# upload - Upload File to Target Upload a file from the Mythic server to the target system. ## Description The `upload` command uploads a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written. ## Syntax ``` upload ``` ## Parameters - `file_id` (required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first. - `destination_path` (required): Destination path where the file will be written. Supports both absolute and relative paths. ## Examples ``` upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe upload xyz789 C:\Windows\Temp\stager.dll upload file123 C:\temp\data.txt ``` ## Features - Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written - Supports both absolute and relative paths (relative paths are resolved using the current working directory) - Creates a 'File Write' artifact for tracking - Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools ## Output ``` [upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes) [upload] Chunk 1/4 written: 512000 bytes [upload] Chunk 2/4 written: 512000 bytes [upload] Chunk 3/4 written: 512000 bytes [upload] Chunk 4/4 written: 512000 bytes [upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe ``` ## OPSEC Considerations - File writes are logged by EDR/XDR solutions - Uploads to sensitive locations may trigger alerts - Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored - File write artifacts are automatically tracked ## Related [File Uploads Support](../../../features.md#file-uploads-support) --- **Command Category:** File System **Requires Admin:** No **MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)