{"id":6944,"date":"2020-01-24T18:54:20","date_gmt":"2020-01-24T18:54:20","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6944"},"modified":"2020-01-24T20:09:18","modified_gmt":"2020-01-24T20:09:18","slug":"how-to-be-a-bad-ctor","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/01\/24\/how-to-be-a-bad-ctor\/","title":{"rendered":"how to be a bad ctor"},"content":{"rendered":"\n<p>If you have any app installed that utilizes InstallShield for deployment the chances are that you may have a Ctor.dll file present on the system.<\/p>\n\n\n\n<p>The nice bit about this library is that it exports a function called LaunchSetup. You can pass any file name to it and you will have it running in no time; that is:<\/p>\n\n\n\n<p>RunDll32.exe c:\\test\\ctor.dll, LaunchSetup &lt;program&gt;<\/p>\n\n\n\n<p>There is one caveat though. You won&#8217;t be able to run Calculator or Notepad applications this way. This is because the function makes a copy of the program file provided from command line to the %TEMP% directory first, and launches it from there. As such, programs that rely on .MUI files to run (e.g. OS GUI-based programs like Notepad, Calculator) need them to be copied to that very same %TEMP% folder as well. But running Calc is not really the point of LOLBINS, isn&#8217;t it? \ud83d\ude09<\/p>\n\n\n\n<p>Typical ctor.dll locations:<\/p>\n\n\n\n<ul><li>C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\engine\\6\\INTEL3~1\\Ctor.dll<\/li><li> C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\PROFES~1\\RunTime\\&lt;number>\\Intel32\\Ctor.dll<\/li><li> C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\PROFES~1\\RunTime\\&lt;number>\\&lt;number>\\Intel32\\Ctor.dll<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>If you have any app installed that utilizes InstallShield for deployment the chances are that you may have a Ctor.dll file present on the system. The nice bit about this library is that it exports a function called LaunchSetup. You &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/01\/24\/how-to-be-a-bad-ctor\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6944"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6944"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6944\/revisions"}],"predecessor-version":[{"id":6948,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6944\/revisions\/6948"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}