diff --git a/LOLLibs.md b/LOLLibs.md index b4fce91..41f433b 100644 --- a/LOLLibs.md +++ b/LOLLibs.md @@ -5,6 +5,7 @@ If you are missing from the acknowledgement, please let me know (I did not forge # OS LIBRARIES [Advpack.dll](OSLibraries/Advpack.md) +[Desk.cpl.dll](OSLibraries/Desk.cpl.md) [Ieadvpack.dll](OSLibraries/Ieadvpack.md) [Ieframe.dll](OSLibraries/Ieframe.md) [Mshtml.dll](OSLibraries/Mshtml.md) diff --git a/OSLibraries/Desk.md b/OSLibraries/Desk.md new file mode 100644 index 0000000..03f1f78 --- /dev/null +++ b/OSLibraries/Desk.md @@ -0,0 +1,25 @@ +## Desk.cpl + +* Functions: Execute + +``` +rundll32.exe Desk.cpl,InstallScreenSaver c:\temp\calc.scr +``` + +Acknowledgements: +* Pierre-Alexandre Braeken - @pabraeken + + +Resources: +* https://twitter.com/pabraeken/status/998627081360695297 + +Full path: +``` +c:\windows\system32\Desk.cpl +c:\windows\sysWOW64\Desk.cpl +``` + +Notes: + + +Detection: diff --git a/OSLibraries/Shell32.md b/OSLibraries/Shell32.md index 14e8fd4..9b67a0f 100644 --- a/OSLibraries/Shell32.md +++ b/OSLibraries/Shell32.md @@ -5,17 +5,20 @@ ``` rundll32.exe shell32.dll,Control_RunDLL payload.dll -rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe +rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe + +rundll32.exe shell32.dll,OpenAs_RunDLL c:\temp\calc.hta ``` Acknowledgements: -* Pierre-Alexandre Braeken - @pabraeken (ShellExec_RunDLL) +* Pierre-Alexandre Braeken - @pabraeken (ShellExec_RunDLL + OpenAs_RunDLL) Code sample: * Resources: * https://twitter.com/pabraeken/status/991768766898941953 +* https://twitter.com/pabraeken/status/998625299976867840 Full path: ```