# LOLSpoof | An Interactive Shell To Spoof Some LOLBins Command Line

**URL:** <https://onehack.st/t/lolspoof-an-interactive-shell-to-spoof-some-lolbins-command-line/282714>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [May 12, 2024, 7:24pm UTC](https://onehack.st/t/lolspoof-an-interactive-shell-to-spoof-some-lolbins-command-line/282714 "2024-05-12T19:24:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [May 12, 2024, 7:24pm UTC](https://onehack.st/t/lolspoof-an-interactive-shell-to-spoof-some-lolbins-command-line/282714/1 "2024-05-12T19:24:33Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/f/ff2663540df03b7d4385ee8ce43334c7ebbeaabf.png)

# LOLSpoof

LOLSpoof is a an interactive shell program that automatically spoof the command line arguments of the spawned process. Just call your incriminate-looking command line LOLBin (e.g. `powershell -w hidden -enc ZwBlAHQALQBwAHIAbwBjAGUA....`) and LOLSpoof will ensure that the process creation telemetry appears legitimate and clear.

[![](https://github.com/itaymigdal/LOLSpoof/raw/main/Example.png)](https://github.com/itaymigdal/LOLSpoof/blob/main/Example.png)

> Use only for 64-bit LOLBins

## Why

Process command line is a very monitored telemetry, being thoroughly inspected by AV/EDRs, SOC analysts or threat hunters.

## How

1. Prepares the spoofed command line out of the real one: `lolbin.exe " " * sizeof(real arguments)`
2. Spawns that suspended LOLBin with the spoofed command line
3. Gets the remote PEB address
4. Gets the address of RTL\_USER\_PROCESS\_PARAMETERS struct
5. Gets the address of the command line unicode buffer
6. Overrides the fake command line with the real one
7. Resumes the main thread

## Opsec considerations

Although this simple technique helps to bypass command line detection, it may introduce other suspicious telemetry:

1. Creation of suspended process
2. The new process has trailing spaces (but it’s really easy to make it a repeated character or even random data instead)
3. Write to the spawned process with WriteProcessMemory

## Build

Built with Nim 1.6.12 (compiling with Nim 2.X yields errors!)

`nimble install winim`

## Known issue

Programs that clear or change the previous printed console messages (such as `timeout.exe 10`) breaks the program. when such commands are employed, you’ll need to restart the console. Don’t know how to fix that, open to suggestions.

## GitHub:

> **[GitHub - itaymigdal/LOLSpoof: An interactive shell to spoof some LOLBins command...](https://github.com/itaymigdal/LOLSpoof)**
>
> An interactive shell to spoof some LOLBins command line