Update readme, began updating OSBins with new template

This commit is contained in:
Oddvar Moe
2018-09-24 01:50:14 +02:00
parent e8c7042468
commit adafa6de3f
17 changed files with 234 additions and 121 deletions

View File

@@ -17,9 +17,10 @@ Primarily files that offer "extra" functionality.
## Definition
* Must be a Microsoft signed file. (OS or downloaded from Microsoft site)
* Must be a Microsoft signed file. (Native to the OS or downloaded from Microsoft site)
* Only extra "unexpected" functionality is interesting (Not interesting to document what it was intended for)
* Exceptions are Application Whitelisting bypasses
* Primary focus is stuff that can be leveraged by APT or in Red Teaming
* Functionality can include:
* Executing code
@@ -48,14 +49,15 @@ We generate the MD files from this and later it will also be the base for an upc
## STORY
"Living off the land" was coined by Matt Graeber - @mattifestation <3
One of the first "Living Off The Land" talks (That I know of) is this one:
"Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation)
One of the first "Living Off The Land" talks is this one:
https://www.youtube.com/watch?v=j-r6UonEkUw
The term LOLBins came from a twitter discussion on what to call these binaries. It was first proposed by Philip Goh - @MathCasualty here:
The term LOLBins came from a twitter discussion on what to call these binaries that can be used by an attacker to perform other actions than what the binary was designed to do.
LOLBins was first proposed by Philip Goh (@MathCasualty) here:
https://twitter.com/MathCasualty/status/969174982579273728
The term LOLScripts came from Jimmy - @bohops:
The term LOLScripts came from Jimmy (@bohops):
https://twitter.com/bohops/status/984828803120881665
Common hashtags for these files are:
@@ -71,7 +73,7 @@ A "highly scientific poll" was also conducted to agree (69% yes) on the name LOL
https://twitter.com/Oddvarmoe/status/985432848961343488
The domain http://lolbins.com has been registered by an unknown individual and redirected it to this project. (Thank you)
The domain http://lolbas-project.com has been registered by Jimmy (@bohops). (Thanks!)
The awesome logos in the logo folder was provided by Adam Nadrowski (@_sup_mane) - Thank you so much man!
Love this logo:
@@ -82,33 +84,36 @@ Love this logo:
All features are added to the issues in this repo.
### 1.0
* Hosted https://github.com/api0cradle/LOLBAS/
* Only MD files
- [x] Hosted https://github.com/api0cradle/LOLBAS/
- [x] Only MD files
### 2.0 -- Current
* Hosted here on this repo
* Everything converted to YML files
* MD files generated from YML files
* Clearer definition
* Management scripts
- [x] Moved from api0cradle and hosted here on this repo (https://github.com/LOLBAS-Project/LOLBAS)
- [x] Everything converted to YML files
- [x] MD files generated from YML files
- [x] Clearer definition of a LOLBin
- [ ] Management scripts
- [x] New template
### 2.1
* More categories
* Jekyll frontend
* Privileges required
- [ ] Migration to new template
- [ ] More categories - Part of the new template
- [ ] ATT&CK Mitre mapping
- [ ] Privileges required by binary
- [ ] Jekyll frontend
### 2.2
* ATT&CK Mitre mapping
* LOLBIN GUID - Unique ID for each bin
* Sub-Categories
* Signed executing unsigned
* Signed executing signed
* Split commands into command, argument structure, and example. i.e. Command: cmstp.exe; ArgStructure: /ini /s <inf_file>; Example: cmstp.exe /ini /s c:\cmstp\CorpVPN.inf
- [ ] LOLBIN GUID - Unique ID for each bin
- [ ]Sub-Categories
- [ ] Signed executing unsigned
- [ ] Signed executing signed
- [ ] Split commands into command, argument structure, and example. i.e. Command: cmstp.exe; ArgStructure: /ini /s <inf_file>; Example: cmstp.exe /ini /s c:\cmstp\CorpVPN.inf
### 2.3
* Tests for PRs to ensure fields are valid
* Provide the project in DB format (sqlite)
- [ ] Tests for PRs to ensure fields are valid
- [ ]Provide the project in DB format (sqlite)