mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-27 04:32:24 +02:00
Update readme, began updating OSBins with new template
This commit is contained in:
55
README.md
55
README.md
@@ -17,9 +17,10 @@ Primarily files that offer "extra" functionality.
|
||||
|
||||
## Definition
|
||||
|
||||
* Must be a Microsoft signed file. (OS or downloaded from Microsoft site)
|
||||
* Must be a Microsoft signed file. (Native to the OS or downloaded from Microsoft site)
|
||||
* Only extra "unexpected" functionality is interesting (Not interesting to document what it was intended for)
|
||||
* Exceptions are Application Whitelisting bypasses
|
||||
* Primary focus is stuff that can be leveraged by APT or in Red Teaming
|
||||
|
||||
* Functionality can include:
|
||||
* Executing code
|
||||
@@ -48,14 +49,15 @@ We generate the MD files from this and later it will also be the base for an upc
|
||||
|
||||
|
||||
## STORY
|
||||
"Living off the land" was coined by Matt Graeber - @mattifestation <3
|
||||
One of the first "Living Off The Land" talks (That I know of) is this one:
|
||||
"Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation)
|
||||
One of the first "Living Off The Land" talks is this one:
|
||||
https://www.youtube.com/watch?v=j-r6UonEkUw
|
||||
|
||||
The term LOLBins came from a twitter discussion on what to call these binaries. It was first proposed by Philip Goh - @MathCasualty here:
|
||||
The term LOLBins came from a twitter discussion on what to call these binaries that can be used by an attacker to perform other actions than what the binary was designed to do.
|
||||
LOLBins was first proposed by Philip Goh (@MathCasualty) here:
|
||||
https://twitter.com/MathCasualty/status/969174982579273728
|
||||
|
||||
The term LOLScripts came from Jimmy - @bohops:
|
||||
The term LOLScripts came from Jimmy (@bohops):
|
||||
https://twitter.com/bohops/status/984828803120881665
|
||||
|
||||
Common hashtags for these files are:
|
||||
@@ -71,7 +73,7 @@ A "highly scientific poll" was also conducted to agree (69% yes) on the name LOL
|
||||
https://twitter.com/Oddvarmoe/status/985432848961343488
|
||||
|
||||
The domain http://lolbins.com has been registered by an unknown individual and redirected it to this project. (Thank you)
|
||||
|
||||
The domain http://lolbas-project.com has been registered by Jimmy (@bohops). (Thanks!)
|
||||
The awesome logos in the logo folder was provided by Adam Nadrowski (@_sup_mane) - Thank you so much man!
|
||||
|
||||
Love this logo:
|
||||
@@ -82,33 +84,36 @@ Love this logo:
|
||||
All features are added to the issues in this repo.
|
||||
|
||||
### 1.0
|
||||
* Hosted https://github.com/api0cradle/LOLBAS/
|
||||
* Only MD files
|
||||
- [x] Hosted https://github.com/api0cradle/LOLBAS/
|
||||
- [x] Only MD files
|
||||
|
||||
|
||||
### 2.0 -- Current
|
||||
* Hosted here on this repo
|
||||
* Everything converted to YML files
|
||||
* MD files generated from YML files
|
||||
* Clearer definition
|
||||
* Management scripts
|
||||
|
||||
- [x] Moved from api0cradle and hosted here on this repo (https://github.com/LOLBAS-Project/LOLBAS)
|
||||
- [x] Everything converted to YML files
|
||||
- [x] MD files generated from YML files
|
||||
- [x] Clearer definition of a LOLBin
|
||||
- [ ] Management scripts
|
||||
- [x] New template
|
||||
|
||||
|
||||
### 2.1
|
||||
* More categories
|
||||
* Jekyll frontend
|
||||
* Privileges required
|
||||
- [ ] Migration to new template
|
||||
- [ ] More categories - Part of the new template
|
||||
- [ ] ATT&CK Mitre mapping
|
||||
- [ ] Privileges required by binary
|
||||
- [ ] Jekyll frontend
|
||||
|
||||
|
||||
|
||||
### 2.2
|
||||
* ATT&CK Mitre mapping
|
||||
* LOLBIN GUID - Unique ID for each bin
|
||||
* Sub-Categories
|
||||
* Signed executing unsigned
|
||||
* Signed executing signed
|
||||
* Split commands into command, argument structure, and example. i.e. Command: cmstp.exe; ArgStructure: /ini /s <inf_file>; Example: cmstp.exe /ini /s c:\cmstp\CorpVPN.inf
|
||||
- [ ] LOLBIN GUID - Unique ID for each bin
|
||||
- [ ]Sub-Categories
|
||||
- [ ] Signed executing unsigned
|
||||
- [ ] Signed executing signed
|
||||
- [ ] Split commands into command, argument structure, and example. i.e. Command: cmstp.exe; ArgStructure: /ini /s <inf_file>; Example: cmstp.exe /ini /s c:\cmstp\CorpVPN.inf
|
||||
|
||||
|
||||
### 2.3
|
||||
* Tests for PRs to ensure fields are valid
|
||||
* Provide the project in DB format (sqlite)
|
||||
- [ ] Tests for PRs to ensure fields are valid
|
||||
- [ ]Provide the project in DB format (sqlite)
|
Reference in New Issue
Block a user