CatalogLOLBAS

LOL · Library

Url.dll

6 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Launch a HTML application payload by calling OpenURL.

Use Invoke an HTML Application via mshta.exe (Default Handler).

rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch an executable payload via proxy through a .url (information) file by calling OpenURL.

Use Load an executable payload by calling a .url file.

rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.url}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch an executable by calling OpenURL.

Use Load an executable payload by specifying the file protocol handler (obfuscated).

rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch an executable by calling FileProtocolHandler.

Use Launch an executable.

rundll32.exe url.dll,FileProtocolHandler {PATH_ABSOLUTE:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch an executable by calling FileProtocolHandler.

Use Load an executable payload by specifying the file protocol handler (obfuscated).

rundll32.exe url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch a HTML application payload by calling FileProtocolHandler.

Use Invoke an HTML Application via mshta.exe (Default Handler).

rundll32.exe url.dll,FileProtocolHandler file:///C:/test/test.hta
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute