Living Off the Land

Walkthrough summary

Living Off the Land TryHackMe walkthrough with 5 answered prompts and lab methodology notes.

Sample prompts covered

• Visit the LOLBAS project's website and check out its functionalities. Then, using the search bar, find the ATT&CK ID: T1040. What is the binary's name?
  Open the walkthrough page to inspect the full answer and command flow.
• Use the search bar to find more information about MSbuild.exe. What is the ATT&CK ID?
  Open the walkthrough page to inspect the full answer and command flow.
• Use the search bar to find more information about Scriptrunner.exe. What is the function of the binary?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the file content?
  Open the walkthrough page to inspect the full answer and command flow.
• Replicate the steps of the No PowerShell technique to receive a reverse shell on port 4444. Once a connection is established, a flag will be created automatically on the desktop. What is the content of the flag file?
  Open the walkthrough page to inspect the full answer and command flow.