![]() After some research it was identified that a “*.wll” file is essentially a DLL with additional “Office-specific extensions”. This is an archaic extension dating back to the days of Word 97 but appears to still be supported, and there’s little documentation on how to actually create such a file. It can be seen that the purposes of the trusted locations are split between “templates” and “StartUp” functionality.įurther investigation of this “StartUp” trusted location found that it could host “Word Add-Ins” of a “*.wll” extension. The three default locations for Word are shown below. ![]() Further research, however, found that certain trusted locations to which a typical standard user has write privileges could also be used to host DLL-based add-ins. Files located here containing VBA code are not subject to the standard restrictions imposed by the macro settings, and the code will be executed without warning even if macros are disabled. Key to the work by Kostas and others on persistence using Office templates was the concept of “Trusted Locations”. The described persistence techniques were tested with Office 2013 running on Windows 7, 8.1 and 10.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
May 2023
Categories |