akde/infosec

Information security is ultimately about managing risk


The Win­dows Appli­ca­tion Com­pat­i­bil­i­ty Frame­work (shim­ming) pro­vides a way to change the sys­tem behav­iour for an appli­ca­tion in order to func­tion like in old­er sys­tems. It works via the IAT Import address Table at load time and can change func­tions, library address­es etc. this way.

Creating a shim

A shim can be reg­is­tered with the sys­tem via a data­base file with exten­sion .sdb under C:\Windows\AppPatch via sbdinst.exe file.sdb.

The Inject­DLL was removed from mod­ern ADKs! How­ev­er, the 32-Bit Com­pa­bil­i­ty Admin­is­tra­tor still has it.

  1. Down­load the Win­dows ADK
  2. Open the Com­pa­bil­i­ty Administrator
  3. In Cus­tom Data­bas­es, right click and add new fix
  4. Choose Inject­DLL and click to Para­me­ters and add the full path of the DLL.
  5. In Match­ing Infor­ma­tion, des­e­lect every­thing except the name.
  6. Save the new Data­base. You have a new sdb file.
  7. Reg­is­ter the new file with sbdinst file.sdb.
  8. Wait for execution..

Leave a Reply

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';