/OneDriveUpdaterSideloading

Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post

Primary LanguageC++

OneDriveUpdater DLL Sideloading

This repo contains source code for DLL sideloading the version.dll for OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe. The payload is based on the subroutines outlined in the PaloAltoNetworks Unit42's blog post.

My blog post regarding this payload:

version

Modified source code from the proxy DLL created by SharpDLLProxy from Flangvik.

versionConsole

A console version of the above used for debugging purposes. Already contains a messagebox shellcode.

Credits