{"id":7195,"date":"2020-05-23T10:15:35","date_gmt":"2020-05-23T10:15:35","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=7195"},"modified":"2020-05-23T10:51:37","modified_gmt":"2020-05-23T10:51:37","slug":"lolbin-ltd","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/05\/23\/lolbin-ltd\/","title":{"rendered":"Lolbin Ltd"},"content":{"rendered":"\n

This is a lolbin trick that forces programmer to use constrained programming style, hence ‘limited’ in title.<\/p>\n\n\n\n

LaunchTM.exe is a small executable that launches taskmgr.exe. It does so, using a flawed approach as it relies on an environment variable-based path: <\/p>\n\n\n\n

%WINDIR%\\System32\\Taskmgr.exe <\/pre>\n\n\n\n
We can change this variable to whatever path we want and as such, LaunchTM.exe will execute <ourpath>\\system32\\taskmgr.exe program.<\/p>\n\n\n\n
The only caveat is that some common DLLs (e.g. responsible for GUI) rely internally on %WINDIR% being set properly. To ensure the program doesn’t crash the best course of action is to write taskmgr.exe to be statically independent from too many libraries i.e. relying on ntdll.dll, and perhaps kernel32.dll only. Once program starts it can fix the environment variable be able to load other libraries.<\/p>\n\n\n\n
Example in action:<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
and taskmgr.exe in action:<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"
This is a lolbin trick that forces programmer to use constrained programming style, hence ‘limited’ in title. LaunchTM.exe is a small executable that launches taskmgr.exe. It does so, using a flawed approach as it relies on an environment variable-based path: … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7195"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7195"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7195\/revisions"}],"predecessor-version":[{"id":7205,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7195\/revisions\/7205"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}