[MUSIC PLAYING]
Welcome to the file transfer section of this course.
In this section, we will be exploring
the process of how to transfer files onto both Windows
and Linux targets.
In this video, we're going to be starting off
by exploring the process of how to set up a web
server with Python, right?
And the reason we're setting up a web server
is primarily to host the files that we
would like to transfer onto both our Windows and Linux target.
So before we actually get started,
let's get an understanding as to why file transfers are very,
very important or the process of transferring files
to a target system is very important during
post-exploitation, right?
So after obtaining initial access to or on a target
system, you will need to transfer files
to the target system.
This is something that you may not need to do in some cases.
But in most cases, you will need to transfer either
a script that you like to execute
or maybe a binary or an exploit, et cetera, right?
And you might be thinking to yourself, well,
we have already done this before.
We did it with Meterpreter, where
I downloaded and uploaded files to the target system
with one simple command.
Well, in some cases, you will not
have access to the target system via a Meterpreter session.
And as a result, you will need to utilize
the in-built operating system specific utilities
to facilitate the transfer of files
from your system or your penetration testing
distribution to the target system, right?
So let's say I gain access to a Windows target system,
and I gain access to the target system
and obtain a standard command shell session.
If I wanted to transfer the JAWS enumeration script,
for example, how would I do that if I don't have access
to Meterpreter?
Well, one option is I could generate an MSFvenom payload.
And then wait, I actually needed to transfer the MSFvenom
payload.
How do I do that?
So you can actually start to see why this is so important.
And it is actually a pivotal phase or rather
step in the post-exploitation phase as a whole.
And it's not just limited to privilege escalation
or anything like that.
It's very important that you understand
how to transfer a file from your system onto the target system
that you've just compromised irregardless of the target
operating system or the operating system
that's running on the target system.
So you never should rely on Meterpreter.
And as I said, if you utilize a manual
exploit that you get from the internet or from ExploitDB
and not a Metasploit framework exploit module, then again,
this is where this will come into play.
So this process utilizes a 2-step approach,
where you will, firstly, need to host the files that you want
to transfer on a web server.
And then secondly, you then need to download the files that
are hosted on the web server you have set up
onto the target system.
In this video, we're going to be dealing
with the first step, where we actually
need to set up the web server that's
going to host the files that we would like to transfer, right?
And we are doing this on the attacker
system or your penetration testing distribution.
So how can we set up a web server
to host the files that we would like to transfer?
Well, one option is to utilize a service or package like Apache
2 or nginx to host the files.
But there is a better time-efficient and
resource-efficient alternative to utilizing a proper web
server technology or stack, and that
is the Python module known as SimpleHTTPServer or HTTP
server, right?
So Python comes with a built-in module
known as SimpleHTTPServer, in the case of python2,
and http.server, in the case of python3,
that can be used to facilitate a simple HTTP server that
gives you the standard GET and HEAD request handlers.
This module can be used to host files
in any directory on your system and can
be implemented through a single command in your terminal.
So the only prerequisite is that you
need to have either python2 installed on your pen testing
distribution or python3, right?
And if you have any of those installed,
then you can easily launch or execute this module
and set up a simple HTTP web server
to host the files in any specific directory
that you want, which is fantastic
because if we utilized a package or service like Apache, then
we would need to transfer the files that we would like
to transfer onto the target system
into the default Apache directory.
However, with the Python module, we
don't need to transfer any files.
If we are working on the desktop,
we can set up or launch the HTTP server within our desktop,
and it will host the files that are
stored on our desktop, which is fantastic.
So that's what we're going to be exploring,
how to do in this video.
So this video has a lab environment attached to it.
And we're not going to be exploiting any system.
We're just going to be exploring the process of how to set up
a web server with Python.
And we'll be exploring it for both python2 and python3.
So all that you need to do is just
fire up the lab environment, and we can get started.
So I'll see you in a couple of seconds in the lab environment.
All right, so I'm back in the lab environment.
And you'll be provided with a target IP address.
But just disregard this as we're not going to be using it,
right?
So let's take a look at a few examples.
On your desktop, you'll have a folder called tools.
And if you open that up, this is just a collection of tools
that you typically utilize during a pen test.
So we can click on the scripts directory.
And you can see we have a few scripts here.
And all I'm trying to do is I'm trying
to identify a file that we would like to transfer onto a target
system or that we would like to host on our Python web server.
So I'm just going to open up my terminal here.
And given the fact that this is a Kali Linux instance,
I can actually list out the content of a directory under
or rather a set of files under /usr/share
and windows-binaries, right?
And let's say I wanted to transfer the following binary.
