The Mysterious "Office Hotkey"..

This video demonstrates how the Microsoft Office hotkey (Ctrl+Shift+Windows+Alt) can be exploited through registry manipulation 0:37-0:42.

Key Takeaways:
• The Office hotkey opens Microsoft 365 apps but can be modified by editing registry keys in HKCU\Software\Classes\ms-officeapp\shell\open\command 1:22-1:31
• The hotkey launches webviewhost.exe and checks registry locations that can be modified by regular users 2:15-2:19
• Arguments cannot be passed directly to the executed program, but environment variables can be manipulated 10:40-10:53
• A malicious payload can be executed by creating a batch file in a world-writable location and adding it to the user's path 12:50-12:57
• The presenter demonstrates obtaining a reverse shell through this method using AutoIt to automate the hotkey press 19:30-19:38

This security research shows how a seemingly innocuous feature could be exploited for persistence, though the presenter notes this requires multiple layers of indirection and file system access.

Sources:

• 0:37-0:42 Introduction to the Office hotkey combination
• 1:22-1:31 Registry locations that regular users can modify
• 2:15-2:19 How the hotkey executes webviewhost.exe
• 10:40-10:53 Limitations of passing arguments to the executed program
• 12:50-12:57 Creating a batch file payload through path manipulation
• 19:30-19:38 Demons