In this series I describe a lot of Windows persistence mechanisms. Most of them are ‘native’ to the OS, but I sometimes cover opportunities offered by popular software too. Today’s case is one of these.<\/p>\n\n\n\n
Ghostscript<\/a> is a superpopular:<\/p>\n\n\n\n suite of software based on an interpreter for Adobe Systems’ PostScript and Portable Document Format (PDF) page description languages<\/p>\n<\/blockquote>\n\n\n\n that can be found installed on many Windows endpoints today. It is often being installed as a dependent component supporting a lot of various applications, including PDF software, games, etc.<\/p>\n\n\n\n What we can find as particularly interesting from a persistence standpoint, is this Registry entry:<\/p>\n\n\n\n Any software relying on Ghostscript will eventually refer to it, and load the DLL this entry points to. As such, it can be leveraged for persistence (proxy DLL).<\/p>\n\n\n\n This mechanism is described in detail here<\/a>.<\/p>\n\n\n\n If you read the linked article, you will notice that there is an alternative way to set the value of GS_DLL by using the environmental variable. This feature can be abused for both persistence and lolbin activities.<\/p>\n","protected":false},"excerpt":{"rendered":" In this series I describe a lot of Windows persistence mechanisms. Most of them are ‘native’ to the OS, but I sometimes cover opportunities offered by popular software too. Today’s case is one of these. Ghostscript is a superpopular: suite … Continue reading \n
(HKCU|HKLM)\\Software\\GPL Ghostscript\\<version>\\GS_DLL=<DLL library><\/pre>\n\n\n\n