Let's say I wanted to transfer--
we can just use a simple example here.
Instead of saying windows-binaries,
and I say windows-resources, we should have the actual mimikatz
executable, right?
So let's say I wanted to transfer
the x64-bit version of the mimikatz executable,
so mimikatz.exe, right?
Well, what would I need to do?
Well I could set up the SimpleHTTPServer
within the following directory.
Alternatively, I could copy this executable into whatever
directory I'm comfortable with.
So instead of listing out, I can just say copy.
And at the end here, I can just say copy it
into our current directory, or I can say copy it into whatever
directory I want to copy to.
So in this case, I'll just copy it
to the root of the root user's home directory.
So just specify a full stop.
Hit Enter.
And now, if I list the contents of the root user's home
directory, you can see we have mimikatz.exe.
So let's say I wanted to host this particular executable,
and then download it onto a target system,
and in this case, a Windows target system.
So again, I can set up a simple or rather
a SimpleHTTPServer with Python.
So if you're using python2, then you can just say python,
and then you use the m option to essentially say
that you want to load a module, or you
want to use a specific module.
And in the case of python2, you can say SimpleHTTPServer,
and this is case-sensitive.
You then need to specify what port you
want to host the web server on.
Now remember, when I hit Enter, or when
I'm using the SimpleHTTPServer, it
is going to create a web server on the Kali Linux IP
or on your penetration testing distribution, right?
So I could host it on the default web server
port, which is port 80 or port 443 or even
another obscure port, right?
So I could say, for example, 1234.
As long as this port is currently not
being used by any other service on your Kali Linux system,
you can use it.
In this case, we will just say we want to host it on port 80.
So I'll hit Enter.
And you can see it's going to tell
you serving HTTP on your Kali Linux IP address on port 80.
So we can actually verify that this is working.
So I'll just open up a new tab here.
And I'll say ifconfig to get my Linux IP address.
Under ethernet 1, I'll just copy my IP.
And in your case, this is going to be different, but just
copy the value.
And if we open it up in our web browser--
I'll open up Firefox, and I'll paste the address there.
You can see that it is essentially
hosting all the files that are stored
within the home directory of the root user, which is fantastic.
And we can see the mimikatz executable here.
So on the target system, I can now
utilize the following address, or I can say,
for example, I want you to download the file
from the following web server, and I
want to download a file called mimikatz.exe.
This will make much more sense in the next video,
where we'll actually be transferring or taking
a look at how to transfer a file or download a file from a web
server onto a Windows system.
So that is how to do this with python2.
With python3, the process is essentially the same.
I'll just hit Control and C to terminate it.
However, before I do that, you can
see that the SimpleHTTPServer Python module will actually
show you all GET requests here.
So you can see a request was made.
This is a GET request.
And you can see in some cases or in this case,
it's saying that there is a 404 status code, which is fine.
And yeah.
So if I downloaded a file or if anyone else downloads a file
from the web server that I've set up,
I would essentially get the actual request
logged right over here.
So I'll just hit Control and C to terminate it.
And if I'm doing this with python3,
I can then say python3 module.
And the actual module name is different for python3.
It is http.server.
So not SimpleHTTPServer, it is http.server,
and then you specify the port.
So you can now say port 80, port 8080, et cetera, port 1234,
whatever port you want to host it on.
Hit Enter, and there we are.
So it's serving HTTP on the Kali Linux IP address on port 80.
And you can access it directly from the following URL.
So if we open up our browser, and we reload it again,
you can see it's still working irregardless
of the version of Python that you utilize.
So the reason why I am actually recommending
the process of setting up a web server
is primarily because it is really simple, especially
with the advent of Python modules like http.server
or SimpleHTTPServer.
And one of the great advantages is I can host any directory,
or I can host any files within any directory
that I want on my file system.
Another example is for example, if I
wanted to host the files within the tools directory, which
is on the desktop, I can just run the previous command.
So I can say python3 -m http.server server on port 80.
Hit Enter.
And now, if I reload the web server,
you can see that it gives me access
to all the directories and files within the tools directory.
So if I open up this directory here,
I can then download any of the files
within that particular folder.
So the Python module SimpleHTTPServer or HTTP server
in the context of python3 is extremely powerful.
So this is the first step of the file transfer process.
The next step is, of course, how we can download a specific file
on the target system once it has been hosted on a web server.
So that is going to conclude the practical demonstration
side of this video.
All right.
So now that we know how to set up a web server with Python
to host the files that we would like to transfer,
in the next video, we will be exploring
the process of how to transfer files onto a Windows target
system after you have compromised it
or gained access to it.
So I'll be seeing you in the next video.