Public release

This commit is contained in:
Rémi GASCOU (Podalirius)
2026-03-20 14:22:53 +01:00
commit 681ee5efa2
26 changed files with 66 additions and 0 deletions
+4
View File
@@ -0,0 +1,4 @@
# These are supported funding model platforms
github: p0dalirius
patreon: Podalirius
Binary file not shown.

After

Width:  |  Height:  |  Size: 564 KiB

+19
View File
@@ -0,0 +1,19 @@
![](./.github/header.png)
## Slides
The slides of this talk can be found here: [SpecterOps - Shift Happens - Uncovering two builtin command injections in Windows context menus .pdf](./SpecterOps%20-%20Shift%20Happens%20-%20Uncovering%20two%20builtin%20command%20injections%20in%20Windows%20context%20menus%20.pdf)
## Scenarios
- [SH01 - Folder with payload in its name](./Scenarios/SH01%20-%20Folder%20with%20payload%20in%20its%20name/)
- [SH02 - Shortcut to a folder with payload in its name](./Scenarios/SH02%20-%20Shortcut%20to%20a%20folder%20with%20payload%20in%20its%20name/)
- [SH03 - Background of the explorer window of a folder with a payload in its name](./Scenarios/SH03%20-%20Background%20of%20the%20explorer%20window%20of%20a%20folder%20with%20a%20payload%20in%20its%20name/)
- [SH04 - Background of the explorer window of a folder with a payload in one of its parent's folders](./Scenarios/SH04%20-%20Background%20of%20the%20explorer%20window%20of%20a%20folder%20with%20a%20payload%20in%20one%20of%20its%20parent%27s%20folders/)
- [SH05 - A user with a payload in its name](./Scenarios/SH05%20-%20A%20user%20with%20a%20payload%20in%20its%20name/)
- [SH06 - Bring your own payload (exe)](./Scenarios/SH06%20-%20Bring%20your%20own%20payload%20%28exe%29/)
- [SH07 - Bring your own payload (ps script)](./Scenarios/SH07%20-%20Bring%20your%20own%20payload%20%28ps%20script%29/)
## Contributing
Feel free to open a pull request if you have a different scenario to propose.
@@ -0,0 +1,5 @@
# SH01: Folder with payload in its name
![](./assets/sh01-1.png)
![](./assets/sh01-2.png)
Binary file not shown.

After

Width:  |  Height:  |  Size: 922 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 349 KiB

@@ -0,0 +1,5 @@
# SH02 - Shortcut to a folder with payload in its name
![](./assets/sh02-1.jpg)
![](./assets/sh02-2.jpg)
@@ -0,0 +1,5 @@
# SH03 - Background of the explorer window of a folder with a payload in its name
![](./assets/sh03-1.png)
![](./assets/sh03-2.png)
Binary file not shown.

After

Width:  |  Height:  |  Size: 299 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 187 KiB

@@ -0,0 +1,5 @@
# SH04 - Background of the explorer window of a folder with a payload in one of its parent's folders
![](./assets/sh04-1.png)
![](./assets/sh04-2.png)
@@ -0,0 +1,7 @@
# SH05 - A user with a payload in its name
![](./assets/sh05-1.png)
![](./assets/sh05-2.png)
![](./assets/sh05-3.png)
Binary file not shown.

After

Width:  |  Height:  |  Size: 641 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1013 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 120 KiB

@@ -0,0 +1,8 @@
# SH06 - Bring your own payload (exe)
![](./assets/sh06-tree.png)
![](./assets/sh06-1.png)
![](./assets/sh06-2.png)
Binary file not shown.

After

Width:  |  Height:  |  Size: 936 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 548 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 44 KiB

@@ -0,0 +1,8 @@
# SH07 - Bring your own payload (ps script)
![](./assets/sh07-tree.png)
![](./assets/sh07-1.png)
![](./assets/sh07-2.png)
Binary file not shown.

After

Width:  |  Height:  |  Size: 935 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 665 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 37 KiB