In their presentation, they showcase a method for launching remote SCT via INF by invoking InstallHinfSection with the following command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 Let’s dive in… Malicious INF-SCT Usage with InstallHinfSectionĪt Derb圜on 2017, and of a very interesting topic – Evading AutoRuns. Methods for launching script component files (‘.sct’) via INF configuration files include InstallHinfSection (setupapi.dll), CMSTP, and LaunchINFSection (advpack.dll). Additionally, we’ll reference other techniques for remote script/scriptlet execution.

In this post, we’ll discuss several known INF-SCT launch methods, introduce LaunchINFSection, and dive into use cases/defensive considerations. In particular, I was curious to see if there were potentially new ways to invoke remote scripts (ActiveX Objects) by leveraging some of the great research already performed and documented by and There were some interesting findings, but the one that really stood out was the discovery of LaunchINFSection, a ‘new’ method to remotely launch staged SCT files configured within INF files. Command: rundll32 advpack.dll, RegisterOCX 'cmd.exe /c calc.exe'ĭescription: Launch command line by calling the RegisterOCX function.Over the last few weeks, I researched and tested a few interesting namespaces/methods documented on various Microsoft/MSDN sources that dealt with executing various COM scripts/scriptlets (e.g. Command: rundll32.exe advpack.dll,RegisterOCX calc.exeĭescription: Launch an executable by calling the RegisterOCX function. Command: rundll32.exe advpack.dll,RegisterOCX test.dllĭescription: Launch a DLL payload by calling the RegisterOCX function. inf file by calling an information file directive (DefaultInstall section implied). Command: rundll32.exe advpack.dll,LaunchINFSection c: est.inf,1,ĭescription: Execute the specified (local or remote). Usecase: Run local or remote script(let) code through INF file specification. inf file by calling an information file directive (section name specified). Command: rundll32.exe advpack.dll,LaunchINFSection c: est.inf,DefaultInstall_SingleUser,1,ĭescription: Execute the specified (local or remote). Description: Utility for installing software and drivers with rundll32.exe

Rundll32 exe advpack