Cheat Sheet - Linux Box Solving

Nmap Scan - TCP

sudo nmap $IP --open -sCV -A -oN $IP -vv -p- --min-rate=300

Nmap Scan - UDP

sudo nmap $IP -sU --top-ports=100 -vv

SNMP enumeration

snmpwalk -v2c -c public 10.129.24.223 NET-SNMP-EXTEND-MIB::nsExtendObjects

Fuzzing for Directories

ffuf -ic -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt:FUZZ -u http://192.168.101.111:5985/FUZZ

Fuzzing for VHOSTS

ffuf -ic -c -w /wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://dog.htb/ -H 'Host: FUZZ.dog.htb'

Fuzzing a BURP request

ffuf -ic -c -w /wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt:FUZZ -request request.req -request-proto http

IN BURP -> copy selected text to a file -> FILE_NAME.req

Recursive scan for Directories

ffuf -ic -c -w /wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt:FUZZ -u http://panda.htb/FUZZ -recursion -recursion-depth 1 -v

Reverse Shell - ( works on both linux and windows )

https://github.com/ivan-sincek/php-reverse-shell.git

404 pages cheatsheet -

https://0xdf.gitlab.io/cheatsheets/404#

Stable shell

python3 -c 'import pty; pty.spawn("/bin/bash")'

python2 shell spawn payload

__import__('os').system('bash')

python3 spawn shell

import os; os.execl("/bin/sh", "sh")

putty key to SSH key

puttygen root.pkk -O private-openssh -o id_rsa

SSH keygen

ssh-keygen -f key

port forwarding

socat TCP4-LISTEN:8080,fork TCP4:localhost:80

SUID Binaries

find / -type f -perm /4000 2>/dev/null

SUID Binaries for specific group

find / -group admin -ls -perm /4000 2>/dev/null

Custom Files & Directories under group

find / -group [GROUP_NAME] 2>/dev/null | grep -v '^/proc\|^/run\|^/sys'

put your group name in [GROUP_NAME]

Custom Files & Directories under user

find / -user [USER_NAME] 2>/dev/null | grep -v '^/proc\|^/run\|^/sys'

put your user name in [USER_NAME]

Downloading files using SCP

scp [email protected]:/home/lnorgaard/passcodes.kdbx .

Interesting files

# NIGNIX
cat /etc/nginx/sites-enabled/*
 
# Apache
cat /etc/apache2/sites-enabled/*

silver-xoxo