.. /Advpack.dll
Star

AWL bypass (INF)
Execute (DLL)

Utility for installing software and drivers with rundll32.exe


Paths:

Resources:
Acknowledgements:

Detection:

AWL bypass

  1. Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

    rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,
    Use case
    Run local or remote script(let) code through INF file specification.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011

  2. Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).

    rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,,1,
    Use case
    Run local or remote script(let) code through INF file specification.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011
    Tags
    Input: INF
    This function was tagged with "Input: INF".

Execute

  1. Launch a DLL payload by calling the RegisterOCX function.

    rundll32.exe advpack.dll,RegisterOCX test.dll
    Use case
    Load a DLL payload.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).

  2. Launch an executable by calling the RegisterOCX function.

    rundll32.exe advpack.dll,RegisterOCX calc.exe
    Use case
    Run an executable payload.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011

  3. Launch command line by calling the RegisterOCX function.

    rundll32 advpack.dll, RegisterOCX "cmd.exe /c calc.exe"
    Use case
    Run an executable payload.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011