Downloading the .AES code from a Cisco WLC 2504 - possible?

I'm not specifically familiar with Cisco WLCs, however on Cisco switches, firewalls and routers, the OS image is located in flash.  At CLI, try:

dir disk0:

or

dir flash:

See if the image is there on one of your working 7.6 WLCs.  If so, then try tftp or ftp to get that file.

I meant to try this today and got onto something else. Many there's copy flash: tftp: or copy flash: sftp: command on there. ??

Trying to sftp to the WLC from my desktop with WinSCP was a no-go.

There appears to be a transfer command. The closest thing to a show flash is:

(Cisco Controller) >test   system dir /mnt            
drwxrwxrwt    5 root     root          100 Apr  4 17:50 ap_bundle
drwxr-xr-x    9 root     root         4096 Apr  4 17:51 application
drwxr-xr-x    2 root     root         4096 Apr  3 01:06 bootsys
drwxr-xr-x    2 root     root            0 Apr  4 17:50 core
drwxr-xr-x    2 root     root            0 Jan  1  1970 download
drwxr-xr-x    5 root     root         4096 Apr  4 17:47 images

But going into each of those directories I don't see any .AES file. Any other idea where it m ight be hiding?

I found the directory but it looks like the file on the WLC is stored in several files. I recall that when upgrading the WLC that there was an unpacking process. Looks like this is the result of that operation...

(Cisco Controller) >test   system dir /mnt/images/ap.pri  
-rwxr-xr-x    1 root     root     13629440 Apr  4 17:46 ap1g1
-rwxr-xr-x    1 root     root           40 Apr  4 17:46 ap1g1.md5
-rwxr-xr-x    1 root     root     27043840 Apr  4 17:47 ap1g4
-rwxr-xr-x    1 root     root           40 Apr  4 17:47 ap1g4.md5
-rwxr-xr-x    1 root     root     23398400 Apr  4 17:47 ap1g5
-rwxr-xr-x    1 root     root           40 Apr  4 17:47 ap1g5.md5
-rwxr-xr-x    1 root     root     10393600 Apr  4 17:46 ap3g1
-rwxr-xr-x    1 root     root           40 Apr  4 17:46 ap3g1.md5
-rwxr-xr-x    1 root     root     15728640 Apr  4 17:46 ap3g2
-rwxr-xr-x    1 root     root           40 Apr  4 17:46 ap3g2.md5
-rwxr-xr-x    1 root     root     41134080 Apr  4 17:46 ap3g3
-rwxr-xr-x    1 root     root           40 Apr  4 17:46 ap3g3.md5
drwxr-xr-x    2 root     root         4096 Apr  4 17:47 avc
-rwxr-xr-x    1 root     root     14694400 Apr  4 17:46 c3700
-rwxr-xr-x    1 root     root           40 Apr  4 17:46 c3700.md5
-rwxr-xr-x    1 root     root          683 Apr  4 17:47 supported_ap.info
-rwxr-xr-x    1 root     root          244 Apr  4 17:46 version.info

Once you've SSH'd in there, go to an enable prompt and then try the dir command.  It should be in the root of the flash: or disk: object.

Hmmm - so this is what I see when I try to enable..

(Cisco Controller)
User: admin
Password:************

(Cisco Controller) >en

Incorrect usage.  Use the '?' or <TAB> key to list commands.

(Cisco Controller) >?
               
clear          Clear selected configuration elements.
config         Configure switch options and settings.
cping          Send capwap echo packets to a specified mobility peer IP address.
debug          Manages system debug options.
eping          Send Ethernet-over-IP echo packets to a specified mobility peer IP address.
grep           Print lines matching a pattern.
help           Help
license        Manage Software License
linktest       Perform a link test to a specified MAC address.
logout         Exit this session. Any unsaved changes are lost.
mping          Send Mobility echo packets to a specified mobility peer IP address.
ping           Send ICMP echo packets to a specified IP address.
reset          Reboot (hard reload) options.
save           Save switch configurations.
show           Display switch options and settings.
test           Test trigger commands
transfer       Transfer a file to or from the switch.
               
(Cisco Controller) >

Thanks much