2018-05-01 13:58:44 +00:00
|
|
|
## Msconfig.exe
|
|
|
|
|
|
|
|
|
|
* Functions: Execute
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
Msconfig.exe -5
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Acknowledgements:
|
|
|
|
|
* Pierre-Alexandre Braeken - @pabraeken
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Resources:
|
|
|
|
|
* https://twitter.com/pabraeken/status/991314564896690177
|
|
|
|
|
|
|
|
|
|
Full path:
|
|
|
|
|
```
|
|
|
|
|
c:\windows\system32\msconfig.exe
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Notes:
|
2018-05-02 06:14:56 +00:00
|
|
|
* Prerequisites
|
|
|
|
|
add a crafted .xml in System32
|
2018-05-01 13:58:44 +00:00
|
|
|
|
2018-05-02 06:14:56 +00:00
|
|
|
```
|
|
|
|
|
<?xml version="1.0" ?>
|
|
|
|
|
<MSCONFIGTOOLS>
|
|
|
|
|
<a NAME="LOLBin" PATH="%windir%\System32\WindowsPowerShell\v1.0\powershell.exe"
|
|
|
|
|
DEFAULT_OPT="-nop -sta -enc -w 1 YOURBASE64" ADV_OPT="-command calc.exe" HELP="LOLBin MSCONFIGTOOLS"/>
|
|
|
|
|
</MSCONFIGTOOLS>
|
|
|
|
|
```
|
2018-05-01 13:58:44 +00:00
|
|
|
|
