{"id":7684,"date":"2021-02-05T23:41:33","date_gmt":"2021-02-05T23:41:33","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=7684"},"modified":"2021-02-06T10:23:50","modified_gmt":"2021-02-06T10:23:50","slug":"desperate-downloader-lolbin","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2021\/02\/05\/desperate-downloader-lolbin\/","title":{"rendered":"Desperate downloader lolbin"},"content":{"rendered":"\n<p>I was toying around with the Office application MSOXMLED.EXE and noticed it handles URLs. Thanks to that it can be used to download file to internet cache folder as shown below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2021\/02\/MSOXMLED.gif\"><img decoding=\"async\" loading=\"lazy\" width=\"1007\" height=\"494\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2021\/02\/MSOXMLED.gif\" alt=\"\" class=\"wp-image-7685\"\/><\/a><\/figure>\n\n\n\n<p>There are at least two different ways to invoke it:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">MSOXMLED.EXE \/verb open [URL]<br>MSOXMLED.EXE \/verb [anything] \/genverb open [URL]<\/pre>\n\n\n\n<p>and the file is being downloaded to the InetCache folder:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">c:\\Users\\[user]\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\[random]\\[file]<\/pre>\n\n\n\n<p>The caveat is that it seems to be using Internet Explorer as a proxy, hence the iexplore.exe will be spawn. As such it doesn&#8217;t work on systems where IE is removed (thx to <a href=\"https:\/\/twitter.com\/NathanMcNulty\">@NathanMcNulty<\/a> for confirming this and reminding me about two different paths below).<\/p>\n\n\n\n<p>The actual MSOXMLED.EXE binary is located in these two places (64- and 32-bit version):<\/p>\n\n\n\n<ul><li>c:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE<\/li><li>c:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE<\/li><\/ul>\n\n\n\n<p>For anyone wondering,<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">MSOXMLED.EXE \/verb open file:\/\/c:\\windows\\notepad.exe<\/pre>\n\n\n\n<p>does work, but we get a dialog box below (rendering this technique useless):<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2021\/02\/MSOXMLED.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2021\/02\/MSOXMLED.png\" alt=\"\" class=\"wp-image-7691\" width=\"512\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2021\/02\/MSOXMLED.png 626w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2021\/02\/MSOXMLED-300x227.png 300w\" sizes=\"(max-width: 626px) 100vw, 626px\" \/><\/a><\/figure>\n\n\n\n<p>It could possibly work with some Registry tweaking, but have not invested time in checking it yet. Other option could be adding other extension handler.<\/p>\n\n\n\n<p>Lame, not very &#8216;finesse&#8217;, but at least documented.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was toying around with the Office application MSOXMLED.EXE and noticed it handles URLs. Thanks to that it can be used to download file to internet cache folder as shown below: There are at least two different ways to invoke &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2021\/02\/05\/desperate-downloader-lolbin\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7684"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7684"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7684\/revisions"}],"predecessor-version":[{"id":7692,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7684\/revisions\/7692"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}