fleet/tools/blackhat-mdm/c2runch_csp/c2runch_csp_registration.reg
Marcos Oviedo d0232561b9
Pushing Blackhat USA 2023 assets for Windows Agentless C2 talk (#13233)
This commit contains the following assets

- Whitepaper
- Slides
- MDM PoC Server
- Exploit Code for CVE-2023-38186
- Sample CSP Boilerplate code
2023-08-08 18:24:50 -07:00

26 lines
1.9 KiB
Reg
Executable File
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CrunchCSP]
"V2CSPNodePath"="./Vendor/MSFT/CrunchCSP"
"WAPNodeProcessor"="{FB11047A-4051-4d1d-9DCA-C80C5DF98D70}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2504E0-4F89-11D3-9A0C-0305E82C3301}]
@="CrunchCSP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2504E0-4F89-11D3-9A0C-0305E82C3301}\InProcServer32]
@="C:\\path\\to\\c2runch_csp.dll"
"ThreadingModel"="Free"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2504E0-4F89-11D3-9A0C-0305E82C3301}\ProgId]
@="CrunchCSP.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2504E0-4F89-11D3-9A0C-0305E82C3301}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2504E0-4F89-11D3-9A0C-0305E82C3301}\VersionIndependentProgId]
@="CrunchCSP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\CSPs\.\Device\Vendor\OEM\CrunchCSP]
@="{3F2504E0-4F89-11D3-9A0C-0305E82C3301}"
"csp_version"="com.microsoft/1.0/MDM/CrunchCSP"