CatalogLOLBAS

LOL · Binary

ssh.exe

3 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Executes specified command on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.

Use Execute specified command, can be used for defense evasion.

ssh localhost "{CMD}"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202
Detection
IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.

Execute

ExecutionWindows

Executes specified command from ssh.exe

Use Performs execution of specified file, can be used as a defensive evasion.

ssh -o ProxyCommand="{CMD}" .
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202
Detection
IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.

Execute

ExecutionWindows

Executes a DLL from an SMB share by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by `ssh.exe`. Note that all backslashes should be escaped (i.e. every `\` should be turned into `\\`).

Use Performs indirect execution of a specified DLL from a remote share, can be used for defense evasion.

ssh -o PKCS11Provider="\\\\127.0.0.1\\Temp\\example.dll" win@github.com
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202
Detection
IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.