Windows File Transfer Methods

Download Operations:(to the compromised host)

Basee64 encoding/decoding:

attack-host$md5sum id_rsa # Check the hash in our machine.
attack-host$cat id_rsa |base64 -w 0;echo
<PRINTS OUT THE BASE64-encoded string>

>[IO.File]::WriteAllBytes("C:\Users\Public\id_rsa", [Convert]::FromBase64String("BASE64-encoded-file"))
> Get-FileHash C:\Users\Public\id_rsa -Algorithm md5

PowerShell Web Downloads

Work in progress.