[addtool] LOLBAS

[piyush-security]

[link] https://lolbas-project.github.io/ [/link] [link] https://github.com/LOLBAS-Project/LOLBAS [/link]

[tags] lol, scripts, scripts, red-team [/tags]

[short_descr] Living Off The Land Binaries, Scripts and Libraries [/short_descr]

[long_descr] The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques.

Criteria

A LOLBin/Lib/Script must:

• Be a Microsoft-signed file, either native to the OS or downloaded from Microsoft.
• Have extra "unexpected" functionality. It is not interesting to document intended use cases.
  • Exceptions are application whitelisting bypasses
• Have functionality that would be useful to an APT or red team

Interesting functionality can include:

• Executing code
  • Arbitrary code execution
  • Pass-through execution of other programs (unsigned) or scripts (via a LOLBin)
• Compiling code
• File operations
  • Downloading
  • Upload
  • Copy
• Persistence
  • Pass-through persistence utilizing existing LOLBin
  • Persistence (e.g. hide data in ADS, execute at logon)
• UAC bypass
• Credential theft
• Dumping process memory
• Surveillance (e.g. keylogger, network trace)
• Log evasion/modification
• DLL side-loading/hijacking without being relocated elsewhere in the filesystem.

[/long_descr]

[image]

[/image]

[gwen001]

Problem occured with the following fields:

• image not found

Check the guidelines or use the template created for that purpose.

[gwen001]

Issue correctly handled, tool is waiting for human validation.

[gwen001]

Tool has been accepted by the team: https://offsec.tools/tool/lolbas

Thank you for your contribution!