Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LOLBAS: Living Off the Land Binaries, Scripts and Libraries

lolbas-project.github.io

Post reply on HN
Print view View original

1–10 of 32 posts

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#2

Post by smcl »

Just to summarise what's going on here, because it took me a little bit of clicking to get the gist of it:

> The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques.

> The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3.

> The term LOLBins came from a Twitter discussion on what to call binaries that can be used by an attacker to perform actions beyond their original purpose.

So it seems like a catalogue of (possible?) exploits in commonly-available executables, libraries and scripts that may already be present on a target machine.

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#4

Post by MrMrtn »

smcl wrote: post #2

Just to summarise what's going on here, because it took me a little bit of clicking to get the gist of it: > The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. > The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3. > The term LOLBins came from a Twitter discuss…

> So it seems like a catalogue of (possible?) exploits in commonly-available executables, libraries and scripts that may already be present on a target machine

That is pretty correct, but it is not necessarily an exploit or vulnerability in the binary. More often than not, it is a quirk or a way to use the binary which is unknown/uncommon, but might not appear on a defenders' radar.

We generally try to (ab)use functionality in pre-existing software to avoid security mechanisms (like AppLocker) and detections (like AV/EDR, or rules created by a SOC when analysing execution logs in a SIEM). Often we discover that a target computer has been hardened in some form or fashion, and we have to get "creative" when trying to download, execute or exfiltrate data during security assessments.

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#6

Post by smcl »

MrMrtn wrote: post #4
smcl wrote: post #2

Just to summarise what's going on here, because it took me a little bit of clicking to get the gist of it: > The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. > The phrase "Living off the land" was coined by Christopher Campbell (@obscuresec) & Matt Graeber (@mattifestation) at DerbyCon 3. > The term LOLBins came from a Twitter discuss…

> So it seems like a catalogue of (possible?) exploits in commonly-available executables, libraries and scripts that may already be present on a target machine That is pretty correct, but it is not necessarily an exploit or vulnerability in the binary. More often than not, it is a quirk or a way to use the binary which is unknown/uncommon, but might not appear on a defenders' radar. We generally try to (ab)use functi…

Apologies I didn't mean to imply there was some nefarious purpose behind this!

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#7

Post by ilyt »

smcl wrote: post #6
MrMrtn wrote: post #4

Earlier quoted context omitted.

> So it seems like a catalogue of (possible?) exploits in commonly-available executables, libraries and scripts that may already be present on a target machine That is pretty correct, but it is not necessarily an exploit or vulnerability in the binary. More often than not, it is a quirk or a way to use the binary which is unknown/uncommon, but might not appear on a defenders' radar. We generally try to (ab)use functi…

Apologies I didn't mean to imply there was some nefarious purpose behind this!

well, no, it's 100% nefarious purpose, just sometimes used to find the holes instead of exploiting it.

It will absolutely be used more often to exploit than to secure

Re: LOLBAS: Living Off the Land Binaries, Scripts and Libraries

#8

Post by jacobwilliamroy »

ilyt wrote: post #7
smcl wrote: post #6

Earlier quoted context omitted.

Apologies I didn't mean to imply there was some nefarious purpose behind this!

well, no, it's 100% nefarious purpose, just sometimes used to find the holes instead of exploiting it. It will absolutely be used more often to exploit than to secure

Or sometimes a person shows up at a new IT job and the old admin didn't leave behind any notes and the only way to do the job at all short of rebuilding everything from the ground up is to pwn the network.
Post reply on HN