I have no idea why, but sometimes acronyms in English are so interesting to me that they draw me deeper...
In the previous post, I summarized my Windows Security review, mainly focusing on learning and reviewing PowerShell... and a few others. In the process, I came across the netsh.exe utility. Curiosity led me to find terms such as LotL and LOLBin. This is where the topic starts to get more complex.
The term "LotL" itself is interesting to me, hence the graphic.
Let's get to the point!
What is LotL?
Living Off the Land is a cybersecurity attack technique that uses tools and features built into the victim's operating system.
Attackers use these "natural resources" of the system to launch attacks or maintain access to a compromised system, often acting undetected.
The term itself has been around for almost 30 years, but in recent years this technique has been used more and more often.
Phenomenal, yet simple and effective
There are over 100 Windows system tools that can be used by cybercriminals for LotL... Therefore, everyone should at least know about this threat and no one should underestimate it! .
This method uses surprising simplicity, based on tools already present in the system, which makes it extremely effective in hiding from antivirus software - the malware uses commands built into the system!
What is LOLBAS/LOLBIN?
(Living Off The Land Binaries, Scripts, and Libraries) refers to non-malicious scripts, binaries, and libraries that are used by adversaries to perform malicious activities. These files are components of Microsoft solutions and are often signed by Microsoft.
What is netsh?
Neth.exe is a scripting tool whose commands are executed using the Windows command console (cmd.exe). This program allows you to view or modify your computer's network settings locally and remotely.
Netsh.exe, also allows you to execute a group of commands in batch processing. It also allows you to save configuration script in a text file.
netsh -c interface dump > c:\export.txt
netsh interface ip set address name="wlan" source=static addr=192.168.0.3 mask=255.255.255.0
netsh interface ip set address name="wlan" gateway=192.168.0.2 gwmetric=0
netsh interface ip set dns name="wlan" source=static addr=62.108.171.33 register=PRIMARY
netsh interface ip add dns name="wlan" addr=153.19.250.100 index=2
netsh interface ip set wins name="wlan" source=static addr=none
Netsh contexts - add functionality
When you use the "add helper" command, you will add an extension to netsh that allows you to execute additional commands defined in the provided DLL script.
This can be used to extend the functionality of netsh with new features that are not available in the standard installation.
Attention!
You need to be an administrator to load the .dll
netsh add helper c:\extra_functionallity.dll
https://attack.mitre.org/techniques/T1546/007/
https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts
Malicious library configuration
Knowing how Netsh works, we can create a script and compile it to the Dynamic Link Library. I do not describe how to do it because I don't know the C family, so I refer you to further materials (github) that I found and can be used.
https://github.com/gtworek/PSBits/tree/master/NetShRun
https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/persistence/t1546-event-triggered-execution/netsh-helper-dll
Demo:
https://www.linkedin.com/posts/grzegorztworek_lolbin-activity-7078740990542454784--ZK0/
Summary
I found it fascinating how over 100 Windows system tools can be manipulated for malicious purposes, emphasizing the critical need for awareness and vigilance among users. My aim is to foster awareness and encourage further learning, pointing readers towards resources for deeper understanding and defense strategies against these sophisticated attacks.
