LOL · Script

Pester.bat

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Execute code using Pester. The third parameter can be anything. The fourth is the payload.

Use Proxy execution

Pester.bat [/help|?|-?|/?] "$null; {CMD}"

Context: user
Native: Execute
MITRE: T1216
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
Refs: twitter.com/Oddvarmoe/status/993383596244258816
twitter.com/_st0pp3r_/status/1560072680887525378
lolbas-project.github.io/lolbas/Scripts/Pester/

Execute

Execution Windows

Execute code using Pester. Example here executes specified executable.

Use Proxy execution

Pester.bat ;{PATH:.exe}

Context: user
Native: Execute
MITRE: T1216
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
Refs: twitter.com/Oddvarmoe/status/993383596244258816
twitter.com/_st0pp3r_/status/1560072680887525378
lolbas-project.github.io/lolbas/Scripts/Pester/