~/bokkapig
hack the box machine writeups

Eudcedit.exe

type: OSBinaries
Private Character Editor Windows Utility

Full path

c:\windows\system32\eudcedit.exe
c:\windows\syswow64\eudcedit.exe

Commands

  1. UAC BypassAdministrator T1548.002

    Execute a binary or script as a high-integrity process without a UAC prompt.

    eudcedit

    Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option “Link with Selected Fonts” and click on Save As, then in the opened enter the command you want to execute.

    os: Windows 10, Windows 11

    Execute: CMDApplication: GUI

Detection

  • IOCProcesses spawned by eudcedit.exe.

Resources

acknowledgement: Matan Bahar @Bl4ckShad3