📑
Security Notes
  • Readme
  • Resources
    • Useful sites
    • Metasploit
      • Searchsploit
      • Msfvenom
      • Meterpreter
    • Shells
    • Linux
      • Cron
      • Connection
      • Compilers
    • Windows
      • Kernel exploits table
    • Bruteforce
      • Checklist
      • John the Ripper
      • Hashcat
    • BOF
      • Assembly
    • Gaining access checklist
  • Cloud - AWS
    • Enumeration
    • References
    • Bucket S3
      • Public Bucket
      • AMI Files
      • File upload to RCE
    • EC2
      • cloud-init Exploits
      • SSRF To AWS Role compromise
      • Unencrypted EBS
    • IAM
      • Account Disclosure by resource policy
    • Lambda Function
      • Code Injection
      • Attacking APIs
    • VPC
      • Expose Resources
  • Networking
    • Nmap
      • Scan types
    • TCPDump
    • Port forwarding
    • Ports
      • 21 - FTP
      • 22 - SSH
      • 25 465 587 - SMTP
      • 53 - DNS
      • 110 995 - POP3
      • 111 - NFS
      • 113 - Ident
      • 123 - NTP
      • 135 137 139 - RPC
      • 143 993 - IMAP
      • 161 - SNMP
      • 389 - LDAP
      • 139 445 - SMB
      • 873 - Rsync
      • 6379 - Redis
      • 6667 - IRC
  • Linux PrivEsc
    • Checklist
    • Enumeration
      • Important files
      • Memory Dump
    • Privileges Exploitation
    • Wildcard Exploits
    • Sudo Exploits
    • Docker Container
    • Docker Groups
    • Common Exploits
  • Windows PrivEsc
    • Checklist
    • Enumeration
      • Important Files
    • Antivirus evasion tools
    • Unquoted paths
    • Always install elevated
    • Vulnerable services
    • Client side
    • Exploitable privileges
      • Juicy Potato
    • UAC bypass
    • Common Exploits
  • Active Directory
    • Introduction
    • Checklist
    • Enumeration
    • Enable RDP
    • Kerberos
    • Rubeus
    • Credentials harvesting
      • Domain Controller specific
    • Connection
    • Pass The Hash
    • Kerberoast
    • ASREProast
    • Tickets
  • Web Attacks
    • Checklist
    • Enumeration
      • URL bruteforcing
    • APIs and Fields
    • Authentication
    • Filter Evasion
      • Fuzzying and encoding
    • File Vulnerabilities
      • LFI List
      • PHP shells
    • RCE
    • Code Injection
    • Dependency Injection
    • Joomla
    • Wordpress
    • WebDAV
    • HTTP
    • XSS
      • DOM Based
      • Reflected
      • Filter Evasion
    • SSI
    • SSTI
    • RCE
    • CSRF
    • SQL injection
      • sqlmap
      • PostgreSQL
      • Oracle
      • MSSQL
      • MySQL
      • Login
    • XPath injection
    • XXE
    • CORS
  • MOBILE PENTESTING
    • Static Code Analysis
    • Dynamic Code Analysis
    • Network Traffic Analysis
Powered by GitBook
On this page
  • Administration
  • Users
  • Groups
  • Firewall
  • Directories and files
  • List subdirs
  • List files
  • Mounting
  • mount / unmount
  • Resolve "file is busy" unmount error
  • Permissions
  • Permission types
  • Check permissions
  • Alter permissions
  • Archives
  • Tar
  • Zip
  • Text
  • Extract
  • Base64
  • Hex
  • Useful Commands
  • Networking
  • Default TTL
  • Typical Ports
  1. Resources

Linux

Useful commands quick reference

Administration

Users

openssl passwd <password>
useradd -p "<password hash>" <username>

Add by editing /etc/passwd

echo "<username>:$(openssl passwd <password>):0:0:/root:/root:/bin/bash" >> /etc/passwd

