LOLESXi
Star

LOLESXi Logo

Living Off The Land ESXi

LOLESXi features a comprehensive list of binaries/scripts natively available in VMware ESXi that adversaries have utilised in their operations. The information on this site is compiled from open-source threat research.

This project is a collaborative project created by Janantha Marasinghe. Special thanks to Wietze Beukema for his contributions and the LOLBAS project for the theme. If you would like to contribute, check out our contribution guide. More information on programmatically accesssing this project can be found on the API page.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. You can see the current ATT&CK® mapping of this project on the ATT&CK® Navigator.

If you are looking for UNIX binaries, please visit gtfobins.github.io.
If you are looking for drivers, please visit loldrivers.io.
If you are looking for Windows Binaries, Scripts and Libraries please visit lolbas-project.github.io.

Icon Credit : Robot icons created by juicy_fish - Flaticon

Binary Type Functions Tags ATT&CK® Techniques
chmod Binaries
T1222.002
df Binaries
T1082
esxcfg-advcfg Binaries
esxcli Binaries
T1082
T1489
T1087.001
T1491.001
T1562.004
T1562.012
T1562.001
find Binaries
T1083
T1070.004
T1491.001
kill Binaries
T1489
mv Binaries
T1491
pkill Binaries
T1489
systemctl Binaries
T1529
touch Binaries
T1070.006
ulimit Binaries
vim-cmd Binaries
T1021.004
T1529
T1082
T1485
vm-support Binaries
T1082
vmkfstools Binaries
T1561.001
vpxa Binaries
T1489
No binary matches…