advpack coverage

plusplusxu · Jul 16, 2018 · 7598e9f · 7598e9f
1 parent 872237d
commit 7598e9f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -36,7 +36,7 @@ The script executes only calc.exe through numerous methods. You can replace this
 | T1047  | Setupapi |
 | T1128  | Shdocvw |
 | T1085  | csc.exe |
-| T1130  |
+| T1130  | advpack.dll |
 | T1191  | 
 | T1202  |
 | T1028  |

diff --git a/runtests.bat b/runtests.bat
@@ -393,6 +393,11 @@ echo Command Excuted: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe /out
 echo Command Excuted: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Csc.exe /out:payload.exe payload.cs
 echo Command Excuted: payload.exe 
 
+echo %time% %date% [+] Testing advpack via rundll32 exec
+start "" cmd /c rundll32.exe advpack.dll,RegisterOCX calc.exe
+echo Execution Finished at %time% %date%
+echo Command Excuted: rundll32.exe advpack.dll,RegisterOCX calc.exe
+
 echo [+] Let tasks finish before killing all the files
 sleep 90