{"id":6867,"date":"2019-11-01T00:47:01","date_gmt":"2019-11-01T00:47:01","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6867"},"modified":"2019-11-01T00:47:02","modified_gmt":"2019-11-01T00:47:02","slug":"quo-vadis-lolbin","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/11\/01\/quo-vadis-lolbin\/","title":{"rendered":"Quo Vadis, Lolbin"},"content":{"rendered":"\n

I am sometimes wondering what Lolbin really means. Most of us assume that a binary or script listed in this context is always ‘trusted’. And the trust ‘bit’ typically comes from a very reputable source – the binary\/script is signed and it means that it will run unchallenged in most of the ‘negative’ scenarios (EDR, AppLocker, etc.).<\/p>\n\n\n\n

However…<\/p>\n\n\n\n

Over last 30 years there were many reputable software releases out there that were not signed, and they still rely on on\/build upon this silly concept of ‘trust’. And the ‘trust’ is not only built around the concept of a authenticode signature, but often also a side-effect of a simple act of ‘belonging’.<\/p>\n\n\n\n

What do I mean by this? <\/p>\n\n\n\n

If it is a binary with a hash that belongs to a ‘clean’ category (nowadays it’s typically checked via NIST, MSDN and other ‘clean’ hash sets) then it’s most likely good….<\/p>\n\n\n\n

This opens a lot of opportunities that could have been overlooked otherwise: i.e. unsigned, good files that are NOT detected by any AV\/AI\/ML engine, but remain at large could be dropped\/re-purposed to deliver a ‘bypass <insert the engine>’ blow. There are actually many of them. <\/p>\n\n\n\n

Time for an example…<\/p>\n\n\n\n

While installing an old version of MS Access 2003 on my VM Guest test system I noticed that one of binaries used by the setup program is called SHELEXEC.EXE<\/a>. The only function of this small program is to execute a command passed to it via a command line – and the command is executed via a call to a ShellExecutA<\/em> API:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This is a Lolbin functionality in statu nascendi<\/a><\/em>. <\/p>\n\n\n\n

And while this may look like a non-issue, there are at least two items we should highlight:<\/p>\n\n\n\n