Hello everyone and welcome to the file transfer section of our course
So today we're going to cover a few different ways to transfer files to or from a machine
This becomes important in post exploitation
So we may need to do this if we need to upload future exploits and attempt to do privilege escalation
Or if we just need to pull some files off of machine that we found and that might be interesting
So in order to do that we have several different methods in this is not even all of them
But what I'm going to show you today
It's going to be http
W get which is really common with Linux
FTP
Tftp which we might use if we're attacking an XP or 2003 Windows machine
Powershell which is going to be for Windows 7 and up pretty typically
And then Metasploit
Let's go ahead and get started covering these
If we go in dark alley machine
I want to go ahead and pick a file that we want to transfer back and forth
So for me today I'm sitting in the bar www HTML folder
And I'm going to be working with this exploit. PHP
We're just going to keep trying to transfer this back-and-forth between machines and see what happens
So the first thing I want to show you is just http
So if we were trying to get something from HTTP we could be hosting it out
And it could just be sitting on our file server
So as long as he's Apache running and it's sitting in the www folder
We could say exploit. PHP and it might pull it we might have to find another way to grab it but
But it's here
So if we want to grab it we could also use W get
To do that
So let's go ahead and try that
Soww get his to command
We could type in HTTP and the web address we want to get
And then the filename to exploit. PHP
Okay it looks like we got it that worked if we were to try it and say it was exploit 23
So far for not found
You can do this with pretty much anything at all on the web
You can use W get to grab index Pages if you want or if you're trying to clone say like google.com you could just
W get google.com
And it would work for you
The nice thing is this is built into the majority of Linux machines
So when you're trying to do file transfers in terms of Linux you're most likely going to go to use W get and
Not your stopping point
The real trouble
With file transfers in my opinion is using it through windows
Because Windows doesn't have W get included
And more likely than not it's 99% chance they're not going to have W get installed
So you're going to have to get creative with your file transfer methods
So one of the methods that we can use and it's pretty common
Is to just use FTP
Is FTP is built into most Windows machines by default
So there's a couple tools we can use you could download more expansive FTP servers but if you just
Want to use a basic FTP server
You could run it with python
Or you could use Metasploit so I can show you both of those today
And the python one is actually an add-on so if you type in app get
Install
And then you going to want to install python -
Pi ftpd lib
I've already got it
So it doesn't need it here for me
But go ahead and install that
And then similar to the python HTTP server
What you can do here is you can actually come in and transfer over to your
Folder you want to be in
So this is where ever you want to host it's really fast
And then all you have to say is python Dash M and then it's pie ft
Apdweb when you pick your part support 21 pretty standard default FTP port
And that's it now you're hosting
So with your Windows machine
What we need to do is get into command line
Let me go ahead and bring that up now
Let's full-screen it here for a minute
So
What do we need to do here while we can do this a couple different ways
We can go long Rock here let's just go ahead and do that so if we say FTP
I will pick up our address here
Tech21 is a port maybe not was just try like that
Okay
So if we FTP here we could say users anonymous
Patrick V anything real estate password
Kaiser login successful
So dep dep
We always want to be in binary
It's just a typeset here
I prefer it I've had issues with bringing files over the other way and it doesn't work for me
I'm still always use binary as opposed to ASCII
And then we're going to say get exploit. PHP
Transfer complete and that's it so
Now we can just say bye
We can confirm that we have transferred out PHP in the directory or the exploit. PHP I apologize
There it is
So now what can we do
Well
In a perfect world we're not going to
We're going to be able to use this but I work
Most likely not going to be able to use this to both situations
We are actually going to most likely have to do is script us out
So how can we script it out we can basically do the same thing we just did here
So what that might look like
Is if we were to just do an FTP file so will say echo in the Saints
FTP or dismiss a open here
But the same IP address in
And then we're going to just call it FTP. Text
Okay so now we need to type in the rest of it so what do we do next we logged in
I remember when you used to of the little arrows here do not overwrite the text
Then we use the password we just called it password
We set everything to binary
And then we retrieved exploit. PHP
And then we told it goodbye so there's by
So what we need to do now and I'm going to go ahead and remove
This folder here
Salmon to remove the the file from the folder if we're going to remove the exploit I just want to confirm that it came back over
To the syntax now that we can use is a hyphen s
And then we're just going to say FTP. Text
Case it's getting us in are here let's look at the fire really quick
And see what's going on
Does not liking password for some reason looks try
Just calling it pass
Say that and try it one more time
Okay take me a little bit of toiling around with this year
But what the issue was
Was there was a space here after Anonymous and I was throwing it off so make sure that you don't have any spaces in here
And then go ahead and save it again and try it
And then your file transfer should work
So when we're doing this and we're sending these commands
Maybe we don't put the space in right here for anonymous maybe we just punch it all together
So that was my mistake I apologize but now we have it working
And we can confirm that really quick we could just do a derp make sure the exploit. PHP is there and it is
So that's really it for this way of doing it
We could also control see in this is nice here too cuz you can see if your FTP is working that's why I like these pythons
Servers
Let's go ahead and close this out we can open up msfconsole
And we can do it
The other way so let's go ahead and hose with msfconsole
And I'm not going to go to the whole file transfer again I'm just going to kind of show you the auxiliary module and then you can kind of player
Grounded if you want
So the auxiliary module is going to be auxiliary
Server
FTV we can show options in here
And then it tells you what folder do you want you can have a password and username you can change your
Or if you want
I'm pretty easy here pretty straightforward
So really we could just set the folder you want to use and then to say use
Would you say use or we can say exploit we want to be cooler and then it's just running
When is a background on the job
So
That's pretty much it for FTP
Now let's go ahead and exit out of
Metasploit
And let's look at FTP so if we wanted to run FTP or TF
ICP I'm sorry
Do you want to run tftp there's actually tool that comes built-in where we can run our own tftp server
And that is a tftp d
And then the syntax is just Damon and then you're poor
Which is always 69 unless you want it to be something different and then you pick the folder you want to run it in
And I just do var www HTML
Okay so now it's at and it's running
If you wanted to pull a file using tftp you would go through a command line on Windows
So similar here except it's not going to work for us there is no tftp
On my version of Windows Windows 10
Does not recognize them to show you the syntax
So this will work on XP and it will work on 2003
In the syntax is just this tftp
- I than the IP address
The get command and then what you want to get exploit. PHP so that's
Syntax there
It's a pretty straightforward and Fortune I can show you the example I don't have an XP machine
Or a2003 machine on any sort of VM
So what we're going to do next then
Is there going to come in here and we're going to practice with Powershell
So this one is probably
A good example of real world you might not see it too much in the labs but you should encounter it a few times
So what we're going to do is we're going to write a script here for the Powershell
And it's going to look something along the lines of this
So
Somewhere to FTP we're going to make
These following commands to make a file here
Is there an echo storage with a present working directory here
And working just call this we call it get and we'll call it PS1 that's a Powershell file
So we're going to Dan Echo webclient here
We're going to call this new object
System.net. Web client
And then this is also going to be
Yet. PS1
Okay now we're going to Echo URL
In our URL is going to be our web server
And we want to grab from its we're going to grab exploit. PHP
Also put this and get that PS1
Now we're going to set a variable of file we can just also called
Call the exploit. PHP if they want to rename and something else we could get that PS1
And then finally we're going to
Set a variable of webclient downloadfile
The URL and the file
Get a PS1 here again
So now you come back in here and just delete one more time
Or exploit. PHP
And let's go ahead and try this to the syntax of E powershell.exe
Execution policy
Bypass
No logo non-interactive
No profile file yet. PS
And there it is so exploit. PHP came over again
So just another way to transfer this might be really useful like I said in the real world
So keep this one in mind and I do recommend making a script where you can just kind of copy and paste these in
So you have to type this out every time it gets annoying
I'm so if you just copy these and you could also one line knees
So for example if you were to
Copy this here and you paste it in you can do an ampersand you can copy
The next one
And then paste it in and do the same thing with another Ampersand and keep going all the way until it's done so if you
You want to make a one liner like that that would also work
It's up to you
But just food for thought things to think about so at all the script in there we can do the more scripting the better it is for us
Seizure design Us in the more time we safe just my opinion there
It's the last time we're going to do is going to be Metasploit
And what we're going to do here is we're actually going to get back into medical light
And make sure that you still have your key optrix Machine level 1 running
So I have it running we're going to explode it again and the exploit was trans to open
Football had just search that again
Day and remember that we're going to use the Linux version
Soyuz exploit Linux
Samba
Trans to open
Show options real quick
Okay we're going to set our our host to the IP
The address of the objects machine
And remember we also want to change the payload here because of the payload that were used in the
