public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-26 14:59:03 +01:00
Code Issues Projects Releases Wiki Activity

First stab at CONTRIBUTING. Addresses #3.

Browse Source
This commit is contained in:
leesoh 2018-10-03 20:33:14 -06:00
parent fa0807ca03
commit de9638d48b
3 changed files with 7 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
CONTRIBUTING.md Normal file
View File

@ -0,0 +1,7 @@
# Contributing
First, thank you for contributing!
When submitting new LOLs, please submit a `yml` sourcefile (`yml/`) as these are used to generate everything else. Next, review `README.md` and ensure that your LOL meets the criteria--interesting or unexpected functionality that would be useful to an attacker.
There's nothing special about the format. Just base your entry off an existing one and modify as required. Please ensure that you do not add or remove any of the fields; all are required.

36
Contribute.md
View File

@ -1,36 +0,0 @@
Use this a Template for new binaries and scripts.
If you think it is hard to make a pull request using github, don't hasitate
to send me a tweet and I will add the contribution for you.
## Binary.exe
* Functions: Execute, Download, Copy, Read ADS, Write ADS, UACBypass, Search, Compile, Credentials, Surveillance
```
Example
```
Acknowledgements:
* Name of guy - @twitterhandle
Code sample:
* [NameOfLink](Payload/NameOfPayload)
Resources:
* https://linktosomethingusefull.com
Full path:
```
c:\windows\system32\binary.exe
c:\windows\sysWOW64\binary.exe
```
Notes:
Some specific details about the binary file.
Detection:
Details about detection.
IOC, Behaviour , User Agents etc

4
README.md
View File

@ -43,10 +43,6 @@ Interesting functionality can include:
* Log evasion/modification * Log evasion/modification
* DLL side-loading/hijacking without being relocated elsewhere in the filesystem. * DLL side-loading/hijacking without being relocated elsewhere in the filesystem.
## YML
All things LOLBAS are stored under the `yml` folder. These files are then converted to markdown for your viewing pleasure. If you're submitting a PR, make your changes to the `yml` version of the file and we'll do the necessary conversions.
## The History of the LOLBin ## The History of the LOLBin
The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at [DerbyCon 3](https://www.youtube.com/watch?v=j-r6UonEkUw). The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at [DerbyCon 3](https://www.youtube.com/watch?v=j-r6UonEkUw).