🪟 LOLBAS / Shell32.dll

Shell32.dll

Windows Shell Common Dll

Paths

  • c:\windows\system32\shell32.dll
  • c:\windows\syswow64\shell32.dll

Commands

Execute

Launch a DLL payload by calling the Control_RunDLL function.

Use case: Load a DLL payload.

Privileges: User

rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}

Execute

Launch an executable by calling the ShellExec_RunDLL function.

Use case: Run an executable payload.

Privileges: User

rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}

Execute

Launch command line by calling the ShellExec_RunDLL function.

Use case: Run an executable payload.

Privileges: User

rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}

Execute

Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.

Use case: Load a DLL/CPL payload.

Privileges: User

rundll32.exe shell32.dll,#44 {PATH:.dll}

Detection

Resources