Individual skill
payloads-file-transfers
Move files on/off a target when there's no shared drive — upload tools (linpeas, nc, exploits), pull loot back, and do it through a pivot or when wget/curl are missing. Load when you need to get a file to or from an authorized host. Signals: "transfer a file", "upload linpeas", "no wget/curl", "get the file off the box", certutil/bitsadmin/impacket-smbserver, exfil over a tunnel.
skills/payloads/payloads-file-transfers/SKILL.md
Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 27
- Repository last updated
- Oct 14, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- ai-security Repository topic
- application-security Repository topic
- blue-team Repository topic
- bug-bounty Repository topic
- claude-code Repository topic
- codex Repository topic
- detection-engineering Repository topic
- gemini Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# File transfers
## When it applies
You have a shell and need to stage a tool onto the target, or pull data/loot back to your box, and
there's no shared filesystem. Pick the method by what the target has (Linux vs Windows, which
binaries exist) and whether you're reaching it directly or through a pivot. `$LHOST` is your box.
## Why it works
Almost every host can speak HTTP, SMB, or raw TCP with something already installed — a language
runtime, `certutil`, `bitsadmin`, `nc`, or `/dev/tcp`. You host the file on your side and pull it
with whatever the target has; for exfil you reverse the direction. Base64 copy-paste works even with
no network path at all.
## Method