public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-26 14:59:03 +01:00
Code Issues Projects Releases Wiki Activity

Reverted back

Browse Source
This commit is contained in:
Oddvar Moe 2019-06-27 13:49:52 +02:00
parent 6338ac77a0
commit d26c01fa45
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
yml/OtherMSBinaries/Update.yml
View File

@ -5,7 +5,7 @@ Author: 'Mr.Un1k0d3r'
Created: '2019-06-26' Created: '2019-06-26'
Commands: Commands:
- Command: Update.exe --processStart payload.exe --process-start-args "whatever args" - Command: Update.exe --processStart payload.exe --process-start-args "whatever args"
Description: Copy your payload into userprofile\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied. Description: Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.
Usecase: Application Whitelisting Bypass Usecase: Application Whitelisting Bypass
Category: AWL Bypass Category: AWL Bypass
Privileges: User Privileges: User
@ -13,7 +13,7 @@ Commands:
MitreLink: https://attack.mitre.org/wiki/Technique/T1218 MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows 7 and up with Microsoft Teams installed OperatingSystem: Windows 7 and up with Microsoft Teams installed
- Command: Update.exe --processStart payload.exe --process-start-args "whatever args" - Command: Update.exe --processStart payload.exe --process-start-args "whatever args"
Description: Copy your payload into userprofile\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied. Description: Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.
Usecase: Execute binary Usecase: Execute binary
Category: Execute Category: Execute
Privileges: User Privileges: User
@ -21,7 +21,7 @@ Commands:
MitreLink: https://attack.mitre.org/wiki/Technique/T1218 MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows 7 and up with Microsoft Teams installed OperatingSystem: Windows 7 and up with Microsoft Teams installed
Full_Path: Full_Path:
- Path: userprofile\AppData\Local\Microsoft\Teams\Update.exe - Path: '%userprofile%\AppData\Local\Microsoft\Teams\Update.exe'
Detection: Detection:
- IOC: Update.exe spawned an unknown process - IOC: Update.exe spawned an unknown process
Resources: Resources: