{"id":7772,"date":"2021-05-02T13:53:11","date_gmt":"2021-05-02T13:53:11","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=7772"},"modified":"2021-05-02T13:54:47","modified_gmt":"2021-05-02T13:54:47","slug":"curo-bin","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2021\/05\/02\/curo-bin\/","title":{"rendered":"Cur\\o\/bin"},"content":{"rendered":"\n

This post wraps up another Twitter thread<\/a> I started a few days ago:<\/p>\n\n\n\n

If you ever get bored using “copy” to copy files you can always use \u2026 curl:<\/p>\n\n\n\n

curl file:\/\/c:\\test\\foo -o bar<\/pre>\n\n\n\n
Same way, you can use it instead of “type” or “cat”<\/p>\n\n\n\n
curl file:\/\/c:\\test\\foo<\/pre>\n\n\n\n
\"\"<\/a><\/figure><\/div>\n\n\n\n
You can also copy file by\u2026 uploading it locally<\/p>\n\n\n\n
curl -T bar file:\/\/c:\\test\\<\/pre>\n\n\n\n
this will copy “bar” file to “c:\\test\\bar”.<\/p>\n\n\n\n
And during copying, you can stat copying at a given offset:<\/p>\n\n\n\n
and even cooler, you can extract any part of the file using range<\/p>\n\n\n\n
curl file:\/\/c:\\test\\foo -C 1<\/pre>\n\n\n\n
dynamic payload building anyone?<\/p>\n\n\n\n
\"\"<\/a><\/figure><\/div>\n\n\n\n
and even cooler, you can extract any part of the file using range<\/p>\n\n\n\n
curl file:\/\/c:\\test\\foo -r2-10<\/pre>\n\n\n\n
\"\"<\/a><\/figure><\/div>\n\n\n\n
offering a chance to build dynamic payloads.<\/p>\n\n\n\n
The operation is surgical and using Procmon we can confirm it reads only these two specific bytes:<\/p>\n\n\n\n
\"\"<\/a><\/figure><\/div>\n\n\n\n
@nf3xn<\/a> added<\/a> one more interesting option:<\/p>\n\n\n\n
curl --remote-time file:\/\/c:\\test\\foo -o bar<\/pre>\n\n\n\n
to preserve file timestamps.<\/p>\n","protected":false},"excerpt":{"rendered":"
This post wraps up another Twitter thread I started a few days ago: If you ever get bored using “copy” to copy files you can always use \u2026 curl: curl file:\/\/c:\\test\\foo -o bar Same way, you can use it instead … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7772"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7772"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7772\/revisions"}],"predecessor-version":[{"id":7777,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7772\/revisions\/7777"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}