{"id":3006,"date":"2015-04-26T10:24:45","date_gmt":"2015-04-26T10:24:45","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3006"},"modified":"2015-04-26T10:24:45","modified_gmt":"2015-04-26T10:24:45","slug":"beyond-good-ol-run-key-part-30","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/04\/26\/beyond-good-ol-run-key-part-30\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 30"},"content":{"rendered":"<p>Many laptops come with preinstalled packages that enhance user experience by responding to gestures and shortcuts available via a touchpad. One of the most popular packages offering such functionality comes from Synaptics. My old laptop has it preinstalled as well and&#8230; that&#8217;s how this post was born.<\/p>\n<p>While exploring the options of the program I discovered that you can associate a lot of various actions with buttons and areas\/zones of the touchpad. Turns out that one such interesting action is&#8230; running an arbitrary program \ud83d\ude42<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3007\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics1-300x223.png\" alt=\"synaptics1\" width=\"300\" height=\"223\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics1-300x223.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics1.png 622w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>Clicking the Configure button allows us to choose the path to the program:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3008\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics2-300x144.png\" alt=\"synaptics2\" width=\"300\" height=\"144\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics2-300x144.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics2.png 461w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>Same goes for the right button (and also zones shown at the bottom of the left pane):<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3009\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics3-300x223.png\" alt=\"synaptics3\" width=\"300\" height=\"223\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics3-300x223.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics3.png 622w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>Once I configured these I was able to launch the program of my choice by just playing with the touchpad.<\/p>\n<p>I must mention that it is not a vulnerability &#8211; it is just a flexibility offered by the program allowing user to define what they want to do with their computer. But of course it could be abused as a persistence mechanism.<\/p>\n<p>The place in the Registry where these paths are stored is shown below:<\/p>\n<ul>\n<li>HKCU\\Software\\Synaptics\\SynTPEnh\\PlugInConfig\\TouchPadPS2<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics4.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3010\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics4-300x72.png\" alt=\"synaptics4\" width=\"300\" height=\"72\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics4-300x72.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics4-598x145.png 598w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics4.png 607w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>The information about what action should be triggered is stored here:<\/p>\n<ul>\n<li>HKCU\\Software\\Synaptics\\SynTP\\TouchPadPS2\n<ul>\n<li>LeftButtonAction = if equal 0 the default touchpad action is overridden with the action of the plugin defined by the next 2 entries below (LeftButtonPlugInID &amp; LeftButtonPlugInActionID)<\/li>\n<li>LeftButtonPlugInID = changed to &#8216;SynTP&#8217;<\/li>\n<li>LeftButtonPlugInActionID = if this ActionID is equal to 5 then it is program execution<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics5.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3011\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics5-300x60.png\" alt=\"synaptics5\" width=\"300\" height=\"60\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics5-300x60.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/04\/synaptics5.png 728w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a>Right button (and other buttons, if present)\u00a0 as well as zones all have similar set of settings (again, their actual availability depends on a touchpad model\/hardware\/); the respective registry entries are:<\/p>\n<ul>\n<li>TopLeftCornerPlugInID=<\/li>\n<li>TopRightCornerPlugInID=<\/li>\n<li>BottomLeftCornerPlugInID=<\/li>\n<li>BottomRightCornerPlugInID=<\/li>\n<li>LeftButtonPlugInID=<\/li>\n<li>MiddleButtonPlugInID=<\/li>\n<li>RightButtonPlugInID=<\/li>\n<li>UpButtonPlugInID=<\/li>\n<li>DownButtonPlugInID=<\/li>\n<li>2FingerTapPlugInID=<\/li>\n<li>3FingerTapPlugInID=<\/li>\n<li>ExButton1PlugInID=<\/li>\n<li>ExButton2PlugInID=<\/li>\n<li>ExButton3PlugInID=<\/li>\n<li>ExButton4PlugInID=<\/li>\n<li>ExButton5PlugInID=<\/li>\n<li>ExButton6PlugInID=<\/li>\n<li>ExButton7PlugInID=<\/li>\n<li>ExButton8PlugInID=<\/li>\n<li>PressToSelectPlugInID=<\/li>\n<li>Button5PlugInID=<\/li>\n<li>ButtonModePlugInID=<\/li>\n<li>3FingerPressPlugInID=<\/li>\n<li>PalmOnPadPlugInID=<\/li>\n<li>2FingerDoubleTapPlugInID=<\/li>\n<\/ul>\n<p>and each of them have the respective &#8216;ActionID&#8217; settings e.g.:<\/p>\n<ul>\n<li>TopRightCornerPlugInID -&gt; TopRightCornerPlugIn<strong>ActionID<\/strong><\/li>\n<\/ul>\n<p>The chance we will come across it on real cases are pretty low, but just adding it here for completeness.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Many laptops come with preinstalled packages that enhance user experience by responding to gestures and shortcuts available via a touchpad. One of the most popular packages offering such functionality comes from Synaptics. My old laptop has it preinstalled as well &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/04\/26\/beyond-good-ol-run-key-part-30\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3006"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3006"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3006\/revisions"}],"predecessor-version":[{"id":3013,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3006\/revisions\/3013"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}