Windows Download Methods
The Windows-native ways to pull a file when you have a shell on a Windows host: certutil, bitsadmin, PowerShell Invoke-WebRequest, WebClient, and the in-memory IEX cradle, with an honest look at how defenders see each one.
Tagged “Windows”
25 entries tagged “Windows”. Browse all tags
All entries
SMB File Transfer
Move files to and from a Windows target over SMB: stand up a share with impacket-smbserver, then pull, run, and push back with native copy / net use or smbclient. Quick reference with a modular cheat sheet and per-command breakdowns.
HTTP File Transfer
The HTTP file-transfer quick reference: serve a folder from your attacker box in one line, then pull files onto the target with wget, curl, certutil, PowerShell, or curl.exe. Flags, a modular cheat sheet, in-memory execution, upload-back with updog, checksum verification, and beating egress filters by serving on 80 or 443.
Getting Files onto a Target
The file-transfer quick reference: the serve-and-pull vs push-and-receive decision, a modular copy-paste cheat sheet, and a worked breakdown of every method. Serve a folder over HTTP, pull with wget or certutil, host an SMB share, move a file with netcat or socat, copy over scp, paste a base64 blob, and checksum both ends.
base64 File Transfer
The base64 file-transfer quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Encode a file to one pasteable line, decode it with a heredoc, move files with certutil or PowerShell on Windows, chunk a blob too long to paste, and checksum both ends to prove it arrived intact.
NetExec
A practical NetExec guide: install it, verify it, enumerate one protocol at a time, validate credentials without locking accounts, read the output honestly, and keep a cheat sheet you will actually reuse.
enum4linux-ng
The enum4linux-ng quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real SMB and RPC situation. List shares anonymously, enumerate users and groups, dump the password policy, RID-cycle when direct enum is blocked, add credentials for depth, and export clean JSON or YAML.
John the Ripper
The John the Ripper quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Identify a hash, convert a ZIP or SSH key with a *2john script, run wordlist and rule attacks, crack NT and sha512crypt, mask a known pattern, fork across CPU cores, and read the pot file honestly.
ldapsearch
The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
Metasploit
A practical Metasploit guide: install it, verify it, search modules, set options safely, validate findings with auxiliary checks, and keep a cheat sheet you will actually reuse.
msfvenom
A practical msfvenom guide: install it, verify it, pick a payload, set LHOST and LPORT, choose a format, generate controlled lab payloads, pair them with a handler, and keep a cheat sheet you will actually reuse.
PowerView
A practical PowerView guide for authorized AD labs: load the module, enumerate users, groups, ACLs, and trusts from a domain-joined host, read the output, and understand the defenses that watch it.
WinPEAS
A practical WinPEAS guide: get the Windows privilege-escalation enumerator onto a target, read its color-coded output, focus on the high-signal findings, and avoid drowning in noise.
Smbmap
The smbmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. List shares over a null session, read the READ/WRITE flags honestly, recurse a share, pull and push files, pass the hash, and run an authorized remote command.
PowerUp
A practical PowerUp guide: run the PowerSploit Windows privesc auditor, read its check output honestly, focus on the high-signal service and path findings, and keep it lab-safe.
Chisel
A practical Chisel guide: tunnel TCP and UDP over HTTP, build a reverse SOCKS pivot from a foothold, reach internal hosts, and keep the noise low in a lab.
BloodHound
A practical BloodHound guide: collect Active Directory graph data, ingest it, hunt attack paths to Domain Admin, and read the output without chasing dead ends.
Mimikatz
A practical Mimikatz guide for authorized AD labs: what it extracts, the core modules, how to read the output, and the defenses that stop it.
Evil-WinRM
A practical Evil-WinRM guide: get an interactive WinRM shell on Windows with a password, hash, or certificate, move files, load scripts, and stay inside scope.
Nmap
The Nmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Ping-sweep a subnet, scan all 65535 ports, fingerprint service versions, run safe NSE scripts, scan UDP, get past a blocked ping, and save output for your notes.
Hashcat
The Hashcat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pick the exact hash mode, run dictionary, rule, mask, and hybrid attacks, crack NTLM, sha512crypt, WPA, and Kerberoast hashes, read the status screen, and resume long jobs.
rpcclient
The rpcclient quick reference: connection flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Open a null session, enumerate users, groups, RIDs, and shares, read the password policy, map names to SIDs, RID-cycle, authenticate with an NT hash, and read NT_STATUS errors honestly.
Impacket
A practical Impacket guide: install it, verify it, pick the right script, handle credential and hash syntax cleanly, read protocol errors honestly, and keep a cheat sheet you will actually reuse.
smbclient
The smbclient quick reference: flags, a modular cheat sheet, and a worked breakdown of every real situation. List shares over a null session, browse a share interactively, pull one file or a whole tree, pass-the-hash, force an SMB dialect, grab a share as a tar, and debug a refused connection.
Responder
A practical Responder guide: install it, pick the right interface, start in analyze mode, capture lab name-resolution traffic safely, read the output honestly, and keep a cheat sheet you will actually reuse.