mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-25 14:29:24 +01:00

Go to file

John Lambert ecbc2f817f Add lolbin for fltMC.exe Used by redteams for defense evasion to disable drivers used by agents like sysmon https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon https://github.com/oddcod3/Phantom-Evasion/blob/master/Modules/post-exploitation/Postex_CMD_UnloadSysmonDriver_windows.py		2021-09-18 17:43:59 -07:00
Archive-Old-Version	Removed MD files, we only use the webportal from now on. All MD files moved to archive	2018-10-25 18:31:11 +02:00
Logo	Initial commit - LOLBAS V2.0	2018-06-09 00:15:06 +02:00
yml	Add lolbin for fltMC.exe	2021-09-18 17:43:59 -07:00
Backlog.txt	Initial commit - LOLBAS V2.0	2018-06-09 00:15:06 +02:00
CategoryList.md	Added UAC bypass as category	2018-12-12 12:43:13 +01:00
CONTRIBUTING.md	Update CONTRIBUTING.md	2018-12-10 18:54:08 +01:00
README.md	Update README.md	2019-06-27 17:47:21 +02:00
YML-Template.yml	Adjusted template (some space errors)	2019-06-27 17:02:21 +02:00

README.md

Living Off The Land Binaries and Scripts (and now also Libraries)

All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io (thanks @ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/). This repo serves as a place where we maintain the YML files that are used by the fancy frontend.

Goal

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques.

Criteria

A LOLBin/Lib/Script must:

Be a Microsoft-signed file, either native to the OS or downloaded from Microsoft.
Have extra "unexpected" functionality. It is not interesting to document intended use cases.
- Exceptions are application whitelisting bypasses
Have functionality that would be useful to an APT or red team

Interesting functionality can include:

Executing code
- Arbitrary code execution
- Pass-through execution of other programs (unsigned) or scripts (via a LOLBin)
Compiling code
File operations
- Downloading
- Upload
- Copy
Persistence
- Pass-through persistence utilizing existing LOLBin
- Persistence (e.g. hide data in ADS, execute at logon)
UAC bypass
Credential theft
Dumping process memory
Surveillance (e.g. keylogger, network trace)
Log evasion/modification
DLL side-loading/hijacking without being relocated elsewhere in the filesystem.

Contributing

If you have found a new LOLBin or LOLScript that you would like to contribute, please review the contributing guidelines located here: https://github.com/LOLBAS-Project/LOLBAS/blob/master/CONTRIBUTING.md

A template for the required format has been provided here: https://github.com/LOLBAS-Project/LOLBAS/blob/master/YML-Template.yml

The History of the LOLBin

The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3.

The term LOLBins came from a Twitter discussion on what to call binaries that can be used by an attacker to perform actions beyond their original purpose. Philip Goh (@MathCasualty) proposed LOLBins. A highly scientific internet poll ensued, and after a general consensus (69%) was reached, the name was made official. Jimmy (@bohops) followed up with LOLScripts. No poll was taken.

Common hashtags for these files are:

#LOLBin
#LOLBins
#LOLScript
#LOLScripts
#LOLLib
#LOLLibs

Our primary maintainer (@oddvarmoe) of this project did a talk at DerbyCon 2018 called: #Lolbins Nothing to LOL about! - https://www.youtube.com/watch?v=NiYTdmZ8GR4 This talk goes over the history of this project.

Thanks

As with many open-source projects, this one is the product of a community and we would like to thank ours:

The domain http://lolbins.com has been registered by an unknown individual and redirected it to the old version of this project.
The domain http://lolbas-project.com has been registered by Jimmy (@bohops).
The logos for the project were created by Adam Nadrowski (@_sup_mane). We #@&!!@#! love them.