Windows.Storage.lol
2024-11-29 06:28:1 Author: www.hexacorn.com(查看原文) 阅读量:1 收藏

This is a bit surprising, but the recent versions of windows.storage.dll export a number of functions identical with shell32.dll. In fact, shell32.dll imports these windows.storage.dll functions and is basically forwarding the execution to them, and just acting as a proxy.

Thanks to that, one can now call some of the shell32.dll functions directly from windows.storage.dll, f.ex. this well-known lolbin:

rundll32 c:\WINDOWS\system32\shell32.dll, ShellExec_RunDLL calc.exe

can be modified to:

rundll32 c:\WINDOWS\system32\windows.storage.dll, ShellExec_RunDLL calc.exe

文章来源: https://www.hexacorn.com/blog/2024/11/28/windows-storage-lol/
如有侵权请联系:admin#unsafe.sh