CatalogLOLBAS

LOL · Binary

PrintBrm.exe

2 techniquesWindowsLOLBASGPL-3.0

Download

File DownloadWindows

Create a ZIP file from a folder in a remote drive

Use Exfiltrate the contents of a remote folder on a UNC share into a zip file

PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1105

ADS

Defense EvasionFile WriteWindows

Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder

Use Decompress and extract a ZIP file stored on an alternate data stream to a new folder

PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
ADS