.. /Cdb.exe
Star

Execute (Shellcode, CMD)

Debugging tool included with Windows Debugging Tools.

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Launch 64-bit shellcode from the specified .wds file using cdb.exe.

    cdb.exe -cf {PATH:.wds} -o notepad.exe
    Use case
    Local execution of assembly shellcode.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1127
    Tags
    Execute: Shellcode

  2. Attaching to any process and executing shell commands.

    cdb.exe -pd -pn {process_name}
.shell {CMD}
    Use case
    Run a shell command under a trusted Microsoft signed binary
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1127
    Tags
    Execute: CMD

  3. Execute arbitrary commands and binaries using a debugging script (see Resources section for a sample file).

    cdb.exe -c {PATH:.txt} "{CMD}"
    Use case
    Run commands under a trusted Microsoft signed binary
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1127
    Tags
    Execute: CMD