{"id":8572,"date":"2023-06-07T21:54:04","date_gmt":"2023-06-07T21:54:04","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=8572"},"modified":"2023-06-07T21:54:04","modified_gmt":"2023-06-07T21:54:04","slug":"this-lolbin-doesnt-exist","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/06\/07\/this-lolbin-doesnt-exist\/","title":{"rendered":"This LOLBIN doesn&#8217;t exist&#8230;"},"content":{"rendered":"\n<p>I have written about <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/06\/26\/enter-sandbox-part-6-the-nullsoft-hypothesis-and-other-installers-conundrums\/\" data-type=\"post\" data-id=\"3122\">Nullsoft<\/a> <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/04\/14\/signed-nullsoft-plug-ins-potential-lolbins\/\" data-type=\"post\" data-id=\"6188\">installer<\/a> a few times before. I am a bit fascinated by it, because there is not that much research about it, in general, and even less &#8211; about its esoteric, yet omnipresent DLL plug-ins&#8230;<\/p>\n\n\n\n<p>One of the more interesting plug-ins that I know of, and yet, one that you will never really see residing on any system, is&#8230; <em>ShellDispatch.dll<\/em>.<\/p>\n\n\n\n<p>It&#8217;s a rarely used Nullsoft Plug-In DLL that is known to be used by the installer of WinAmp, yes.. THE WinAmp&#8230; and even there&#8230; it is used temporarily, as it is immediately deleted from the file system after delivering the required functionality.<\/p>\n\n\n\n<p>What&#8217;s so special about it?<\/p>\n\n\n\n<p>The <em>ShellDispatch.dll<\/em> exports a few functions:<\/p>\n\n\n\n<ul><li>AddRef<\/li><li>GetInterface<\/li><li>Release<\/li><li>RunDll_ShellExecuteW<\/li><li>ShellExecute<\/li><\/ul>\n\n\n\n<p>The <em>RunDll_ShellExecuteW<\/em> is the most interesting to us as it is a callback function specifically crafted to respond to invocations via <em>rundll32.exe<\/em>, and since it&#8217;s a wrapper for <em>ShellExecute <\/em>API we can use it to launch any program of our choice, f.ex, calculator:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rundll32 ShellDispatch.dll, RunDll_ShellExecute open calc<\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2023\/06\/ShellDispatch.gif\"><img decoding=\"async\" loading=\"lazy\" width=\"456\" height=\"587\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2023\/06\/ShellDispatch.gif\" alt=\"\" class=\"wp-image-8573\"\/><\/a><\/figure>\n\n\n\n<p>Again, the chances you will ever see it abused are VERY LOW.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I have written about Nullsoft installer a few times before. I am a bit fascinated by it, because there is not that much research about it, in general, and even less &#8211; about its esoteric, yet omnipresent DLL plug-ins&#8230; One &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/06\/07\/this-lolbin-doesnt-exist\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8572"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=8572"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8572\/revisions"}],"predecessor-version":[{"id":8574,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8572\/revisions\/8574"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=8572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=8572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=8572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}