Operator On The Wire
Join
← Back to Knowledge Base
RED TEAM / FILE TRANSFERS

File Transfer Matrix

MethodWindowsLinuxDownloadUploadNetwork Needed?Notes
Base64 + certutil✔—✔✔*NoClipboard-only; encode/decode
Base64 (Linux)—✔✔✔NoOffline text transfer
certutil -verifyctl✔—✔❌YesModern + reliable download
certutil -urlcache✔—✔❌YesLegacy; sometimes blocked
bitsadmin✔—✔❌YesDownload only
Invoke-WebRequest✔—✔✔YesFull HTTP client
IEX DownloadString✔—In-Mem❌YesIn-memory execution
wget✔*✔✔✔YesDefault on Linux
curl✔✔✔✔YesUniversal HTTP
python urllib✔✔✔❌YesRequires Python
PHP download✔✔✔❌YesRequires PHP
Ruby Net::HTTP✔✔✔❌YesRequires Ruby
/dev/tcp—✔✔❌YesRaw TCP
python http.server✔✔Server✔YesSimple download server
php -S✔✔Server✔YesPHP HTTP server
ruby httpd✔✔Server✔YesRuby server
uploadserver (HTTPS)✔✔❌✔YesEasiest upload path
curl -X POST upload✔✔❌✔YesWorks with uploadserver
SMB (impacket)✔✔✔✔YesFast file moves
net use \\share✔—✔✔YesWindows SMB
nc / ncat✔✔✔✔YesRaw TCP
FTP server✔✔✔✔YesSimple; built-in Windows FTP client
RDP Clipboard✔—✔✔OptionalClipboard channel
RDP Drive Share✔—✔✔Optional\\tsclient\share

Best for high-restriction environments (no network):

  • Base64 + certutil
  • Base64 (Linux)

Best for pure Windows workflow:

  • Invoke-WebRequest (download + upload)
  • IEX DownloadString (in-memory)
  • Certutil -verifyctl (download)
  • SMB (fast & simple)
  • Bitsadmin (download-only)

Best universal cross-platform downloaders:

  • curl
  • wget
  • python urllib

Best direct peer-to-peer transfer:

  • Netcat / Ncat
  • SMB copy
  • FTP (put/get)

Best for uploading FROM target → attacker:

  • curl -X POST + uploadserver
  • FTP put
  • SMB writable share
  • RDP share
  • Netcat

Best when everything is locked down but clipboard works:

  • certutil Base64
  • Linux base64