CatalogLOLBAS

LOL · Binary

Pcwrun.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Open the target .EXE file with the Program Compatibility Wizard.

Use Proxy execution of binary

Pcwrun.exe {PATH_ABSOLUTE:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

Execute

ExecutionWindows

Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

Use Proxy execution of binary

Pcwrun.exe /../../$(calc).exe
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202