File Transfer

After we have “built“ an exploit locally on our attacking machine, we still have to transfer it to the target system. Here, we will discover that in fact many roads lead to Rome, and we are going to show three example procedures:

1. The Swiss Army Knife netcat is once again the forerunner for file transfers. Here, we only have to read the input from our desired file on the client side and divert the output into a file on the server side. Using our attacker scenario, this would work as follows:

Attacker

nc -q0 ${target server} ${target port} < ${file}

Target system

nc -l -p ${local port} > ${file}

2. Aside from netcat, we could also use the secure shell protocol SSH, which requires us to have a user with ssh access for our target system. Indeed, we rarely run into this situation in practice, but we have nevertheless learned about the password usage of users. If the above condition applies, we can transfer a file to the target system via the secure copy protocol (scp):

 scp ${file} ${user}@${target system}:${filing location}

3. A more creative solution would be to launch a web server on our attacker machine, place the file in its DocumentRoot and access it from the target system, using wget or curl, for example.