Category Archives: Living off the land

ripgrep as a lolbin

Posted on by

This is a lesser known feature of ripgrep that can be used to spawn your own executable via proxy. All you have to do is to run ripgrep with a ‘-z/–search-zip’ flag. Once you do it, any archive file that ripgrep comes across (and supports) will be preprocessed with a decompression tool as per the below list, first:

  • *.gz – gzip -d -c
  • *.tgz – gzip -d -c
  • *.bz2 – bzip2 -d -c
  • *.tbz2 – bzip2 -d -c
  • *.xz – xz -d -c
  • *.txz – xz -d -c
  • *.lz4 – lz4 -d -c
  • *.lzma – xz –format=lzma -d -c
  • *.br – brotli -d -c
  • *.zst – zstd -q -d -c
  • *.zstd – zstd -q -d -c
  • *.Z – uncompress -c

So, you can create a dummy foo.gz file, save payload to gzip.exe and run:

rg -z "whatever"

This will force rg.exe to launch gzip.exe.

1 little known secret of UIEOrchestratorStub.exe

Posted on by

When you run UIEOrchestratorStub.exe it executes UIEOrchestrator.exe program located here:

%SystemRoot%\uus\<architecture>\UIEOrchestrator.exe

So, changing the SystemRoot environment variable to point to your chosen path will lead to execution by proxy.

On a 64-bit Windows 11 26H2, we can try this:

set systemroot=c:\test
UIEOrchestratorStub.exe

which will launch:

c:\test\uus\amd64\UIEOrchestrator.exe