{"id":9551,"date":"2024-10-19T22:17:28","date_gmt":"2024-10-19T22:17:28","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9551"},"modified":"2024-10-19T23:57:22","modified_gmt":"2024-10-19T23:57:22","slug":"beyond-good-ol-run-key-part-143","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/10\/19\/beyond-good-ol-run-key-part-143\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 143"},"content":{"rendered":"\n

This entry is a bit convoluted, but it’s still quite interesting. I have discovered it today only to google around and find out someone posted the info about it back in 2013<\/a>. So, I will describe what they did in 2013 + will add one extra bit.<\/p>\n\n\n\n

The trick relies on the way the UserInstStubWrapper <\/em>API exported by advpack.dl<\/em>l \/ IEAdvpack.dll<\/em> works. <\/p>\n\n\n\n

When you execute a command like this:<\/p>\n\n\n\n

rundll32.exe advpack.dll, UserInstStubWrapper test<\/strong><\/pre>\n\n\n\n
the UserInstStubWrapper <\/em>function will read the value from RealStubPath<\/em>:<\/p>\n\n\n\n
HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\test<\/strong>\nRealStubPath=<PATH> (f.ex. c:\\windows\\notepad.exe)<\/pre>\n\n\n\n
and execute the program referenced by it (in this case Notepad).<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
As for the extra, there is a twin function called UserUnInstStubWrapper<\/em>. This one requires admin privileges to run, but it behaves in a similar manner – f.ex. for the command:<\/p>\n\n\n\n
rundll32.exe advpack.dll, UserUnInstStubWrapper test<\/strong><\/pre>\n\n\n\n
it will reach out to Registry and fetch the value of RealStubPath <\/em>as well, but this time the key it accesses will be the name passed via the command line, but slightly modified by adding a suffix .Restore<\/em> to it:<\/p>\n\n\n\n
HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\test<\/strong>.Restore<\/em> \nRealStubPath=<PATH> (f.ex. c:\\windows\\system32\\calc.exe)<\/pre>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
So, a persistence opportunity relies on populating these Registry entries first, and then ensuring one of the following commands is executed during autostart by leveraging any of the existing persistence locations (f.ex. Run key):<\/p>\n\n\n\n
rundll32.exe advpack.dll, UserInstStubWrapper test<\/strong>\nrundll32.exe advpack.dll, UserInstStubWrapper test<\/strong>\nrundll32.exe ieadvpack.dll, UserUnInstStubWrapper test<\/strong>\nrundll32.exe ieadvpack.dll, UserUnInstStubWrapper test<\/strong><\/pre>\n\n\n\n
If we enable the advpack logging<\/a> we can see these test log entries:<\/p>\n\n\n\n
-------------------- advpack.dll is loaded or Attached ------------------------------\nDate: 10\/19\/2024 (mm\/dd\/yyyy)\tTime: 15:11:52 (hh:mm:ss)\nUserInstStubWrapper:\nLaunchAndWait: Cmd=c:\\windows\\notepad.exe\n-------------------- advpack.dll is loaded or Attached ------------------------------\nDate: 10\/19\/2024 (mm\/dd\/yyyy)\tTime: 15:11:58 (hh:mm:ss)\nUserUnInstStubWrapper:\nLaunchAndWait: Cmd=c:\\windows\\system32\\calc.exe\nLaunchAndWait: End hr=0x0, c:\\windows\\system32\\calc.exe\nUserUnInstStubWrapper: End hr=0x0\n-------------------- advpack.dll is unloaded or Detached ----------------------------<\/pre>\n","protected":false},"excerpt":{"rendered":"
This entry is a bit convoluted, but it’s still quite interesting. I have discovered it today only to google around and find out someone posted the info about it back in 2013. So, I will describe what they did in … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,35],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9551"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9551"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9551\/revisions"}],"predecessor-version":[{"id":9555,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9551\/revisions\/9555"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}