> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/lolbas.md).

# LOLBAS

Living Off The Land Binaries and Scripts

## File Transfers

The [certutil.exe](https://lolbas-project.github.io/lolbas/Binaries/Certutil/) tool is meant for handling certificates, but can be utilized for transfering and base64 encoding / decoding files. See more in the [certutil](/breakpoint/windows/windows-privilege-escalation/file-transportation.md#certutil) section.

## DLL Handling

Suppose we were to download a malicious DLL file onto a target machine, we could then use [rundll32.exe](https://lolbas-project.github.io/lolbas/Binaries/Rundll32/) for executing the DLL. 

## Always Install Elevated

The `Always install with elevated privileges` setting can be found in the registry and is responsible for whether or not MSI installers run as `SYSTEM`. 

{% code title="Querying the registry keys" %}

```powershell
PS C:\htb> reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
    AlwaysInstallElevated    REG_DWORD    0x1

PS C:\htb> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
    AlwaysInstallElevated    REG_DWORD    0x1
```

{% endcode %}

If we generate a malicious MSI package and execute we may be able to obtain a reverse shell as `SYSTEM`.

## CVE-2019-1388

A privilege escalation vulnerability in the Windows Certificate Dialog that was patched in November 2019. See details in this [post](https://app.gitbook.com/o/gKQhPowBrwBDw8VcWB5T/s/mGhYQRY1OEeL4zywZ9zS/~/edit/~/changes/57/windows/windows-privilege-escalation/lolbas/cve-2019-1388).

## Scheduled Tasks