How to Proxy Command Execution: "Living Off The Land" Hacks 

lol

just give me my botnet so I can press the funny button. Ion cannon go brr

Ion cannon wasn't a botnet? It was just software that spammed request from your computer only to specified site that you started by running it there were no c2's, it was dependent on many people launching the tool at once following others. DDoS will probably go down in history as the method of attack from people with zero knowledge.

Best Comment Ever!

@@whateverppl1229 what is your botnet price

I just tried it, it runs as the user who ran tpmtool.exe, so no privesc.

Which version/patch of Windows are you seeing this on? On a fully updated Windows 11 box it still seems to work just fine for me.

@@_JohnHammond windows 11 my old computer had a lot of problems with my linux terminals on there never working like Ubuntu and Debian do u use windows 11?

bro do it your self dont be a *SKID*

@@corruption781i can't find anything related to that

@@demon1058 i highly doubt that lol.

Sektor7

@@demon1058 If you can't Google and find information or education resources, then don't bother going any further to be a hacker, it's probably THE most important skill, to be able to find things out.

Hard part is probably getting the malware on there in the first place, let alone executing it.

Any good AV detects a lot of living off the land techniques. At least well known ones

Which "good, at least well known" AVs are you referring to that would detect living off the land techniques?

@@_JohnHammond Sorry for the late reply I barely saw this. EDRs Ive gone against in my testing (elastic, crowdstrike and sentinel one) all detect basic LOLbin techniques. Especially ones commonly used by threat actors. Rundll32, RegSvr, MSHTA, MsBuild etc. This technique that youre looking at is a bit more advanced, messing with some nuances in the commandline of a spawned LOLBIN that doesnt specify a full path. In a way this is similar to DLL hijacking, they do not specify the full path of the target dll to load (just like the full path to logman isnt specified) and therefore it loads whatever is in the current directory first before going through the standard search order. Edit: I forgot to mention even basic Windows Defender will detect a lot of LOLBIN techniques, and it wasnt my payload getting detected it was the techniques themselves. Also in my initial comment I meant well known as in “well known LOLBIN techniques”, not well known AVs, sorry about that. Either way it should still stand

someone*

problem*