File tree Expand file tree Collapse file tree 1 file changed +11
-1
lines changed
Expand file tree Collapse file tree 1 file changed +11
-1
lines changed Original file line number Diff line number Diff line change @@ -31,6 +31,15 @@ Commands:
3131 OperatingSystem : Windows 10, Windows 11
3232 Tags :
3333 - Execute : CMD
34+ - Command : rundll32.exe shell32.dll,#44 {PATH:.dll}
35+ Description : Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.
36+ Usecase : Load a DLL/CPL payload.
37+ Category : Execute
38+ Privileges : User
39+ MitreID : T1218.011
40+ OperatingSystem : Windows 10, Windows 11
41+ Tags :
42+ - Execute : DLL
3443Full_Path :
3544 - Path : c:\windows\system32\shell32.dll
3645 - Path : c:\windows\syswow64\shell32.dll
@@ -43,8 +52,9 @@ Resources:
4352 - Link : https://twitter.com/mattifestation/status/776574940128485376
4453 - Link : https://twitter.com/KyleHanslovan/status/905189665120149506
4554 - Link : https://windows10dll.nirsoft.net/shell32_dll.html
55+ - Link : https://www.hexacorn.com/blog/2025/05/18/shell32-dll-44-lolbin/
4656Acknowledgement :
47- - Person : Adam (Control_RunDLL)
57+ - Person : Adam (Control_RunDLL, Control_RunDLLNoFallback )
4858 Handle : ' @hexacorn'
4959 - Person : Pierre-Alexandre Braeken (ShellExec_RunDLL)
5060 Handle : ' @pabraeken'
You can’t perform that action at this time.
0 commit comments