What technique is used when downloading fgdump.exe with certutil?
A penetration tester issues the following command after obtaining a shell: Which of the following describes this technique? - 
Community Votes
78% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between using a native tool for download (LotL) and the ultimate goal of the downloaded tool; the trap is to pick privilege escalation because fgdump is a privilege escalation tool.
The correct answer is D: Living-off-the-land. This technique leverages built-in Windows utilities like certutil to download attacker tools, evading detection. The community strongly favors D, with 78 votes, while noting that the purpose is not privilege escalation itself.
B (Privilege escalation) is the most common wrong answer. While fgdump.exe is intended for privilege escalation later, the command shown only downloads it; the technique described is using a built-in utility (certutil) to perform the download, which is living-off-the-land.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The command uses certutil, a legitimate Windows built-in utility, to download fgdump.exe from a remote URL. This is a classic example of living-off-the-land, where attackers leverage native system tools to avoid detection. Commenter [2] correctly explains that certutil is often used for certificate management but can also download files, making this technique harder for defenses to flag. The action itself—downloading a file with a trusted utility—is the focus, not what the downloaded file will do later.
Why the Other Options Are Wrong
Option A (backdoor) is incorrect because no persistence mechanism or remote access capability is established by the command; it only downloads a file. Option C (PowerShell remoting) is wrong because no PowerShell cmdlets or remoting sessions are used; certutil is a separate utility. Option B (privilege escalation) is the most tempting but incorrect: while fgdump.exe is a password hash dump tool often used in privilege escalation, the command shown only downloads it—no privilege escalation is actually performed. The commenter [3] argues that the 'fgdump is not native' and that it targets password cracking, but the technique being tested is the method of downloading, not the purpose of the tool.
Community Comment Notes
The community vote was 78 for D vs 22 for B, reflecting a strong consensus toward living-off-the-land. Comments [1] and [4] clearly articulate that the use of a built-in binary (LOLBin) defines the technique. Comment [5] supports B, focusing on the purpose of fgdump, but comment [6] directly corrects that view by saying 'Yeti87 is wrong.' This highlights a common exam trap: distinguishing between the current action (download via native tool) and the potential future impact of the downloaded content.
Official Reference
Exam Strategy
Focus on the action in the command, not the tool's intended purpose. The technique is about how the action is performed (using a built-in binary) rather than what the downloaded tool will do later. In penetration testing exams, always analyze what the command actually does at the moment, not what the attacker plans to do next.