Living Off The Land Binaries and Scripts (and now also Libraries)

There are currently three different lists:

• LOLBins
• LOLLibs
• LOLScripts

The above files can be found behind a fancy frontend here: https://lolbas-project.github.io (thanks @xenosCR for this bit of eyecandy).

Goal

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques.

Criteria

A LOLBin/Lib/Script must:

• Be a Microsoft-signed file, either native to the OS or downloaded from Microsoft.
• Have extra "unexpected" functionality. It is not interesting to document intended use cases.
  • Exceptions are application whitelisting bypasses
• Have functionality that would be useful to an APT or red team

Interesting functionality can include:

• Executing code
  • Arbitrary code execution
  • Pass-through execution of other programs (unsigned) or scripts (via a LOLBin)
• Compiling code
• File operations
  • Downloading
  • Upload
  • Copy
• Persistence
  • Pass-through persistence utilizing existing LOLBin
  • Persistence (e.g. hide data in ADS, execute at logon)
• UAC bypass
• Credential theft
• Dumping process memory
• Surveillance (e.g. keylogger, network trace)
• Log evasion/modification
• DLL side-loading/hijacking without being relocated elsewhere in the filesystem.

YML

All things LOLBAS are stored under the yml folder. These files are then converted to markdown for your viewing pleasure. If you're submitting a PR, make your changes to the yml version of the file and we'll do the necessary conversions.

The History of the LOLBin

The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3.

The term LOLBins came from a Twitter discussion on what to call binaries that can be used by an attacker to perform actions beyond their original purpose. Philip Goh (@MathCasualty) proposed LOLBins. A highly scientific internet poll ensued, and after a general consensus (69%) was reached, the name was made official. Jimmy (@bohops) followed up with LOLScripts. No poll was taken.

Common hashtags for these files are:

• #LOLBin
• #LOLBins
• #LOLScript
• #LOLScripts
• #LOLLib
• #LOLLibs

Thanks

As with many open-source projects, this one is the product of a community and we would like to thank ours:

• The domain http://lolbins.com has been registered by an unknown individual and redirected it to this project.
• The domain http://lolbas-project.com has been registered by Jimmy (@bohops).
• The logos for the project were created by Adam Nadrowski (@_sup_mane). We #@&!!@#! love them.