Sometimes ‘research’ means browsing the folders of the ‘installed ‘target’ and… just executing programs present inside these directories to see what they do.
During this very engaging and fascinating activity I noticed that the program:
c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\OSSLLibs\AdobeFips.exe
produces a very familiar output:
Yup, it is the OpenSSL client signed by Adobe:
Verified: Signed Signing date: 10:59 2024-01-13 Publisher: Adobe Inc. Company: The OpenSSL Project, https://www.openssl.org/ Description: OpenSSL application Product: The OpenSSL Toolkit Prod version: 3.0.10 File version: 3.0.10 MachineType: 32-bit
so, one can run f.ex.:
AdobeFips.exe s_client -connect domain:port
to connect to the domain and download stuff (f.ex. via GET request), plus any other rich features OpenSSL offers (download, encryption, reverse shell, etc.).