{"id":6714,"date":"2019-08-30T23:55:10","date_gmt":"2019-08-30T23:55:10","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6714"},"modified":"2019-08-30T23:55:12","modified_gmt":"2019-08-30T23:55:12","slug":"sitting-on-the-lolbins-9","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/08\/30\/sitting-on-the-lolbins-9\/","title":{"rendered":"Sitting on the Lolbins, 9"},"content":{"rendered":"\n<p>This is not really a proper LOLBIN category, but is interesting for many reasons. How often do we see libraries that are written by A, sometimes even open source, but then they are signed by B?<\/p>\n\n\n\n<p>I mentioned <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/07\/05\/bring-your-own-lolbas\/\">7z a while ago<\/a>, but there is more&#8230;<\/p>\n\n\n\n<p>Examples:<\/p>\n\n\n\n<p>Debugging Tools for Windows signed by NVIDIA Corporation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Verified:       Signed\nSigning date:   03:13 2014-07-04\nPublisher:      NVIDIA Corporation\nCompany:        Microsoft Corporation\nDescription:    Windows Image Helper\nProduct:        Debugging Tools for Windows(R)\nProd version:   6.12.0002.633\nFile version:   6.12.0002.633 (debuggers(dbg).100201-1203)\nMachineType:    32-bit<\/code><\/pre>\n\n\n\n<p>Sample: 70FBA09DEDCDDCA02C38785071745C50CDB8C532BDB0C5A632F79EE5873C9405<\/p>\n\n\n\n<p>OpenSSL Shared Library, signed by Intel Corporation-Mobile Wireless Group<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Verified:       Signed\nSigning date:   02:13 2012-09-13\nPublisher:      Intel Corporation-Mobile Wireless Group\nCompany:        The OpenSSL Project, http:\/\/www.openssl.org\/\nDescription:    OpenSSL Shared Library\nProduct:        The OpenSSL Toolkit\nProd version:   1.0.0b\nFile version:   1.0.0b\nMachineType:    64-bit<\/code><\/pre>\n\n\n\n<p>Sample: 00471424438D68AE3F7E734808562A529D563243D156380A487C2D92D8EE4446<\/p>\n\n\n\n<p>What are the benefits of using these?<\/p>\n\n\n\n<ul><li>They are signed<\/li><li>They are often not up to date &#8211;> vulnerable<\/li><li>Their sigs are probably quite hard to be revoked<\/li><li>They are whitelisted by hash by many security solutions, including forensic suites, AV, EDR, etc.<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This is not really a proper LOLBIN category, but is interesting for many reasons. How often do we see libraries that are written by A, sometimes even open source, but then they are signed by B? I mentioned 7z a &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/08\/30\/sitting-on-the-lolbins-9\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,56,64,59],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6714"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6714"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6714\/revisions"}],"predecessor-version":[{"id":6715,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6714\/revisions\/6715"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}