You are browsing the archive for LOLBins.

certutil – one more GUI lolbin

August 23, 2020 in LOLBins

Cerutil is a very complex tool and only careful review of all its options allows us to comprehend its rich functionality. Lots of its command line arguments are described online all over the place and as such, what I present below is not new. However, AFAICT it has not been covered in a context of lolbining and as such, perhaps deserves some attention.

Project LOLBAS describes at least two ways of downloading files via certutil. Here is the third one:

certutil -URL

This will launch a GUI window for a program called URL Retrieval Tool:

Once you hit Retrieve button you will get the ‘Failed’ status, but… the file that URL points to will be now downloaded into %APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash> file (thx to @OsandaMalith for pointing out a mistake in the path).

ODBCConf – Lolbin Trifecta

August 23, 2020 in Living off the land, LOLBins

I posted about ODBCConf before and then posted again on Twitter.

The Twitter bit was about REGSVR:

odbcconf.exe /a {REGSVR c:\test\test.dll}

– loads a DLL

At that time I looked at other ACTIONS accepted by this tool, but didn’t explore them fully. Of course, the one I did want to explore the most was INSTALLDRIVER, but put it on a backburner. I eventually tested it today and here’s the result:

ODBCConf /ld foo /a {INSTALLDRIVER "test|Driver=c:\test\test64.dll|APILevel=2"}

This will set up ‘test’ driver entry in Registry.

We then need to force that DLL to load. There are two ways — via GUI — need to launch odbcad32.exe, then click ‘Add DSN’ and choose ‘test’:

Or, we can do it via command line as well 🙂

odbcconf configsysdsn "test" "DSN=test"