Skip to content

Commit c3346c6

Browse files
fix: add prompt information for clarity in SilverFox POC documentation
1 parent 2947665 commit c3346c6

2 files changed

Lines changed: 2 additions & 0 deletions

File tree

_posts/2025-12-15-silver-fox-poc-2025-zh-cn.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -502,6 +502,7 @@ flowchart TD
502502

503503
2. 在注册表 `HKEY_CLASSES_ROOT` 下创建以这个随机扩展名为名的键,将其默认值指向一个自定义的程序标识符 `sf-demo`。随后,为 `sf-demo` 创建完整的 `shell\open\command` 结构,命令内容指向攻击者放置在脚本同目录下的 `python.exe`,并将文件路径作为参数传入。
504504
> **目的**:确保系统知道遇到这个随机扩展名的文件时,应该使用指定的 Python 解释器打开。
505+
{: .prompt-info }
505506

506507
3. 通过向 `Session Manager` 下的 `DOS Devices` 键写入一个新值,将一个未被使用的盘符(如 `X:`)映射到系统的公共开始菜单 `Programs` 目录。
507508

_posts/2025-12-15-silver-fox-poc-2025.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -502,6 +502,7 @@ The entire attack chain is designed very ingeniously, mainly divided into the fo
502502

503503
2. Create a key named after this random extension under the registry `HKEY_CLASSES_ROOT`, pointing its default value to a custom program identifier `sf-demo`. Subsequently, create a complete `shell\open\command` structure for `sf-demo`, with the command content pointing to `python.exe` placed by the attacker in the same directory as the script, and passing the file path as an argument.
504504
> **Purpose**: Ensure the system knows to use the specified Python interpreter when encountering a file with this random extension.
505+
{: .prompt-info }
505506

506507
3. Map an unused drive letter (e.g., `X:`) to the system's Common Start Menu `Programs` directory by writing a new value to the `DOS Devices` key under `Session Manager`.
507508

0 commit comments

Comments
 (0)