Lolbins for connoisseurs…

We are all quite fixated on a purity of lolbins. Best if it is a hidden/undocumented/unexpected behavior of a native OS binary that can be abused for some nefarious purposes. I, obviously, love these the most, too.

However…

Living Off The land’s scope should be wide.

Take a compression utility as an example: zip, bzip2, 7z and their variations. It’s a lame example, but it serves the purpose of demonstration well. There are many software packages out there today. There is a subset of them that are being quite popular. And there is a subset of software packages that are quite popular that install a compression utility…

Let’s have a look at a sample of ‘interesting’ paths:

  • %program files%\2printer\7z.exe
  • %program files%\advanced system optimizer 3\updater\extract\7z.exe
  • %program files%\aiseesoft studio\aiseesoft ipad transfer\7z.exe
  • %program files%\aunsoft\aunsoft dvd ripper\zip.exe
  • %program files%\aunsoft\aunsoft transmxf\zip.exe
  • %program files%\aunsoft\aunsoft video converter\zip.exe
  • %program files%\auntec\ifonebox\7z.exe
  • %program files%\docufreezer\7z.exe
  • %program files%\driver tuneup\dp\7z.exe
  • %program files%\driver updater\dp\7z.exe
  • %program files%\dvdfab media player 3\7za.exe
  • %program files%\dvdfab passkey\7za.exe
  • %program files%\epson\sl-d700\common\7za.exe
  • %program files%\fastneuron inc\backupchain\7za.exe
  • %program files%\fengtao software inc.\ifonerestore\7z.exe
  • %program files%\filetiger\zip.exe
  • %program files%\getnzb\7z.exe
  • %program files%\gimp*\bin\bzip2.exe
  • %program files%\gimp*\bin\minigzip.exe
  • %program files%\git\usr\bin\bzip2.exe
  • %program files%\git\usr\bin\gzip.exe
  • %program files%\git\mingw64\bin\bzip2.exe
  • %program files%\globalshareware\ifonemate\7z.exe
  • %program files%\greatis\regrunsuite\7za.exe
  • %program files%\imyfone\imyfone tunesfix\7z.exe
  • %program files%\intelligent converters\demos\zip.exe
  • %program files%\intel\phone flash tool\7z.exe
  • %program files%\kingo root\tools\7z.exe
  • %program files%\moyea\dvd4web converter\7z.exe
  • %program files%\my-bp\zip.exe
  • %program files%\my-pf\zip.exe
  • %program files%\ospeedy batch photo processor\7za.exe
  • %program files%\pa file sight\7za.exe
  • %program files%\pa storage monitor\7za.exe
  • %program files%\radarsync\updater\extract\7z.exe
  • %program files%\radioboss\7za.exe
  • %program files%\raxco\perfectupdater\updater\extract\7z.exe
  • %program files%\systweak\netbook optimizer\updater\extract\7z.exe
  • %program files%\tenorshare ibackupunlocker\7z\7z.exe
  • %program files%\unhackme\7za.exe
  • %program files%\winzip driver updater\updater\extract\7z.exe
  • %program files%\wise\wise driver care\7z.exe
  • %program files%\wondershare\dr.fone\addins\recovery\extractor\7z.exe

While most of these are not necessarily the most popular ever, there are people downloading and installing these…

And compression utilities are not the only tools we may find, f.ex. some software install curl.exe and wget.exe – how cool is that?

  • %program files%\git\mingw64\bin\curl.exe
  • %program files%\hp\pfp_guide\wget.exe
  • %program files%\pa file sight\wget.exe
  • %program files%\pa storage monitor\wget.exe
  • %program files%\printfil\wget.exe
  • %program files%\wondershare\dr.fone\addins\recovery\wget.exe

Need a mysql dump? here it is:

  • %program files%\memberties\server\bin\mysqldump.exe

VNC?

There you go:

  • %localappdata%\crossloop\winvnc.exe
  • %program files%\crossloop\winvnc.exe
  • %program files%\hammer software\metalan administrator 2\vnc\tightvnc3\winvnc.exe
  • %userappdata%\design master software\remote support\vnc.exe
  • c:\tcafe\tcvnc.exe

And if you need any more examples, remember my NVIDIA Uninstallers post from 2017.

This LOLBIN doesn’t exist…

I have written about Nullsoft installer a few times before. I am a bit fascinated by it, because there is not that much research about it, in general, and even less – about its esoteric, yet omnipresent DLL plug-ins…

One of the more interesting plug-ins that I know of, and yet, one that you will never really see residing on any system, is… ShellDispatch.dll.

It’s a rarely used Nullsoft Plug-In DLL that is known to be used by the installer of WinAmp, yes.. THE WinAmp… and even there… it is used temporarily, as it is immediately deleted from the file system after delivering the required functionality.

What’s so special about it?

The ShellDispatch.dll exports a few functions:

  • AddRef
  • GetInterface
  • Release
  • RunDll_ShellExecuteW
  • ShellExecute

The RunDll_ShellExecuteW is the most interesting to us as it is a callback function specifically crafted to respond to invocations via rundll32.exe, and since it’s a wrapper for ShellExecute API we can use it to launch any program of our choice, f.ex, calculator:

rundll32 ShellDispatch.dll, RunDll_ShellExecute open calc

Again, the chances you will ever see it abused are VERY LOW.