Living Off The Land Binaries and Scripts (and now also Libraries)

There are currently three different lists:

• LOLBins
• LOLLibs
• LOLScripts

The above files can be found behind a fancy frontend here: https://lolbas-project.github.io (thanks @ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/).

Goal

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques.

Criteria

A LOLBin/Lib/Script must:

• Be a Microsoft-signed file, either native to the OS or downloaded from Microsoft.
• Have extra "unexpected" functionality. It is not interesting to document intended use cases.
  • Exceptions are application whitelisting bypasses
• Have functionality that would be useful to an APT or red team

Interesting functionality can include:

• Executing code
  • Arbitrary code execution
  • Pass-through execution of other programs (unsigned) or scripts (via a LOLBin)
• Compiling code
• File operations
  • Downloading
  • Upload
  • Copy
• Persistence
  • Pass-through persistence utilizing existing LOLBin
  • Persistence (e.g. hide data in ADS, execute at logon)
• UAC bypass
• Credential theft
• Dumping process memory
• Surveillance (e.g. keylogger, network trace)
• Log evasion/modification
• DLL side-loading/hijacking without being relocated elsewhere in the filesystem.

Contributing

If you have found a new LOLBin or LOLScript that you would like to contribute, please review the contributing guidelines located here: https://github.com/LOLBAS-Project/LOLBAS/blob/master/CONTRIBUTING.md

A template for the required format has been provided here: https://github.com/LOLBAS-Project/LOLBAS/blob/master/YML-Template.yml

The History of the LOLBin

The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3.

The term LOLBins came from a Twitter discussion on what to call binaries that can be used by an attacker to perform actions beyond their original purpose. Philip Goh (@MathCasualty) proposed LOLBins. A highly scientific internet poll ensued, and after a general consensus (69%) was reached, the name was made official. Jimmy (@bohops) followed up with LOLScripts. No poll was taken.

Common hashtags for these files are:

• #LOLBin
• #LOLBins
• #LOLScript
• #LOLScripts
• #LOLLib
• #LOLLibs

Thanks

As with many open-source projects, this one is the product of a community and we would like to thank ours:

• The domain http://lolbins.com has been registered by an unknown individual and redirected it to this project.
• The domain http://lolbas-project.com has been registered by Jimmy (@bohops).
• The logos for the project were created by Adam Nadrowski (@_sup_mane). We #@&!!@#! love them.