{"id":10271,"date":"2025-12-06T09:46:26","date_gmt":"2025-12-06T09:46:26","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10271"},"modified":"2025-12-07T00:01:27","modified_gmt":"2025-12-07T00:01:27","slug":"1-little-secret-of-cliconfg-dll","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2025\/12\/06\/1-little-secret-of-cliconfg-dll\/","title":{"rendered":"1 little secret of cliconfg.dll"},"content":{"rendered":"\n<p>Most of my favorite sideloading techniques rely on some old and kinda obscure localisation\/test features embedded in various programming frameworks.<\/p>\n\n\n\n<p>This post touches on yet another one of these.<\/p>\n\n\n\n<p>When you launch this function:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rundll32 cliconfg.dll, OnInitDialogMain<\/pre>\n\n\n\n<p>the code of the DllMain of this DLL library will try to find the following localisation RLL files:<\/p>\n\n\n\n<ul>\n<li>C:\\WINDOWS\\system32\\Resources\\1024\\cliconfg.RLL<\/li>\n\n\n\n<li>C:\\WINDOWS\\system32\\Resources\\1033\\cliconfg.RLL<\/li>\n<\/ul>\n\n\n\n<p>What is surprising though, these files are loaded via a regular <em>LoadLibrary<\/em> call, which obviously leads to a code execution&#8230;<\/p>\n\n\n\n<p>So, placing your payload in any of these two RLL files, and executing any of the APIs exported by <em>cliconfg.dll<\/em>, will lead to loading and execution of these payloads. And if you know how <em>rundll32.exe<\/em> works, and paid attention to the bit mentioning DllMain being responsible for loading these localisation libraries, you know that we can specify any API name, or ordinal number, and get the payload execution anyway, As such, as long as our RLL files are in place, any of the below invocations will load the payload:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rundll32 cliconfg.dll, foo\nrundll32 cliconfg.dll, bar\nrundll32 cliconfg.dll, #1\nrundll32 cliconfg.dll, #3948794357847857<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Most of my favorite sideloading techniques rely on some old and kinda obscure localisation\/test features embedded in various programming frameworks. This post touches on yet another one of these. When you launch this function: rundll32 cliconfg.dll, OnInitDialogMain the code of &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2025\/12\/06\/1-little-secret-of-cliconfg-dll\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[126,131,61],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10271"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10271"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10271\/revisions"}],"predecessor-version":[{"id":10272,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10271\/revisions\/10272"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}