Windows File Transfer Methods

HTB Content Academy
1

I finished the first two questions and am currently working on the optional question - trying out all the methods of Windows File Downloads. I am unable to get any of them to work except the PowerShell Base64 Encode & Decode - that one works fine. I am hoping that I can get some help on the others - one method at a time.
First: PowerShell DownloadFile Method - I put in this command:

PS C:\Users\htb-student> (New-Object Net.WebClient).DownloadFile(‘https://10.129.201.55/home/htb-ac-1222157/test.txt’,'C:\Users\htb-student\test.txt’)

I got the error message:

“The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.”

After some research, I determined that this was due to a self-signed certificate issue, and so I fixed that by just telling Windows to accept any and all certificates presented with this command:

PS C:\Users\htb-student> [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

That command was accepted and so I put in the original command to download the file, but now I get this error:

Exception calling “DownloadFile” with “2” argument(s): “The remote server returned an error: (404) Not Found.”

I have checked the path to the file on the pwnbox, and it is correct, so I don’t know why I am getting the 404 error. Any ideas?

1 Like
2

I only skimmed this section so far, but the question that comes to my mind is: How do you spin up the webserver on your file hosting machine (e.g. PwnBox)? Because the typical candidates like python -m http.server typically use neither HTTPS nor absolute paths. E.g. the aforementioned command expects the path to be relative to PWD.

When in doubt, whatever ad-hoc webserver you used should log an error for your request since it returned a 404 and thus is at least reachable.

3

Thank you Gordin! You pointed out my mistake. I had forgotten to use the path to my python simple webserver directory on my attack machine. Your reply fixed it! It now works fine.