Shells and File Transfer with nimux

Overview

Many assessments need more than one-shot command execution. Operators may need to change directories, collect a scoped file, upload a benign test file, or transfer a directory of approved evidence. nimux includes shell-level file helpers across several execution modes and SMB file primitives for direct share operations.

The guiding rule is simple: move only what the engagement requires and keep evidence handling clean.

Shell helpers

Several nimux shells share the same local command shape:

help
exit
cd <path>
upload <local> [remote]
download <remote> [local]
upload-dir <local> [remote]
download-dir <remote> [local]
execute-assembly <local> [args...]

execute-assembly is supported in supported Windows remote shells such as WinRM, CIM, MMC, scheduled task, and helper-service modes. It is not supported over MSSQL xp_cmdshell.

WinRM shell

nimux winrm server01.corp.local -d corp.local -u operator -p '<password>' --shell

Typical shell workflow:

whoami
cd C:\Users\Public
upload ./marker.txt marker.txt
download C:\Users\Public\marker.txt ./marker-copy.txt
exit

WinRM is usually the easiest shell for authorized administrative validation.

Helper-service shell

nimux bin server01.corp.local -d corp.local -u Administrator -H <nt_hash> --shell

This shell is useful when reliable console output is needed and helper deployment is approved.

hostname
upload-dir ./configs C:\Windows\Temp\configs
download-dir C:\Windows\Temp\results ./results
exit

CIM, scheduled task, and DCOM shells

nimux cim server01.corp.local -d corp.local -u Administrator -p '<password>' --shell

nimux task server01.corp.local -d corp.local -u Administrator -p '<password>' --shell

nimux mmc server01.corp.local -d corp.local -u Administrator -p '<password>' --shell

Use these when WinRM is unavailable or when the assessment is specifically validating those management paths.

SMB direct file operations

For share-level movement, use the SMB file commands. These do not require opening an interactive shell.

List a directory:

nimux ls fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Shared \
  --remote Reports

Upload a file:

nimux put fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Shared \
  --local ./marker.txt \
  --remote Reports\marker.txt

Download a file:

nimux get fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Shared \
  --remote Reports\marker.txt \
  --local ./marker-copy.txt

Create a directory:

nimux mkdir fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Shared \
  --remote Reports\nimux-validation

Remove an approved test file:

nimux rm fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Shared \
  --remote Reports\marker.txt

Kerberos file workflows

For Kerberos-backed share access, keep the cache explicit:

nimux ls fileserver01.corp.local -d corp.local -k \
  --ccache operator-cifs.ccache \
  --share Shared

Make sure the cache contains the right service ticket for the hostname used in the command.

Evidence handling

File transfer findings should document:

• Source host.
• Destination host.
• Share or remote path.
• Local evidence path.
• Account context.
• Reason for transfer.
• Cleanup result.

Avoid pulling whole directories when a single scoped file proves the point.