operations – Malware University

You may run into situations where you want to download a simple directory listing hosted via HTTP(S) from Powershell without needing any external tooling.

function Download-Dir {
    param(
        [string]$BaseUrl,
        [string]$LocalPath
    )

    # Create local folder
    if (-not (Test-Path $LocalPath)) {
        New-Item -ItemType Directory -Path $LocalPath | Out-Null
    }

    $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/notacrawler Firefox/144.0"

    # Fetch the directory listing from the target
    $html = curl.exe -s -A $ua $BaseUrl

    # Extract and follow the links (no backsies)
    $links = ($html -split "`n") | Select-String -Pattern 'href="([^"]+)"' | ForEach-Object {
        ($_ -replace '.*href="([^"]+)".*','$1')
    } | Where-Object {$_ -notmatch "^\.\./" -and $_ -notmatch "index.html"}

    foreach ($link in $links) {
        $url = $BaseUrl + $link
        $dest = Join-Path $LocalPath (Split-Path $link -Leaf)

        if ($link.EndsWith("/")) {
            # Recurse into subdirectory
            Download-Dir -BaseUrl $url -LocalPath $dest
        } else {
            # Download file
            Write-Host "Downloading $url ..."
            curl.exe -A $ua -o $dest $url
        }
    }
}

# Start the recursive download
Download-Dir -BaseUrl "https://your-backups.com/My%20Personal%20Folder/" -LocalPath ".\SuperSecretPayloads"

Tag: operations

Recursive File Directory Downloading on Windows