Skip to content

Create COM persistence using Zoom and zero-width space directories

Notifications You must be signed in to change notification settings

FatRodzianko/ZoomCOMPersist

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

11 Commits
 
 
 
 
 
 

Repository files navigation

ZoomCOMPersist

Create COM persistence using Zoom and zero-width space directories.

Will create a new Zoom directory in the user's %APPDATA% directory and create a new registry key for the {62BE5D10-60EB-11d0-BD3B-00A0C911CE86}. Whenever Zoom.exe is launched, the registry key will be read and your DLL will be loaded and executed by Zoom.

You can read more about this here: https://fatrodzianko.com/2020/07/06/unprivileged-zoom-persistence-part-2-com-hijacking/

Usage

ZoomCOMPersist.exe <base64 encoded DLL file>

If you do not provide base64 encoded bytes of a DLL file, ZoomCOMPersist will create a DLL that startes a new cmd.exe process.

Example: ZoomCOMPersist.exe TVqQA...(snip)...AAAAAA=

Note: If you are running this from a cmd.exe prompt, your base64 encoded DLL will likely be too large to paste in. In a powershell.exe prompt I could paste in a 8kb base64 encoded file. I have not tested this with execute-assembly type functionality like in Cobalt Strike / Covenant so I do not know if it will work in that.

If you are having issues with ZoomCOMPersist reading all of your base64 encoded bytes as an argument, just update the b64Bytes = "TVqQA...(snip)...AAAAAA="; line.

About

Create COM persistence using Zoom and zero-width space directories

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages