Previously we saw how Windows Run Line searches in App Paths registry keys before PATH. We can perform a silly attack and create a registry key for an application in path and point it to another command.
This is a silly attack because we need to be admin to create/edit those keys. But if you ever find yourself in the unlikely situation, you can use this to become delayed admin (i.e. wait for admin to run the app via Run Line).
This also serves as a tutorial note for using PowerShell to list/manipulate registry.
Let"s pick notepad which is in PATH and point it to calc. Open an admin PowerShell prompt.
$ New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"
$ Set-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\notepad.exe"
$ New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\notepad.exe"
ls/gci/Get-ChildItem do not list the properties, only registry keys.
$ ls -path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\"
$ ls -path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\notepad.exe"
We need to get each property one by one (or use a PS script to run $Key.GetValueNames() and iterate over them).
Now open up Run Line and enter notepad to see calc pop up.
Silly attack because only admins can edit those registry keys.