marcos.luna
62 lines
2.0 KiB
Markdown
62 lines
2.0 KiB
Markdown
# upload - Upload File to Target
|
|
|
|
Upload a file from the Mythic server to the target system.
|
|
|
|
## Description
|
|
|
|
The `upload` command uploads a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
upload <file_id> <destination_path>
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `file_id` (required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first.
|
|
- `destination_path` (required): Destination path where the file will be written. Supports both absolute and relative paths.
|
|
|
|
## Examples
|
|
|
|
```
|
|
upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe
|
|
upload xyz789 C:\Windows\Temp\stager.dll
|
|
upload file123 C:\temp\data.txt
|
|
```
|
|
|
|
## Features
|
|
|
|
- Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written
|
|
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
|
|
- Creates a 'File Write' artifact for tracking
|
|
- Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools
|
|
|
|
## Output
|
|
|
|
```
|
|
[upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes)
|
|
[upload] Chunk 1/4 written: 512000 bytes
|
|
[upload] Chunk 2/4 written: 512000 bytes
|
|
[upload] Chunk 3/4 written: 512000 bytes
|
|
[upload] Chunk 4/4 written: 512000 bytes
|
|
[upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- File writes are logged by EDR/XDR solutions
|
|
- Uploads to sensitive locations may trigger alerts
|
|
- Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored
|
|
- File write artifacts are automatically tracked
|
|
|
|
## Related
|
|
|
|
[File Uploads Support](../../../features.md#file-uploads-support)
|
|
|
|
---
|
|
|
|
**Command Category:** File System
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)
|