LOLPROX | LOLPROX

LOLPROX

Star

Living Off The Land Proxmox (LOLPROX) is the curated catalog of native Proxmox VE binaries and techniques that adversaries can abuse for post-exploitation operations.

This project maintains a comprehensive list of binaries natively available in Proxmox VE that can be leveraged by adversaries during security assessments and red team operations. The documentation is compiled from real-world testing and threat research.

For the full write-up on LOLPROX techniques and methodology, see the blog post. For defensive guidance and detection strategies, see the defense blog post.

The project was created by ZephrFish, inspired by the LOLESXi project and following the methodology established by LOLBAS.

Binary	Type	Functions	Tags	ATT&CK Techniques
pct	Binaries	Discovery Execution Collection Privilege Escalation Configuration Impact Persistence	Lateral Movement Container Escape Container Escape Privilege Escalation	T1082 T1059 T1105 T1005 T1074.001 T1611 T1548 T1529 T1485 T1610
pve-firewall	Binaries	Discovery Defense Evasion	Defense Evasion	T1082 T1562.004
pvecm	Binaries	Discovery Impact		T1082 T1489
pveproxy	Binaries	Credential Access Discovery	Certificate Theft MITM Credential Access Ticket Forgery	T1552.004 T1082 T1552.001
pvesh	Binaries	Discovery Account Enumeration Permission Enumeration Execution Collection Persistence Privilege Escalation	Lateral Movement Guest Agent Abuse	T1082 T1087.001 T1069.001 T1059 T1005 T1136.001 T1098 T1074.001
pvesm	Binaries	Discovery Exfiltration Persistence		T1082 T1567 T1135 T1074
pvesr	Binaries	Discovery		T1082
pveum	Binaries	Account Enumeration Permission Enumeration Persistence Privilege Escalation Discovery Credential Access		T1087.001 T1069.001 T1136.001 T1098 T1098.001 T1552.001
pveversion	Binaries	Discovery		T1082
qm	Binaries	Discovery Execution Collection Impact Credential Access	Lateral Movement Guest Agent Abuse Credential Access	T1082 T1059 T1005 T1105 T1074.001 T1529 T1485 T1552.001
socat	Binaries	Command and Control Execution Lateral Movement	Covert Channel vsock Persistence vsock	T1572 T1059.004 T1090 T1059 T1090.001
vzdump	Binaries	Collection Exfiltration Execution Persistence		T1005 T1567 T1059 T1078
No binary matches your search query.

Tags

ATT&CK Techniques

Binaries

Lateral Movement