Groups

id
groups
getent group

Add group

sudo groupadd <group name>

Assign user to group

usermod -a -G <group> <user>
usermod -g <group> <user>    #transfer user to group

usermod -a -G root <user>    #add to root
usermod -a -G rdp <user>     #add to rdp enabled group
usermod -a -G ftp <user>     #add to ftp enabled group

Firewall

iptables -L
iptables -S
iptables --flush

Directories and files

List subdirs

find . -type d 2>/dev/null
find / -type d -readable -exec ls -adl {} \; 2>/dev/null

List files

find . -type f -name "<name>" 2>/dev/null
find . -type f -name "*.conf" 2>/dev/null
find . -type f -name "*.txt"  2>/dev/null
find . -type f -mtime +<days> 2>/dev/null                   #files older than x days
find . -type f -name"<name>" -exec cat {} \; 2>/dev/null    #find and print file
ls -h  
ls -lah

Mounting

mount / unmount

mount    #list currently mounted resources
mount -t <type> <ip>:/<share path> <path to mount point>
umount <path to mount point>
umount -f <path>

Resolve "file is busy" unmount error

fuser <path to mount point>     #list all processes accessing the mount point
fuser -k <path to mount>        #kill all processes accessing the mount point

Permissions

Permission types

Octal
Decimal
Representation
Permission

000

0

---

No permission

001

1

--x

Execute

010

2

-w-

Write

011

3

-wx

Write+Execute

100

4

r--

Read

101

5

r--x

Read+Execute

110

6

rw-

Read+Write

111

7

rwx

Read+Write+Execute

Check permissions

ls -alh <file>

Alter permissions

chmod +<repr> <file> #add permission
chmod -<repr> <file> #drop permission
chmod <decimal for user,group,others i.e. 760> <file> #set all for users, r+w for owner group, none for others

chown <user> <file>            #change file owner
chown <user>:<group> <file>    #change file owner specifying user's group

Archives

Tar

--Add to archive--
tar -cf <archive>.tar <file1 file2... or dir/>
tar -uvf <archive>.tar <file to add>
--List files--
tar -tvf <archive>.tar
--Compress--
tar -czvf archive.tar.gz <dir>/
--Extract--
tar -xvf <archive>.tar -C <path to extract>
tar -xzvf <archive>.tar.gz -C <path to extract>

Zip

--Archive--
7z a -t<type>  <archive>.<type> <dir>
7z a -mhe=on -p<password> <archive>.7z <dir>
--Extract--
7z e <archive>.<type> -o <dir output>
--Extract full paths--
7z x <archive>.<7z,zip,gzip,bzip2,tar> -o <dir output>
gunzip <archive>.zip > <filename>.txt

Text

Extract

Between two delimiters (from pipe or specify filename)

sed -n '/<begin>/,<end>/{/<begin>/b;/<end>/b;p}'

Get string length

echo -n "<str>" | wc -c

Read content from .gz archive

zcat <.gz archive>

Base64

echo "<string>" | base64
echo -n "<base64 string>" | base64 -d
base64 -d <file> > <decoded file>

Hex

xxd -p <file> | tr -d '\n' > <hexfile>.hex
echo -n "<hex string>" | xxd -r -ps
cat <hexfile>.hex | xclip -selection clipboard

Useful Commands

su -c '<command>' <user>    
su - <user> -c '<command>'    #may ask for password
sudo -u <user> <cmd>          #simulate user login


find -type f -name "*.txt" -exec cat "{}" \;
find -type f -name "*.txt" -exec mv "{}" <dst> \;    #useful when mv throws errors
find -exec mv "{}" <dst> \;                          #move all files and folders from here

ls | wc -l    #count files in folder
wc -l <file>  #count the lines in file
wc -w <file>  #count the words in file

Networking

Default TTL

64

Typical Ports

22    SSH
111   RPC
123   NTP
2049  NFS
PreviousShellsNextCron

Last updated 2 years ago