Skip to main content
Getting files on or off a target is one of those things that comes up in almost every engagement. Pulling down enumeration scripts, moving tool binaries onto a box, exfiltrating loot. The method you reach for depends mostly on what’s already installed on the target and what the network actually allows out.

Download

Pulling a file from your attack host onto the target, usually a script or binary you need to run there. The most common direction by far.

Upload

Pushing a file from the target back to you, typically loot like credential dumps or config files you want to exfiltrate.
If no interpreter or transfer tool is available at all, built-in shell features like /dev/tcp on Linux or Base64 encoding can still move small files manually. Both are covered further down.

​
Hosting a Transfer Server

Before downloading anything onto a target, you need something on your attack host to serve it from. A quick HTTP server is the usual choice, but FTP and upload-specific servers come in handy depending on direction and protocol availability.
For receiving uploads instead of just serving files, use the uploadserver module:
If you need FTP specifically, pyftpdlib spins one up with write access enabled:

​
Linux

On a Linux target, which tool you reach for usually comes down to what’s actually installed. curl and wget cover most cases, but it’s worth knowing the fallbacks for when neither is present.

​
Download

Pulling a file from another host you already have access to:
When neither curl nor wget is available, the shell’s own /dev/tcp device can fetch a file over a raw HTTP request:

​
Upload

Uploading more than one file in a single request:

​
General Techniques

Mounting a remote share directly avoids a formal “transfer” step entirely, since files just become locally accessible.
RDP clients can mount a local folder into the session, useful for pulling files off a Windows box through an existing RDP connection:
When nothing can reach the network directly but you have copy-paste access to the shell, Base64 lets you move a file through plain text.
Reconstruct it on the other end:
GTFOBins is the best reference for file transfer and other tricks hiding in binaries you wouldn’t expect.

​
Windows

Windows has more built-in download paths than Linux does, partly because PowerShell gives you a full scripting environment. The trade-off is that most of these are well known to defenders.

​
Download

certutil is often overlooked by application allowlisting since it’s a signed Microsoft binary, which is exactly why it’s so heavily monitored now:
bitsadmin queues the download through the Background Intelligent Transfer Service instead of a direct connection:
Downloading and executing a script straight into memory, without ever writing it to disk:
If a proxy or filter is blocking requests based on User-Agent, spoofing one as Chrome often gets through:

​
Upload

Copying straight to a mounted WebDAV root behaves just like a normal file copy:

​
General Techniques

Mount a smb share
LOLBAS catalogs living-off-the-land binaries on Windows, including plenty of file transfer tricks beyond what’s listed here.

​
Other Languages

Worth keeping around for targets where neither a browser based download tool nor PowerShell is an option, just a bare interpreter.
Uploading a file with a Python one-liner, useful once you’ve got an upload server running:

​
Quick Reference Tools

GTFOBins

Unix binaries that can be abused for file transfer, privilege escalation, and more.

LOLBAS

The Windows equivalent of GTFOBins, cataloging built-in binaries with transfer and execution capabilities.

PowerShell Download Cheat Sheet

HarmJ0y’s reference of PowerShell download and execution one-liners.
Replace ATTACKER_IP and ports with your real listener or server details. For authorized penetration tests, CTFs, and lab environments only.