CatalogLOLBAS

LOL · Library

Shell32.dll

4 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Launch a DLL payload by calling the Control_RunDLL function.

Use Load a DLL payload.

rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch an executable by calling the ShellExec_RunDLL function.

Use Run an executable payload.

rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch command line by calling the ShellExec_RunDLL function.

Use Run an executable payload.

rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.

Use Load a DLL/CPL payload.

rundll32.exe shell32.dll,#44 {PATH:.dll}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute