{"id":477880,"date":"2023-08-09T09:22:01","date_gmt":"2023-08-09T09:22:01","guid":{"rendered":""},"modified":"2023-09-05T11:15:36","modified_gmt":"2023-09-05T11:15:36","slug":"lolbin","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/lolbin\/","title":{"rendered":"\u6d1b\u5bbe"},"content":{"rendered":"<p>LOLBin \u662f\u201cLiving Off the Land Binaries\u201d\u7684\u7f29\u5199\uff0c\u662f\u7f51\u7edc\u5b89\u5168\u4e2d\u4f7f\u7528\u7684\u4e00\u4e2a\u672f\u8bed\uff0c\u6307 Windows \u64cd\u4f5c\u7cfb\u7edf\u4e0a\u5b58\u5728\u7684\u5408\u6cd5\u53ef\u6267\u884c\u6587\u4ef6\u3001\u5de5\u5177\u6216\u811a\u672c\uff0c\u8fd9\u4e9b\u6587\u4ef6\u53ef\u80fd\u88ab\u5a01\u80c1\u884c\u4e3a\u8005\u6ee5\u7528\u6765\u6267\u884c\u6076\u610f\u6d3b\u52a8\u3002\u8fd9\u4e9b\u4e8c\u8fdb\u5236\u6587\u4ef6\u662f\u7cfb\u7edf\u672c\u673a\u7684\uff0c\u901a\u5e38\u88ab\u7f51\u7edc\u72af\u7f6a\u5206\u5b50\u7528\u6765\u7ed5\u8fc7\u4f20\u7edf\u7684\u5b89\u5168\u63aa\u65bd\u3002\u901a\u8fc7\u5229\u7528\u8fd9\u4e9b\u9884\u5b89\u88c5\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u907f\u514d\u68c0\u6d4b\uff0c\u5e76\u4f7f\u5b89\u5168\u5de5\u5177\u96be\u4ee5\u533a\u5206\u5408\u6cd5\u6d3b\u52a8\u548c\u6076\u610f\u6d3b\u52a8\u3002<\/p>\n<h2>LOLBin\u7684\u8d77\u6e90\u5386\u53f2\u548c\u9996\u6b21\u63d0\u53ca<\/h2>\n<p>LOLBins \u7684\u6982\u5ff5\u5728 2014 \u5e74\u5de6\u53f3\u5728\u7f51\u7edc\u5b89\u5168\u793e\u533a\u4e2d\u5f97\u5230\u4e86\u91cd\u89c6\uff0c\u5f53\u65f6\u5b89\u5168\u7814\u7a76\u4eba\u5458\u5f00\u59cb\u89c2\u5bdf\u5230\u65e0\u6587\u4ef6\u653b\u51fb\u548c\u5229\u7528\u5408\u6cd5\u7cfb\u7edf\u5b9e\u7528\u7a0b\u5e8f\u8fdb\u884c\u6076\u610f\u76ee\u7684\u7684\u6280\u672f\u6709\u6240\u589e\u52a0\u3002\u9996\u6b21\u63d0\u53ca LOLBins \u662f\u5728 Casey Smith \u4e8e 2014 \u5e74\u53d1\u8868\u7684\u4e00\u7bc7\u9898\u4e3a\u201cLiving off the Land and EvadingDetection \u2013 A Survey of Common Practices\u201d\u7684\u7814\u7a76\u8bba\u6587\u4e2d\u3002\u8fd9\u7bc7\u8bba\u6587\u63ed\u793a\u4e86\u653b\u51fb\u8005\u5982\u4f55\u5229\u7528\u5185\u7f6e\u7684 Windows \u4e8c\u8fdb\u5236\u6587\u4ef6\u6765\u9690\u85cf\u4ed6\u4eec\u7684\u6d3b\u52a8\u548c\u884c\u4e3a\u3002\u9003\u907f\u68c0\u6d4b\u3002<\/p>\n<h2>\u6709\u5173 LOLBin \u7684\u8be6\u7ec6\u4fe1\u606f\uff1a\u6269\u5c55\u4e3b\u9898 LOLBin<\/h2>\n<p>LOLBins \u4ee3\u8868\u4e86\u7f51\u7edc\u5bf9\u624b\u5728\u96f7\u8fbe\u4e0b\u98de\u884c\u7684\u5de7\u5999\u7b56\u7565\u3002\u8fd9\u4e9b\u9884\u5b89\u88c5\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e3a\u653b\u51fb\u8005\u63d0\u4f9b\u4e86\u5e7f\u6cdb\u7684\u6b66\u5668\u5e93\u6765\u6267\u884c\u5404\u79cd\u547d\u4ee4\u3001\u4e0e\u7cfb\u7edf\u4ea4\u4e92\u4ee5\u53ca\u6267\u884c\u4fa6\u5bdf\uff0c\u800c\u65e0\u9700\u5728\u53d7\u5bb3\u8005\u7684\u8ba1\u7b97\u673a\u4e0a\u653e\u7f6e\u5176\u4ed6\u6076\u610f\u6587\u4ef6\u3002\u5b83\u4eec\u901a\u5e38\u7528\u4e8e\u65e0\u6587\u4ef6\u653b\u51fb\uff0c\u5176\u4e2d\u653b\u51fb\u4ec5\u53d1\u751f\u5728\u5185\u5b58\u4e2d\uff0c\u5728\u786c\u76d8\u9a71\u52a8\u5668\u4e0a\u51e0\u4e4e\u4e0d\u7559\u4e0b\u4efb\u4f55\u75d5\u8ff9\u3002<\/p>\n<p>LOLBins \u7684\u4f7f\u7528\u901a\u5e38\u4e0e\u5176\u4ed6\u6280\u672f\u7ed3\u5408\u4f7f\u7528\uff0c\u4f8b\u5982\u9646\u4e0a\u6218\u672f\u3001PowerShell \u811a\u672c\u7f16\u5199\u548c WMI\uff08Windows \u7ba1\u7406\u89c4\u8303\uff09\uff0c\u4ee5\u6700\u5927\u9650\u5ea6\u5730\u63d0\u9ad8\u5176\u6548\u7387\u3002 LOLBins \u5728\u540e\u5229\u7528\u573a\u666f\u4e2d\u7279\u522b\u6709\u6548\uff0c\u56e0\u4e3a\u5b83\u4eec\u4f7f\u653b\u51fb\u8005\u80fd\u591f\u878d\u5165\u5408\u6cd5\u7684\u7cfb\u7edf\u6d3b\u52a8\uff0c\u4ece\u800c\u4f7f\u5b89\u5168\u5206\u6790\u5e08\u96be\u4ee5\u533a\u5206\u6b63\u5e38\u884c\u4e3a\u548c\u6076\u610f\u884c\u4e3a\u3002<\/p>\n<h2>LOLBin \u7684\u5185\u90e8\u7ed3\u6784\uff1aLOLBin \u7684\u5de5\u4f5c\u539f\u7406<\/h2>\n<p>LOLBins \u662f\u9884\u88c5\u5728\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u7684\u672c\u673a Windows \u4e8c\u8fdb\u5236\u6587\u4ef6\u3002\u5b83\u4eec\u5177\u6709\u5408\u6cd5\u7684\u529f\u80fd\uff0c\u65e8\u5728\u534f\u52a9\u6267\u884c\u5404\u79cd\u7ba1\u7406\u4efb\u52a1\u3001\u7cfb\u7edf\u7ef4\u62a4\u548c\u6545\u969c\u6392\u9664\u3002\u653b\u51fb\u8005\u5728\u4e0d\u5f15\u8d77\u6000\u7591\u7684\u60c5\u51b5\u4e0b\u64cd\u7eb5\u8fd9\u4e9b\u4e8c\u8fdb\u5236\u6587\u4ef6\u6765\u5b9e\u73b0\u6076\u610f\u76ee\u6807\u3002 LOLBin \u7684\u5185\u90e8\u7ed3\u6784\u4e0e\u4efb\u4f55\u5e38\u89c4\u7cfb\u7edf\u4e8c\u8fdb\u5236\u6587\u4ef6\u7684\u5185\u90e8\u7ed3\u6784\u76f8\u540c\uff0c\u4f7f\u5176\u80fd\u591f\u5728\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u4e0d\u88ab\u53d1\u73b0\u7684\u60c5\u51b5\u4e0b\u8fd0\u884c\u3002<\/p>\n<p>\u8be5\u8fc7\u7a0b\u901a\u5e38\u6d89\u53ca\u4f7f\u7528\u547d\u4ee4\u884c\u53c2\u6570\u6765\u8c03\u7528\u7279\u5b9a\u529f\u80fd\u3001\u6267\u884c PowerShell \u547d\u4ee4\u6216\u8bbf\u95ee\u654f\u611f\u7cfb\u7edf\u8d44\u6e90\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528 LOLBins \u6267\u884c\u4ee3\u7801\u3001\u521b\u5efa\u6216\u4fee\u6539\u6587\u4ef6\u3001\u67e5\u8be2\u7cfb\u7edf\u6ce8\u518c\u8868\u3001\u901a\u8fc7\u7f51\u7edc\u8fdb\u884c\u901a\u4fe1\u4ee5\u53ca\u6267\u884c\u5b9e\u73b0\u5176\u76ee\u6807\u6240\u9700\u7684\u5176\u4ed6\u6d3b\u52a8\u3002<\/p>\n<h2>LOLBin\u5173\u952e\u7279\u6027\u5206\u6790<\/h2>\n<p>LOLBins \u63d0\u4f9b\u4e86\u51e0\u4e2a\u5bf9\u5a01\u80c1\u884c\u4e3a\u8005\u6709\u5438\u5f15\u529b\u7684\u5173\u952e\u529f\u80fd\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u5408\u6cd5\u51fa\u73b0<\/strong>\uff1aLOLBins \u5177\u6709\u6709\u6548\u7684\u6570\u5b57\u7b7e\u540d\uff0c\u5e76\u4e14\u901a\u5e38\u7531 Microsoft \u7b7e\u540d\uff0c\u8fd9\u4f7f\u5f97\u5b83\u4eec\u770b\u8d77\u6765\u503c\u5f97\u4fe1\u8d56\u5e76\u7ed5\u8fc7\u5b89\u5168\u68c0\u67e5\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u9690\u5f62<\/strong>\uff1a\u7531\u4e8e\u5b83\u4eec\u662f\u672c\u673a\u7cfb\u7edf\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0cLOLBins \u53ef\u4ee5\u6267\u884c\u6076\u610f\u4ee3\u7801\uff0c\u800c\u4e0d\u4f1a\u5f15\u53d1\u5371\u9669\u4fe1\u53f7\u6216\u89e6\u53d1\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u7684\u8b66\u62a5\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u65e0\u9700\u5220\u9664\u6076\u610f\u8f6f\u4ef6<\/strong>\uff1aLOLBins \u4e0d\u9700\u8981\u653b\u51fb\u8005\u5728\u53d7\u5bb3\u8005\u7684\u7cfb\u7edf\u4e0a\u653e\u7f6e\u989d\u5916\u7684\u6587\u4ef6\uff0c\u4ece\u800c\u51cf\u5c11\u4e86\u88ab\u53d1\u73b0\u7684\u673a\u4f1a\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6ee5\u7528\u53ef\u4fe1\u5de5\u5177<\/strong>\uff1a\u653b\u51fb\u8005\u5229\u7528\u5df2\u5217\u5165\u767d\u540d\u5355\u4e14\u88ab\u8ba4\u4e3a\u5b89\u5168\u7684\u5de5\u5177\uff0c\u8fd9\u4f7f\u5f97\u5b89\u5168\u5de5\u5177\u96be\u4ee5\u533a\u5206\u5408\u6cd5\u4f7f\u7528\u548c\u6076\u610f\u4f7f\u7528\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u65e0\u6587\u4ef6\u6267\u884c<\/strong>\uff1aLOLBins \u652f\u6301\u65e0\u6587\u4ef6\u653b\u51fb\uff0c\u51cf\u5c11\u6570\u5b57\u8db3\u8ff9\u5e76\u589e\u52a0\u53d6\u8bc1\u8c03\u67e5\u7684\u590d\u6742\u6027\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>LOLBin \u7684\u7c7b\u578b<\/h2>\n<table>\n<thead>\n<tr>\n<th>LOLBin\u7c7b\u578b<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>PowerShell \u811a\u672c<\/td>\n<td>\u5229\u7528 Windows \u4e2d\u5f3a\u5927\u7684\u811a\u672c\u8bed\u8a00 PowerShell \u6765\u6267\u884c\u6076\u610f\u6d3b\u52a8\u3002<\/td>\n<\/tr>\n<tr>\n<td>Windows \u7ba1\u7406\u89c4\u8303 (WMI)<\/td>\n<td>\u5229\u7528 WMI \u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u8fdc\u7a0b\u6267\u884c\u811a\u672c\u548c\u547d\u4ee4\u3002<\/td>\n<\/tr>\n<tr>\n<td>Windows \u547d\u4ee4\u63d0\u793a\u7b26 (cmd.exe)<\/td>\n<td>\u5229\u7528\u672c\u673a Windows \u547d\u4ee4\u884c\u89e3\u91ca\u5668\u6765\u6267\u884c\u547d\u4ee4\u548c\u811a\u672c\u3002<\/td>\n<\/tr>\n<tr>\n<td>Windows \u811a\u672c\u5bbf\u4e3b\uff08wscript.exe\u3001cscript.exe\uff09<\/td>\n<td>\u6267\u884c\u7528 VBScript \u6216 JScript \u7f16\u5199\u7684\u811a\u672c\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>LOLBin\u7684\u4f7f\u7528\u65b9\u6cd5\u3001\u4f7f\u7528\u4e2d\u9047\u5230\u7684\u95ee\u9898\u53ca\u89e3\u51b3\u65b9\u6cd5<\/h2>\n<h3>LOLBin \u7684\u4f7f\u7528\u65b9\u6cd5<\/h3>\n<ol>\n<li>\n<p><strong>\u6743\u9650\u63d0\u5347<\/strong>\uff1aLOLBins \u53ef\u7528\u4e8e\u63d0\u5347\u53d7\u611f\u67d3\u7cfb\u7edf\u7684\u6743\u9650\uff0c\u4ece\u800c\u83b7\u5f97\u5bf9\u654f\u611f\u4fe1\u606f\u548c\u8d44\u6e90\u7684\u8bbf\u95ee\u6743\u9650\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4fe1\u606f\u6536\u96c6<\/strong>\uff1a\u5a01\u80c1\u53c2\u4e0e\u8005\u5229\u7528 LOLBins \u6536\u96c6\u6709\u5173\u76ee\u6807\u7cfb\u7edf\u7684\u4fe1\u606f\uff0c\u5305\u62ec\u5b89\u88c5\u7684\u8f6f\u4ef6\u3001\u7f51\u7edc\u914d\u7f6e\u548c\u7528\u6237\u5e10\u6237\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6a2a\u5411\u8fd0\u52a8<\/strong>\uff1a\u653b\u51fb\u8005\u5229\u7528 LOLBins \u5728\u7f51\u7edc\u5185\u6a2a\u5411\u79fb\u52a8\uff0c\u4ece\u4e00\u4e2a\u7cfb\u7edf\u8df3\u5230\u53e6\u4e00\u4e2a\u7cfb\u7edf\uff0c\u540c\u65f6\u4fdd\u6301\u9690\u79d8\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u575a\u6301<\/strong>\uff1aLOLBins \u4f7f\u653b\u51fb\u8005\u80fd\u591f\u5728\u53d7\u611f\u67d3\u7684\u7cfb\u7edf\u4e0a\u5efa\u7acb\u6301\u4e45\u6027\uff0c\u786e\u4fdd\u4ed6\u4eec\u53ef\u4ee5\u957f\u65f6\u95f4\u4fdd\u6301\u8bbf\u95ee\u3002<\/p>\n<\/li>\n<\/ol>\n<h3>\u4f7f\u7528\u8fc7\u7a0b\u4e2d\u51fa\u73b0\u7684\u95ee\u9898\u53ca\u89e3\u51b3\u65b9\u6cd5<\/h3>\n<p>LOLBins \u7684\u4f7f\u7528\u7ed9\u7f51\u7edc\u5b89\u5168\u4e13\u4e1a\u4eba\u5458\u5e26\u6765\u4e86\u91cd\u5927\u6311\u6218\u3002\u5176\u4e2d\u4e00\u4e9b\u95ee\u9898\u5305\u62ec\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u68c0\u6d4b<\/strong>\uff1a\u4f20\u7edf\u7684\u57fa\u4e8e\u7b7e\u540d\u7684\u5b89\u5168\u5de5\u5177\u53ef\u80fd\u96be\u4ee5\u68c0\u6d4b LOLBins\uff0c\u56e0\u4e3a\u5b83\u4eec\u7684\u5408\u6cd5\u6027\u548c\u7f3a\u4e4f\u5df2\u77e5\u7684\u6076\u610f\u8f6f\u4ef6\u6a21\u5f0f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u80fd\u89c1\u5ea6<\/strong>\uff1a\u7531\u4e8e LOLBins \u5728\u5408\u6cd5\u7684\u7cfb\u7edf\u8fdb\u7a0b\u4e2d\u8fd0\u884c\uff0c\u56e0\u6b64\u5b83\u4eec\u901a\u5e38\u4f1a\u9003\u907f\u57fa\u4e8e\u884c\u4e3a\u5206\u6790\u7684\u68c0\u6d4b\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u767d\u540d\u5355<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u6ee5\u7528\u767d\u540d\u5355\u673a\u5236\uff0c\u5141\u8bb8\u5df2\u77e5\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e0d\u53d7\u9650\u5236\u5730\u8fd0\u884c\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u51cf\u8f7b<\/strong>\uff1a\u5b8c\u5168\u7981\u7528\u6216\u963b\u6b62 LOLBins \u662f\u4e0d\u53ef\u884c\u7684\uff0c\u56e0\u4e3a\u5b83\u4eec\u670d\u52a1\u4e8e\u57fa\u672c\u7684\u7cfb\u7edf\u529f\u80fd\u3002<\/p>\n<\/li>\n<\/ol>\n<p>\u4e3a\u4e86\u5e94\u5bf9\u8fd9\u4e9b\u6311\u6218\uff0c\u7ec4\u7ec7\u9700\u8981\u91c7\u7528\u591a\u5c42\u5b89\u5168\u65b9\u6cd5\uff0c\u5305\u62ec\uff1a<\/p>\n<ul>\n<li><strong>\u884c\u4e3a\u5206\u6790<\/strong>\uff1a\u91c7\u7528\u57fa\u4e8e\u884c\u4e3a\u7684\u68c0\u6d4b\u65b9\u6cd5\u6765\u8bc6\u522b\u5f02\u5e38\u6d3b\u52a8\uff0c\u5373\u4f7f\u5728\u5408\u6cd5\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e2d\u4e5f\u662f\u5982\u6b64\u3002<\/li>\n<li><strong>\u5f02\u5e38\u68c0\u6d4b<\/strong>\uff1a\u5229\u7528\u5f02\u5e38\u68c0\u6d4b\u6765\u53d1\u73b0\u4e0e\u6b63\u5e38\u7cfb\u7edf\u884c\u4e3a\u7684\u504f\u5dee\u3002<\/li>\n<li><strong>\u7aef\u70b9\u4fdd\u62a4<\/strong>\uff1a\u6295\u8d44\u5148\u8fdb\u7684\u7aef\u70b9\u4fdd\u62a4\u5de5\u5177\uff0c\u53ef\u4ee5\u68c0\u6d4b\u65e0\u6587\u4ef6\u653b\u51fb\u548c\u57fa\u4e8e\u5185\u5b58\u7684\u653b\u51fb\u3002<\/li>\n<li><strong>\u7528\u6237\u6559\u80b2<\/strong>\uff1a\u6559\u80b2\u7528\u6237\u6709\u5173\u7f51\u7edc\u9493\u9c7c\u548c\u793e\u4f1a\u5de5\u7a0b\u7684\u98ce\u9669\uff0c\u5b83\u4eec\u662f\u4f20\u64ad\u57fa\u4e8e LOLBin \u7684\u653b\u51fb\u7684\u5e38\u89c1\u5a92\u4ecb\u3002<\/li>\n<\/ul>\n<h2>\u4e3b\u8981\u7279\u70b9\u53ca\u4e0e\u540c\u7c7b\u672f\u8bed\u7684\u5176\u4ed6\u6bd4\u8f83<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u5b66\u671f<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u6d1b\u5bbe\u65af<\/td>\n<td>\u5408\u6cd5\u7684\u7cfb\u7edf\u4e8c\u8fdb\u5236\u6587\u4ef6\u88ab\u7528\u4e8e\u6076\u610f\u76ee\u7684\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u65e0\u6587\u4ef6\u653b\u51fb<\/td>\n<td>\u653b\u51fb\u4e0d\u4f9d\u8d56\u4e8e\u5c06\u6587\u4ef6\u5220\u9664\u5230\u76ee\u6807\u7cfb\u7edf\u4e0a\uff0c\u4ec5\u5728\u5185\u5b58\u4e2d\u8fd0\u884c\u3002<\/td>\n<\/tr>\n<tr>\n<td>PowerShell\u5e1d\u56fd<\/td>\n<td>\u4e00\u4e2a\u5229\u7528 PowerShell \u8fdb\u884c\u653b\u51fb\u64cd\u4f5c\u7684\u540e\u5229\u7528\u6846\u67b6\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u9760\u571f\u5730\u8c0b\u751f\u7684\u7b56\u7565<\/td>\n<td>\u5229\u7528\u5185\u7f6e\u5de5\u5177\u8fdb\u884c\u6076\u610f\u6d3b\u52a8\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4e0e LOLBin \u76f8\u5173\u7684\u672a\u6765\u524d\u666f\u548c\u6280\u672f<\/h2>\n<p>\u968f\u7740\u6280\u672f\u7684\u53d1\u5c55\uff0c\u653b\u51fb\u8005\u548c\u9632\u5fa1\u8005\u4f7f\u7528\u7684\u6280\u672f\u4e5f\u4f1a\u4e0d\u65ad\u53d1\u5c55\u3002 LOLBins \u7684\u672a\u6765\u53ca\u5176\u5bf9\u7b56\u53ef\u80fd\u6d89\u53ca\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u4eba\u5de5\u667a\u80fd\u9a71\u52a8\u7684\u68c0\u6d4b<\/strong>\uff1a\u4eba\u5de5\u667a\u80fd\u9a71\u52a8\u7684\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u5c06\u901a\u8fc7\u5206\u6790\u5927\u91cf\u6570\u636e\u5e76\u8bc6\u522b\u8868\u660e\u6076\u610f\u884c\u4e3a\u7684\u6a21\u5f0f\u6765\u6539\u8fdb\u57fa\u4e8e LOLBin \u7684\u653b\u51fb\u7684\u68c0\u6d4b\u548c\u9884\u9632\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u884c\u4e3a\u5206\u6790\u589e\u5f3a\u529f\u80fd<\/strong>\uff1a\u57fa\u4e8e\u884c\u4e3a\u7684\u68c0\u6d4b\u673a\u5236\u5c06\u53d8\u5f97\u66f4\u52a0\u590d\u6742\uff0c\u53ef\u4ee5\u66f4\u597d\u5730\u533a\u5206\u5408\u6cd5\u6d3b\u52a8\u548c\u6076\u610f\u6d3b\u52a8\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u96f6\u4fe1\u4efb\u67b6\u6784<\/strong>\uff1a\u7ec4\u7ec7\u53ef\u4ee5\u91c7\u7528\u96f6\u4fe1\u4efb\u539f\u5219\uff0c\u5728\u5141\u8bb8\u6267\u884c\u4e4b\u524d\u9a8c\u8bc1\u6bcf\u4e2a\u64cd\u4f5c\uff0c\u51cf\u5c11 LOLBins \u7684\u5f71\u54cd\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u786c\u4ef6\u5b89\u5168<\/strong>\uff1a\u57fa\u4e8e\u786c\u4ef6\u7684\u5b89\u5168\u529f\u80fd\u53ef\u4ee5\u901a\u8fc7\u5b9e\u65bd\u66f4\u5f3a\u5927\u7684\u9694\u79bb\u548c\u5b8c\u6574\u6027\u68c0\u67e5\u6765\u5e2e\u52a9\u963b\u6b62 LOLBin \u653b\u51fb\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u5982\u4f55\u4f7f\u7528\u4ee3\u7406\u670d\u52a1\u5668\u6216\u5982\u4f55\u5c06\u4ee3\u7406\u670d\u52a1\u5668\u4e0e LOLBin \u5173\u8054<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\u5728\u9632\u5fa1\u57fa\u4e8e LOLBin \u7684\u653b\u51fb\u65b9\u9762\u53d1\u6325\u7740\u81f3\u5173\u91cd\u8981\u7684\u4f5c\u7528\u3002\u5b83\u4eec\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u65b9\u5f0f\u4f7f\u7528\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u4ea4\u901a\u5de1\u68c0<\/strong>\uff1a\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u68c0\u67e5\u7f51\u7edc\u6d41\u91cf\u662f\u5426\u5b58\u5728\u53ef\u7591\u6a21\u5f0f\uff0c\u5305\u62ec\u901a\u5e38\u4e0e LOLBins \u76f8\u5173\u7684\u901a\u4fe1\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6076\u610f\u5185\u5bb9\u8fc7\u6ee4<\/strong>\uff1a\u4ee3\u7406\u53ef\u4ee5\u963b\u6b62\u5bf9 LOLBin \u8fd0\u8425\u5546\u4f7f\u7528\u7684\u5df2\u77e5\u6076\u610f\u57df\u548c IP \u5730\u5740\u7684\u8bbf\u95ee\u3002<\/p>\n<\/li>\n<li>\n<p><strong>SSL\/TLS \u89e3\u5bc6<\/strong>\uff1a\u4ee3\u7406\u53ef\u4ee5\u89e3\u5bc6\u548c\u68c0\u67e5\u52a0\u5bc6\u6d41\u91cf\uff0c\u4ee5\u68c0\u6d4b\u548c\u963b\u6b62\u901a\u8fc7 LOLBins \u4f20\u9012\u7684\u6076\u610f\u8d1f\u8f7d\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u533f\u540d\u68c0\u6d4b<\/strong>\uff1a\u4ee3\u7406\u53ef\u4ee5\u8bc6\u522b\u5e76\u963b\u6b62\u4f7f\u7528\u533f\u540d\u6280\u672f\u9690\u85cf LOLBin \u6d41\u91cf\u7684\u5c1d\u8bd5\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u6709\u5173 LOLBins \u548c\u7f51\u7edc\u5b89\u5168\u6700\u4f73\u5b9e\u8df5\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u60a8\u53ef\u4ee5\u53c2\u8003\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ol>\n<li><a href=\"https:\/\/www.blackhat.com\/docs\/us-15\/materials\/us-15-Smith-Living-Off-The-Land-And-Evading-Endpoint-Security-For-Fun-And-Profit.pdf\" target=\"_new\" rel=\"noopener nofollow\">\u9760\u571f\u5730\u4e3a\u751f\u5e76\u9003\u907f\u68c0\u6d4b\u2014\u2014\u5e38\u89c1\u505a\u6cd5\u8c03\u67e5<\/a> \u2013 Casey Smith \u7684\u7814\u7a76\u8bba\u6587\uff0c2014 \u5e74\u3002<\/li>\n<li><a href=\"https:\/\/attack.mitre.org\/techniques\/T1218\/\" target=\"_new\" rel=\"noopener nofollow\">MITRE ATT&amp;CK \u2013 LOLBins<\/a> \u2013 MITRE ATT&amp;CK \u6846\u67b6\u4e2d LOLBins \u7684\u4fe1\u606f\u3002<\/li>\n<li><a href=\"https:\/\/www.sans.org\/cyber-security-summit\/archives\/file\/summit-archive-1492182931.pdf\" target=\"_new\" rel=\"noopener nofollow\">\u9632\u5fa1 LOLBAS<\/a> \u2013 \u5173\u4e8e\u9632\u5fa1\u201c\u9760\u5730\u751f\u6d3b\u201d\u4e8c\u8fdb\u5236\u6587\u4ef6\u548c\u811a\u672c\u7684\u767d\u76ae\u4e66\u3002<\/li>\n<\/ol>\n<p>LOLBins \u5728\u4e0d\u65ad\u53d1\u5c55\u7684\u7f51\u7edc\u5b89\u5168\u9886\u57df\u63d0\u51fa\u4e86\u91cd\u5927\u6311\u6218\u3002\u4e86\u89e3\u4ed6\u4eec\u7684\u6280\u672f\u5e76\u91c7\u7528\u4e3b\u52a8\u9632\u5fa1\u7b56\u7565\u5bf9\u4e8e\u4fdd\u62a4\u7cfb\u7edf\u548c\u6570\u636e\u514d\u53d7\u8fd9\u4e9b\u6f5c\u5728\u5a01\u80c1\u81f3\u5173\u91cd\u8981\u3002<\/p>","protected":false},"featured_media":477881,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477880","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>LOLBin: Living Off the Land Binaries for Cybersecurity<\/mark>","faq_items":[{"question":"What is LOLBin?","answer":"<p>LOLBin, short for \"Living Off the Land Binaries,\" refers to legitimate executables, tools, or scripts on a Windows operating system that cyber adversaries abuse for malicious activities. These pre-installed binaries allow attackers to evade detection and execute various commands without raising suspicion.<\/p>"},{"question":"How did LOLBin originate?","answer":"<p>The concept of LOLBins gained prominence around 2014 when researchers noticed an increase in fileless attacks and techniques using built-in Windows binaries for malicious purposes. The term was first mentioned in a research paper titled \"Living off the Land and Evading Detection - A Survey of Common Practices\" by Casey Smith in 2014.<\/p>"},{"question":"How do LOLBins work?","answer":"<p>LOLBins are native Windows binaries that come pre-installed on the system, designed for legitimate administrative tasks. Cybercriminals manipulate these binaries to perform malicious activities, leveraging their legitimate appearance and functionalities to avoid detection.<\/p>"},{"question":"What are the key features of LOLBins?","answer":"<p>LOLBins offer several key features that attract threat actors, including their legitimate appearance, invisibility, fileless execution, and abuse of trusted tools.<\/p>"},{"question":"What types of LOLBins exist?","answer":"<p>LOLBins come in various types, including PowerShell Scripts, Windows Management Instrumentation (WMI), Windows Command Prompt (cmd.exe), and Windows Script Host (wscript.exe, cscript.exe).<\/p>"},{"question":"How are LOLBins used, and what are the associated problems?","answer":"<p>LOLBins are used for privilege escalation, information gathering, lateral movement, and persistence. The associated problems include difficulty in detection, visibility, whitelisting abuse, and mitigation challenges.<\/p>"},{"question":"How can organizations counter LOLBin-based attacks?","answer":"<p>Organizations can adopt a multi-layered security approach involving behavioral analysis, anomaly detection, advanced endpoint protection, and user education to mitigate LOLBin threats effectively.<\/p>"},{"question":"What are the future perspectives and technologies related to LOLBins?","answer":"<p>The future of LOLBins may involve AI-driven detection, enhanced behavioral analysis, zero trust architecture, and hardware-based security features to combat these threats effectively.<\/p>"},{"question":"How can proxy servers help with LOLBin defense?","answer":"<p>Proxy servers can assist in LOLBin defense by inspecting traffic, filtering malicious content, decrypting SSL\/TLS traffic, and detecting anonymization attempts.<\/p>"},{"question":"Where can I find more information about LOLBins?","answer":"<p>For more information on LOLBins and cybersecurity best practices, refer to the provided related links, research papers, and the MITRE ATT&amp;CK framework.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477880\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/477881"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477880"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}