Comments on: Excel with cmd.dll & regedit.dll

By: Exploit writing tutorial part 11 : Heap Spraying Demystified | Corelan Team

Exploit writing tutorial part 11 : Heap Spraying Demystified | Corelan Team — Sun, 01 Jan 2012 06:53:27 +0000

[...] Excel with cmd.dll & regedit.dll [...]

By: Didier Stevens

Didier Stevens — Thu, 15 Dec 2011 22:34:21 +0000

@danielweis A Kiwi neighbor of yours has done that http://blog.didierstevens.com/2011/04/19/signed-spreadsheet-with-cmd-dll-regedit-dll/

By: danielweis

danielweis — Thu, 15 Dec 2011 22:28:02 +0000

Hi There, will you be making your completed spreadsheet with all the macro configuration in it available for download? Great work by the way

By: Didier Stevens

Didier Stevens — Fri, 22 Apr 2011 08:10:55 +0000

@teo I’ve used it in 2 situations:
1) you administer LUA users, you’ve restricted them from using cmd.exe and/or regedit, and now you need to debug an issue in a LUA context.
2) cleaning up an infected PC where the malware prevents you from running tools like cmd.exe and regedit.

By: teo

teo — Thu, 21 Apr 2011 18:30:23 +0000

Can u pls give me an example where I could use this thing? Apart from demonstrating all these techniques. In what situation would that this be useful? Keep “wow-ing” us Didier.

By: Signed Spreadsheet with cmd.dll & regedit.dll « Didier Stevens

Signed Spreadsheet with cmd.dll & regedit.dll « Didier Stevens — Tue, 19 Apr 2011 14:05:54 +0000

[...] Remember my Excel with cmd.dll & regedit.dll? [...]

By: Circumventing SRP and AppLocker, By Design « Didier Stevens

Circumventing SRP and AppLocker, By Design « Didier Stevens — Mon, 24 Jan 2011 00:04:12 +0000

[...] to block this DLL with SRP or AppLocker. But now I found out it’s also easy to bypass this, much easier than what I’ve done before. I just have to replace a call to LoadLibrary with a call to LoadLibraryEx, and pass it argument [...]

By: Prevent Files With These Extensions Running From These Locations...

Prevent Files With These Extensions Running From These Locations... — Sun, 11 Jul 2010 10:20:17 +0000

[...] and wscript.exe? It's also worth mentioning that even after you have done the above, it is still very easy to bypass these restrictions via process injection. I reckon a student could easily do this if they [...]

By: Didier Stevens

Didier Stevens — Fri, 19 Mar 2010 16:36:02 +0000

@sgt Pepper Regedit.dll and cmd.dll run inside the Excel process with new threads. Provided Excel runs under the (elevated) Admin account, regedit will too.

By: sgt Pepper

sgt Pepper — Fri, 19 Mar 2010 16:17:23 +0000

cool stuff. Is the regedit in godmode (admin)?