Clipboard-Only File Transfer (xxd Hex-Dump Method)

When every conventional channel is closed — SCP/SFTP blocked, no writable share, no outbound HTTP, a multi-hop SSH chain through bastions you don’t control, or a heavily locked-down RDP/VNC session — a file can still cross the boundary through the clipboard itself, so long as both ends can display ASCII text and run a hex tool. The trick: hex-encode the file on the source, copy the text, paste it on the destination, and un-encode. Slow and manual, but it works where nothing else does — a genuine last-resort exfiltration/infiltration primitive (MITRE T1020 / T1105 territory).

The xxd method

xxd ships with Vim and is present on most Linux systems; its -plain (postscript) mode emits a continuous hex stream with no offsets or ASCII column — ideal for copy-paste:

1. Source: dump the file as plain hex

   xxd -plain $FILE > $HEXDUMP

2. Copy the hex text. If the clipboard buffer or terminal can’t swallow it whole, work a chunk at a time — hex splits cleanly at any byte boundary (any even character count).

3. Destination: paste into an intermediate file. A text editor works; so does cat in append mode — paste, ensure the final chunk ends in a newline, then Ctrl+C (or Ctrl+D) to close:

   cat - >> $INTERMEDIATE_FILE

4. Destination: reverse the dump back into the original bytes

   xxd -revert -plain $INTERMEDIATE_FILE > $FILE

Verify integrity with sha256sum on both ends when the file matters — clipboard managers have been known to mangle very large pastes, normalize whitespace, or choke on size limits (often a few MB).

Variants and considerations

• Base64 instead of hex: base64 $FILE / base64 -d is ~33% expansion versus hex’s 100%, and base64 paste is equally clipboard-safe — usually the better choice; xxd wins mainly when only Vim’s toolchain is guaranteed
• Windows destinations: certutil -decodehex / certutil -decode replace xxd/base64 on locked-down Windows boxes; PowerShell [Convert]::FromBase64String() works too
• Integrity: chunk-level checksums (split + per-chunk hashes) make multi-paste transfers recoverable when one chunk corrupts
• Detection angle: clipboard-redirection channels (RDP rdpclip, VNC, terminal paste) are a real exfil path — hardened jump-host and VDI policies disable clipboard sharing for exactly this reason; large paste events into cat/editors are host-telemetry-visible if terminal logging exists

Sources

• xxd(1) man page — make a hexdump or do the reverse
• MITRE ATT&CK T1105 — Ingress Tool Transfer
• MITRE ATT&CK T1020 — Automated Exfiltration

Related: netcat, powercat, aws-ssm-ssh