wiki created

2025-11-06 12:23:49 +01:00
parent 6cd3511962
commit 2fe9fa8254
60 changed files with 5012 additions and 142 deletions
@@ -0,0 +1,61 @@
+# upload - Upload File to Target
+
+Upload a file from the Mythic server to the target system.
+
+## Description
+
+The `upload` command uploads a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written.
+
+## Syntax
+
+```
+upload <file_id> <destination_path>
+```
+
+## Parameters
+
+- `file_id` (required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first.
+- `destination_path` (required): Destination path where the file will be written. Supports both absolute and relative paths.
+
+## Examples
+
+```
+upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe
+upload xyz789 C:\Windows\Temp\stager.dll
+upload file123 C:\temp\data.txt
+```
+
+## Features
+
+- Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- Creates a 'File Write' artifact for tracking
+- Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools
+
+## Output
+
+```
+[upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes)
+[upload] Chunk 1/4 written: 512000 bytes
+[upload] Chunk 2/4 written: 512000 bytes
+[upload] Chunk 3/4 written: 512000 bytes
+[upload] Chunk 4/4 written: 512000 bytes
+[upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe
+```
+
+## OPSEC Considerations
+
+- File writes are logged by EDR/XDR solutions
+- Uploads to sensitive locations may trigger alerts
+- Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored
+- File write artifacts are automatically tracked
+
+## Related
+
+[File Uploads Support](../../../features.md#file-uploads-support)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)