Skip to content

Commit 9324a55

Browse files
1 parent 13d75ef commit 9324a55

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

_lolbas/Libraries/Shell32.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,15 @@ Commands:
3131
OperatingSystem: Windows 10, Windows 11
3232
Tags:
3333
- Execute: CMD
34+
- Command: rundll32.exe shell32.dll,#44 {PATH:.dll}
35+
Description: Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.
36+
Usecase: Load a DLL/CPL payload.
37+
Category: Execute
38+
Privileges: User
39+
MitreID: T1218.011
40+
OperatingSystem: Windows 10, Windows 11
41+
Tags:
42+
- Execute: DLL
3443
Full_Path:
3544
- Path: c:\windows\system32\shell32.dll
3645
- Path: c:\windows\syswow64\shell32.dll
@@ -43,8 +52,9 @@ Resources:
4352
- Link: https://twitter.com/mattifestation/status/776574940128485376
4453
- Link: https://twitter.com/KyleHanslovan/status/905189665120149506
4554
- Link: https://windows10dll.nirsoft.net/shell32_dll.html
55+
- Link: https://www.hexacorn.com/blog/2025/05/18/shell32-dll-44-lolbin/
4656
Acknowledgement:
47-
- Person: Adam (Control_RunDLL)
57+
- Person: Adam (Control_RunDLL, Control_RunDLLNoFallback)
4858
Handle: '@hexacorn'
4959
- Person: Pierre-Alexandre Braeken (ShellExec_RunDLL)
5060
Handle: '@pabraeken'

0 commit comments

Comments
 (0)