Original video wasn't working so we're going to do now onstage just so generic
Shell reverse here
Cash options again
So now it needs an alehouse what's that are all hosts
Okay so now we have the aisle Houston there one more time but show options
Hi unless exploit
Queso have a shell here
Okay but it brought us right to bash
So
When you're exploiting a
Linux machine like this you're really not going to be able to do many file transfers
We can still do
CW get here and we wanted to grab our file we could still do that
Okay so we'll say LS it's sitting in here
And we're sitting in temp right now
So this is how if we were using Metasploit we would do a file transfer on Linux
You're not really given the meterpreter shell unless you set up a meterpreter shell
I do want to show you one other way of doing this let's look at a Windows example because that's a really we're going to use it so
So with Linux like I said you have the W get probably 95% of a Time
So let's go ahead and do another exploit
But we're going to do what we did in our original lesson with doing Java applet attacks
Let's go ahead and just close out of everything here I'm going to exit
And make sure that you know that your windows machines running over here
And that we can still access it
I'm so
Make sure you know the IP address as well
And we're going to use the SE toolkit
Let's go ahead and do that again
Case of social engineering attacks
And website attack vectors
Java applet attack
We're going to use the site cloner here
We are using that
The IP address is going to be alright the address here
And no our payload is not different machine
So we're going to have it do its own built-in
And we're going to clone google.com
They're going to use the meterpreter
Payload
443 is fine
What type of reverse https is fine
Okay and it's going to take just a minute here it's going to run through it's going to open up Metasploit
So are we have Apache running so let's go ahead and stop it
Now it's going to launch its own web service and it's going to launch Metasploit
In shortly here we're going to go back to our weather dress like we did in the
Java app video and we should be able to get some sort of shell here
Case of a running on job zero in the background let's go ahead and try going to our web page
See if we get that malicious pop-up there it is
Coyote run will see what's happening on the other side of things
Do we have a meterpreter session we can just say sessions
Tose sessions one
Now if meterpreter shell here
And if we say help
We can kind of look through here
And we can actually start downloading or
Giving files to a machine
So here's a download option right there
And we're going to go ahead and do that
So we have download and we have upload
So let's try this
Superstar with upload first upload let's just do our
R-bar www HTML and we're going to give it to
Exploit PHP
Now we need a folder
So when you enter a folder in here
You going to want to make sure to use two slashes for syntax
Or else it's not going to take
So we could just try to jump in the sea folder let's see if that works
So access denied we might need to put it into the user folder
Let's go ahead and verify what that user is
So because we don't have root privileges we can't actually put into the sea folder here
So we're just call the IE user so let's try that
Okay and now he uploaded it let's go double-check that that actually happened
And there it is exploit. PHP
So
In Reverse say we wanted to grab this file exploit. PHP and bring it to us
We could say download seed colon slash slash
Remember to do to
And we're going to grab it from users IE users
By user I'm sorry exploit. PHP and then we can chew
We're going to put it
We'll just put it in the VAR www folder so don't overwrite let's try it
Well actually caught exploit. PHP there as well
And I messed up did you catch that so this won't work unless you have both of these just
Just like that
There you go
So now it should have moved it for us let's go ahead and open this folder
Go back one and there is exploit. PHP so we are successfully able to transfer those back
So if we recap here
We covered a CTP which we could use if we have some sort of web interface
So we actually have like a RDP or VNC into a machine and we want to just make it easy on RC
So we can use http
Winnetka have a lot of opportunities like that but it's nice if we're hosting a file and we just need to grab it
Another method is WG
I remember that that's common to Linux machines but not common to Windows machines
So for Windows machines are really going to need to use some sort of crafting material either FTP
I would just comment on most machines Windows 7 and up
Or tftp is XP in 2003 windows
Or else we could try Powershell
With
Either Windows 7 and up
Or we can try Metasploit
And
Attempt to use that to transfer files mainly with Windows machines we could also use it if we're using a meterpreter shell with Lynn
Next which I didn't show you
But
Humanely going to be concerned with transferring files on Linux machines
So unless you're trying to pull something off of it w gets going to be perfect on Linux
And that's really yet so there's a bunch of other methods here but we don't need to get into them because this is really the
The most common ones you're going to use
You'll see a couple more in the pwk oscp course
And all kind of teach you some more obscure ones that involve you know with XP
Or older versions of Linux
So really you're not going to need those for real world examples here
But do pay attention to those in the pwk course
Slatted for this lesson