Category Archives: Anti-Forensics

Sitting on the Lolbins, 1

Posted on by

I recently mentioned that I am sitting on quite a few lolbins, and was asked to share, so here’s the first batch – at least 6 of them 🙂

c:\Program Files\HP\<model>\
\Bin\<model>.exe
\Bin\HPCustParticUI.exe
\Bin\hpqDTSS.exe
\Bin\InstanceFinderDlg.exe
\Bin\ScanToPCActivationApp.exe
\Bin\Toolbox.exe

where <model> means the actual HP printer model e.g. HP OfficeJet Pro 8710:

c:\Program Files\HP\HP OfficeJet Pro 8710\Bin\HP OfficeJet Pro 8710.exe

All of them take a nice command line argument -uiDll, e.g.:

Toolbox.exe -uiDll c:\Test\test.dll

This loads and executes your DLL of choice 🙂

Notably, there are a few more executables in the same directory that can be used for this purpose:

\Bin\DigitalWizards.exe
\Bin\FaxApplications.exe
\Bin\HPRewards.exe

but they require additional command line arguments that I have not figured out yet.

Beyond good ol’ Run key, Part 111

Posted on by

I came across this entry by a pure chance. I was testing some software (sorry, can’t reveal which one) and noticed that at some stage it tried to read the following WOW6432Node entry from the Registry:

HKLM\SOFTWARE\WOW6432Node\Microsoft\BidInterface\Loader
:Path=?

Of course, anytime I see something like this I immediately test it as it is an opportunity to document yet another persistence mechanism. My quick test confirmed we can modify this value to load our DLL of choice when the aforementioned software starts.

Now… this entry is not software-specific. In fact, the tested software does talk to the databases a lot. And after a quick googling exercise I discovered why I saw this artifact in my logs – the key is documented and is used for ADO.NET Tracing.

Of course, it works in a non-WOW set up too:

HKLM\SOFTWARE\Microsoft\BidInterface\Loader
:Path=?

So you can either do the tracing, or load a badness. Your choice.