You are browsing the archive for Autostart (Persistence).

← Previous Entries

Beyond good ol’ Run key, Part 112

August 16, 2019 in Autostart (Persistence)

This is a pretty ancient persistence trick one can use on systems where IBM’s Java Control Panel is still present.

On these systems you will find Registry Key:

HKLM\SOFTWARE\IBM\Java2 Runtime Environment\
<version>\

and a Value Name underneath called:

JavaHome = <directory>

By changing this value, one can ensure that next time the Control Panel applet is called, the signed CPL file will launch a bin\javacpl.exe program from this path.

In other words, for the example old version 1.6.0 one could change the value name to this:

HKLM\SOFTWARE\IBM\Java2 Runtime Environment\
1.6.0\JavaHome=c:\test

and then drop a malicious c:\Test\bin\javacpl.exe file.

I have not tested it, but I am pretty sure that changing the value of that variable will definitely affect the way Java works, so things will be probably broken, unless proper links to files are established for all the content residing in the actual JavaHome directory.

Yes, it’s ancient, and probably dead by this time + not worth pursuing, but just documenting… because why not.

Comments Off on Beyond good ol’ Run key, Part 112

Beyond good ol’ Run key, Part 111

July 13, 2019 in Anti-Forensics, Autostart (Persistence)

I came across this entry by a pure chance. I was testing some software (sorry, can’t reveal which one) and noticed that at some stage it tried to read the following WOW6432Node entry from the Registry:

HKLM\SOFTWARE\WOW6432Node\Microsoft\BidInterface\Loader
:Path=?

Of course, anytime I see something like this I immediately test it as it is an opportunity to document yet another persistence mechanism. My quick test confirmed we can modify this value to load our DLL of choice when the aforementioned software starts.

Now… this entry is not software-specific. In fact, the tested software does talk to the databases a lot. And after a quick googling exercise I discovered why I saw this artifact in my logs – the key is documented and is used for ADO.NET Tracing.

Of course, it works in a non-WOW set up too:

HKLM\SOFTWARE\Microsoft\BidInterface\Loader
:Path=?

So you can either do the tracing, or load a badness. Your choice.

Comments Off on Beyond good ol’ Run key, Part 111

← Previous Entries