A penetration tester needs to use the native binaries on a system in order to download a file from the internet and evade detection. Which of the following tools would the tester most likely use?

The correct answer is B. certutil.exe. certutil.exe is a native Windows binary originally designed for certificate management, but it can be used to download files from the internet using the -urlcache -split -f flags, making it a popular Living off the Land (LOtL) technique to evade detection since it's a trusted, bu

Submitted by daniela_cl· Mar 6, 2026Post-exploitation and Lateral Movement

Question

Options

Anetsh.exe
Bcertutil.exe
Cnc.exe
Dcmdkey.exe

How the community answered

(27 responses)

A
11% (3)
B
81% (22)
C
4% (1)
D
4% (1)

Explanation

certutil.exe is a native Windows binary originally designed for certificate management, but it can be used to download files from the internet using the -urlcache -split -f flags, making it a popular Living off the Land (LOtL) technique to evade detection since it's a trusted, built-in tool. netsh.exe (Option A) is a network configuration utility used for managing firewall rules and network settings, but it cannot download files from the internet. nc.exe (Option C), while useful for transferring data over a network, is not a native Windows binary - it must be separately installed, which disqualifies it as a "living off the land" tool. cmdkey.exe (Option D) is used to manage stored credentials in Windows and has no file-downloading capability.

Memory Tip: Think of "cert"util as a tool that has gone "cert-ifiably rogue" - it was built for certificates but moonlights as a secret file downloader. If an exam question mentions downloading files + native binaries + evasion, always think certutil.

Topics

#Living Off The Land#File Transfer#Evading Detection#Windows Binaries

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice