From 100042b44f7ef310a9cadae5b9f21d4aed35e756 Mon Sep 17 00:00:00 2001 From: giMini Date: Mon, 23 Apr 2018 17:00:15 -0400 Subject: [PATCH 1/2] Create Nvudisp.md --- OtherBinaries/Nvudisp.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 OtherBinaries/Nvudisp.md diff --git a/OtherBinaries/Nvudisp.md b/OtherBinaries/Nvudisp.md new file mode 100644 index 0000000..62cffed --- /dev/null +++ b/OtherBinaries/Nvudisp.md @@ -0,0 +1,37 @@ +## Nvudisp.exe + +* Functions: Execute, Copy, Add registry, Create shortcut, kill process + +``` +Nvudisp.exe System calc.exe + +Nvudisp.exe Copy test.txt,test-2.txt + +Nvudisp.exe SetReg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\malware=malware.exe + +Nvudisp.exe CreateShortcut test.lnk,"Test","c:\windows\system32\calc.exe","","c:\windows\system32" + +Nvudisp.exe KillApp calculator.exe + +Nvudisp.exe Run foo +``` + +Acknowledgements: +* Pierre-Alexandre Braeken - @pabraeken + +Code sample: +* + +Resources: +* http://sysadminconcombre.blogspot.ca/2018/04/run-system-commands-through-nvidia.html + +Full path: +``` +? +``` + +Notes: + + + + From a3163bd36810d9df81c580535aa2cda1c2bc26a3 Mon Sep 17 00:00:00 2001 From: giMini Date: Mon, 23 Apr 2018 17:00:24 -0400 Subject: [PATCH 2/2] Update LOLBins.md --- LOLBins.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LOLBins.md b/LOLBins.md index 559e848..37373fd 100644 --- a/LOLBins.md +++ b/LOLBins.md @@ -77,7 +77,7 @@ If you are missing from the acknowledgement, please let me know (I did not forge # OTHER NON MICROSOFT BINARIES [Nvuhda6.exe](OtherBinaries/Nvuhda6.md) - +[Nvudisp.exe](OtherBinaries/Nvudisp.md)