One Day Sec

How does this technique relate to other exploitation methods for loading DLLs or assemblies, such as Java JNI or .NET Assembly.Load?

This method is conceptually similar to other code-loading techniques like Analysis of Exploitation Techniques for Loading .NET Assemblies from Memory (Assembly.Load) and Java Exploitation Techniques – Loading DLL via JNI, where an application's API is abused to load and execute arbitrary code. The key difference is that RegisterXLL() relies on Microsoft Excel's legitimate functionality, making it stealthy for Office environments.
code loadingDLL injectionJNIAssembly.Loadexploitation techniques

Browse all Q&A →