{"id":6696,"date":"2019-08-25T23:01:29","date_gmt":"2019-08-25T23:01:29","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6696"},"modified":"2019-08-25T23:01:31","modified_gmt":"2019-08-25T23:01:31","slug":"sitting-on-the-lolbins-6","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/08\/25\/sitting-on-the-lolbins-6\/","title":{"rendered":"Sitting on the Lolbins, 6"},"content":{"rendered":"\n<p>So many lolbins&#8230;<\/p>\n\n\n\n<p>There is a class of Dell-written launchers that are very demanding. In order to use any of them to launch a program we need to use a 6-level directory traversal.<\/p>\n\n\n\n<p>Why?<\/p>\n\n\n\n<p>Because it relies on <em><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/printdocs\/getprinterdriverdirectory\">GetPrinterDriverDirectory<\/a><\/em> API to retrieve a path where the file it expects to see will be launched from (the path resolves to <em>C:\\Windows\\system32\\spool\\DRIVERS\\W32X86<\/em> on 32-bit Windows). And then, depending on the OS major version (<em>5<\/em> or <em>6<\/em>), it appends additional subfolder path (<em>2<\/em> or <em>3<\/em>) to it. <\/p>\n\n\n\n<p>In other words, to run <em>c:\\windows\\system32\\notepad.exe<\/em>, one has to run the following:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>&lt;sample> ..\\..\\..\\..\\..\\..\\windows\\system32\\notepad.exe<\/p><\/blockquote>\n\n\n\n<p>Samples:<br>0B7F97EC4792A65D5DFA596F2693E8ADBFBDBA340BF300BDB761B483D6922FF9<br>E11DFC77E4B9570425FAAAC65B26070448E83EB7B9451AA5A9B0B61F1E8FBCA6<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So many lolbins&#8230; There is a class of Dell-written launchers that are very demanding. In order to use any of them to launch a program we need to use a 6-level directory traversal. Why? Because it relies on GetPrinterDriverDirectory API &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/08\/25\/sitting-on-the-lolbins-6\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,56,64,59],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6696"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6696"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6696\/revisions"}],"predecessor-version":[{"id":6699,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6696\/revisions\/6699"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}