LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Odbcconf.exe

View source

Used in Windows for managing ODBC connections

Execute
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute3

EXAMPLE 01T1218.008

Execute DllRegisterServer from DLL specified.

COMMAND
odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}
USE CASE
Execute a DLL file using technique that can evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
EXAMPLE 02T1218.008

Install a driver and load the DLL. Requires administrator privileges.

COMMAND
odbcconf INSTALLDRIVER "lolbas-project|Driver={PATH_ABSOLUTE:.dll}|APILevel=2"
odbcconf configsysdsn "lolbas-project" "DSN=lolbas-project"
USE CASE
Execute dll file using technique that can evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
EXAMPLE 03T1218.008

Load DLL specified in target .RSP file. See the Code Sample section for an example .RSP file.

COMMAND
odbcconf -f {PATH:.rsp}
USE CASE
Execute dll file using technique that can evade defensive counter measures
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\odbcconf.exe
C:\Windows\SysWOW64\odbcconf.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Adam@Hexacorn