mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-27 12:42:19 +02:00
Major changes to Web portal - Small fixes to source files to adjust
This commit is contained in:
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: Replace C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe by your binary
|
||||
Description: Hijack RdrCEF.exe with a payload executable to launch when opening Adobe
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://twitter.com/pabraeken/status/997997818362155008
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: Gpup.exe -w whatever -e c:\Windows\System32\calc.exe
|
||||
Description: Execute another command through gpup.exe (Notepad++ binary).
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- 'C:\Program Files (x86)\Notepad++\updater\gpup.exe '
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://twitter.com/pabraeken/status/997892519827558400
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: NLNOTES.EXE /authenticate "=N:\Lotus\Notes\Data\notes.ini" -Command if((Get-ExecutionPolicy ) -ne AllSigned) { Set-ExecutionPolicy -Scope Process Bypass }
|
||||
Description: Run PowerShell via LotusNotes.
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\Program Files (x86)\IBM\Lotus\Notes\Notes.exe
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://gist.github.com/danielbohannon/50ec800e92a888b7d45486e5733c359f
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: Notes.exe "=N:\Lotus\Notes\Data\notes.ini" -Command if((Get-ExecutionPolicy) -ne AllSigned) { Set-ExecutionPolicy -Scope Process Bypass }
|
||||
Description: Run PowerShell via LotusNotes.
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\Program Files (x86)\IBM\Lotus\Notes\notes.exe
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://gist.github.com/danielbohannon/50ec800e92a888b7d45486e5733c359f
|
||||
|
@@ -17,9 +17,9 @@ Commands:
|
||||
Description: Kill a process.
|
||||
- Command: Nvudisp.exe Run foo
|
||||
Description: Run process
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\windows\system32\nvuDisp.exe
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- http://sysadminconcombre.blogspot.ca/2018/04/run-system-commands-through-nvidia.html
|
||||
|
@@ -17,9 +17,9 @@ Commands:
|
||||
Description: Kill a process.
|
||||
- Command: nvuhda6.exe Run foo
|
||||
Description: Run process
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- Missing
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- http://www.hexacorn.com/blog/2017/11/10/reusigned-binaries-living-off-the-signed-land/
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: Replace ROCCAT_Swarm_Monitor.exe with your binary.exe
|
||||
Description: Hijack ROCCAT_Swarm_Monitor.exe and launch payload when executing ROCCAT_Swarm.exe
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\Program Files (x86)\ROCCAT\ROCCAT Swarm\
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://twitter.com/pabraeken/status/994213164484001793
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: Run Setup.exe
|
||||
Description: Hijack hpbcsiServiceMarshaller.exe and run Setup.exe to launch a payload.
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\LJ-Ent-700-color-MFP-M775-Full-Solution-15315
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://twitter.com/pabraeken/status/994381620588236800
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: Usbinst.exe InstallHinfSection "DefaultInstall 128 c:\temp\calc.inf"
|
||||
Description: Execute calc.exe through DefaultInstall Section Directive in INF file.
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\Program Files (x86)\Citrix\ICA Client\Drivers64\Usbinst.exe
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://twitter.com/pabraeken/status/993514357807108096
|
||||
|
@@ -7,9 +7,9 @@ Categories: []
|
||||
Commands:
|
||||
- Command: VBoxDrvInst.exe driver executeinf c:\temp\calc.inf
|
||||
Description: Set registry key-value for persistance via INF file call through VBoxDrvInst.exe
|
||||
Full Path:
|
||||
Full_Path:
|
||||
- C:\Program Files\Oracle\VirtualBox Guest Additions
|
||||
Code Sample: []
|
||||
Code_Sample: []
|
||||
Detection: []
|
||||
Resources:
|
||||
- https://twitter.com/pabraeken/status/993497996179492864
|
||||
|
Reference in New Issue
Block a user