Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LOLBAS: Living Off the Land Binaries, Scripts and Libraries

lolbas-project.github.io

Post reply on HN
Print view View original

21–30 of 32 posts

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#21

Post by ilyt »

sh34r wrote: post #13
ilyt wrote: post #7

Earlier quoted context omitted.

well, no, it's 100% nefarious purpose, just sometimes used to find the holes instead of exploiting it. It will absolutely be used more often to exploit than to secure

It’s dual use, like Metasploit. It’s hard to predict whether black hats or white hats will use it more often or not. I think your conclusion is more intuitive, but let me play devil’s advocate. LotL is too advanced for script kiddies to pull off. You’re already dealing with an adversary with some sophistication, who likely have the time, skill, and resources to create their own LOLbins (or buy them on darknet forums)…

I'm not saying that it is bad those are out, I'm saying by volume they'd be used more by "slightly advanced script kiddies", and as part of bigger tools.

Sure it might make it easier for red teams to help secure system, but for organizations bad at security they will be hit by that low hanging fruit methods, even if it might make more aware organizations more secure. Just because it lowers the point of entry.

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#22

Post by ComputerGuru »

“Download” here seems to mean anything from actually downloading a file from a remote http server to copying a file from an accessible/open smb share (makecab example).

Also layout is confusing, capabilities don’t appear after the executable name, rather the executable name iis vertically centered against the list of features.

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#23

Post by anaisbetts »

MrMrtn wrote: post #4
smcl wrote: post #2

Just to summarise what's going on here, because it took me a little bit of clicking to get the gist of it: > The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. > The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3. > The term LOLBins came from a Twitter discuss…

> So it seems like a catalogue of (possible?) exploits in commonly-available executables, libraries and scripts that may already be present on a target machine That is pretty correct, but it is not necessarily an exploit or vulnerability in the binary. More often than not, it is a quirk or a way to use the binary which is unknown/uncommon, but might not appear on a defenders' radar. We generally try to (ab)use functi…

Yep, and to make it even more clear as an author of one of these LOLBins (Squirrel.exe), I have to underscore this point again - this list doesn't apply to normal Windows installations, it is only meaningful in the context of Blue teams trying to create their own hardened security boundaries via AV/EDR/AppLocker, and Red teams trying to evade said tools

(inb4 the comments, Squirrel itself attempts to strike a balance between usability and security, running only as the current user without admin limits its potential to be exploited, since any "I can hack Squirrel to run my code" trick is "Rather Involved Being On The Same Side Of The Airtight Hatch", as Raymond Chen would say)

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#24

Post by clbrmbr »

0x53 wrote: post #3

Don’t forget the Linux version! https://gtfobins.github.io/

Who is still using restricted shared hosts? I used to use a Dreamhost account like that, but it was years ago. I thought everybody had moved to virtualization for which these hacks don’t help. Am I wrong? Or are new shades/restricted Linux systems still being deployed?

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#25

Post by cjohnson318 »

smcl wrote: post #2

Just to summarise what's going on here, because it took me a little bit of clicking to get the gist of it: > The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. > The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3. > The term LOLBins came from a Twitter discuss…

Wow, I had no idea what any of that meant. I thought these were scripts helpful for... the tiny fraction of people that work in tech, but live off the grid?

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#26

Post by pjungwir »

20+ years ago I worked at a small dev shop. The IT folks and we devs had a contentious relationship, and it was hard to get any changes done on the servers. All I had was sudo access to something like `vi /etc/apache.conf`. I don't remember if I ever exploited it "for real", but it was nice to know that whatever I needed was really just a `:!foo` away.

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#27

Post by [deleted] »

californiadreem wrote: post #15

Is it possible for people to stop polluting perfectly valid namespaces? I understand that the metaphors and analogies make snese but every time this occurs, whether it's software, films, or whatever, it furthers destroys the integrity of already crumbling search engines. Edit: Because apparently this isn't clear enough: 1. Real world phenomena and technical projects are two distinctive categories, each encompassing a…

[deleted]

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#29

Post by m4jor »

HumblyTossed wrote: post #10

Link to some random web site with a bunch of downloadable files. Sure, let me just run one... What is this? Please update the link to point to what this actually is. If it's interesting to someone, they'll find the files.

It's for redteamers/pentesters and a very popular website.

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#30

Post by imchillyb »

jacobwilliamroy wrote: post #8
ilyt wrote: post #7

Earlier quoted context omitted.

well, no, it's 100% nefarious purpose, just sometimes used to find the holes instead of exploiting it. It will absolutely be used more often to exploit than to secure

Or sometimes a person shows up at a new IT job and the old admin didn't leave behind any notes and the only way to do the job at all short of rebuilding everything from the ground up is to pwn the network.

They're for penetration testing and red vs blue teams.

Red is typically 'mischief' and Blue is typically 'mischief prevention.'

Post reply on HN