KevinLiebergen

Tools to check first

• file
• strings
• hexdump: Show the content of a binary
• objdump: Show the elements (structure) of a binary
• ltrace: Intercepts dynamic library calls
• strace: Intercepts any syscall

KevinLiebergen

Tips for writing a paper

1. e.g. is an abbreviation for exempli greti, it has a comma after.

There exist many malware types (e.g., ransomware, spyware, worm)

2. Same with i.e.

3. With three or more objects use a comma before and.

KevinLiebergen

while inotifywait -q -e modify --excludei './.git/' -r .; do make all_latexmk > /dev/null && python -c "print('#'*80)"; done

KevinLiebergen

cut -f 1,21 some.tsv | grep -E "([a-z]*\|[0-9]*[\^]?){3}" | \ 
awk -F '\t' '{print length(), $0 | "sort -rn"}' | cut -d ' ' -f 2 > new_staff.tsv

KevinLiebergen

Some ideas are based from S4vitar and takito.


$ tmux new -s <mysession-machine_name>

Rename current window:
$ Ctrl + b ,       : VPN
$ Ctrl + b ,       : Scanning
$ Ctrl + b ,       : Exploitation
$ Ctrl + b ,       : Escalation

KevinLiebergen

#!/bin/bash

ping -c 1 -W 1 1.1.1.1 || sudo systemctl restart NetworkManager.service

KevinLiebergen

>>> t = [25, "mayo", 19]
>>> type(t)
<class 'list'>
 
>>> t = (25, "mayo", 19)
>>> type(t)
<class 'tuple'>
 
>>> t = {25, "mayo", 19}
>>> type(t)

KevinLiebergen

ADVISORY: linpeas should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

Linux Privesc Checklist: https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
 LEGEND:
  RED/YELLOW: 99% a PE vector
  RED: You must take a look at it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) 
  LightMangeta: Your username

KevinLiebergen

unix-privesc-check v2.1 ( http://code.google.com/p/unix-privesc-check )

I: [file] Generating file cache...
I: [file] Cache generated...
I: [credentials] Starting at: Fri Sep 11 12:50:56 CEST 2020
W: [credentials] /snap/core18/1880/etc/pam.d/chpasswd is owned by user root (group root) and is world-readable (-rw-r--r--)
W: [credentials] /snap/core18/1880/etc/pam.d/passwd is owned by user root (group root) and is world-readable (-rw-r--r--)
W: [credentials] /snap/core18/1880/etc/passwd is owned by user root (group root) and is world-readable (-rw-r--r--)
W: [credentials] /snap/core18/1880/usr/bin/gpasswd is owned by user root (group root) and is world-readable (-rwsr-xr-x)
W: [credentials] /snap/core18/1880/usr/bin/passwd is owned by user root (group root) and is world-readable (-rwsr-xr-x)

KevinLiebergen

Crear diccionarios

CeWL:  Aplicación que rastrea una determinada URL a una profundidad especificada, siguiendo opcionalmente enlaces externos, y devuelve una lista de palabras que pueden ser usadas para crackers de contraseñas como John the Ripper.


Forense:

Ver tipo de archivo, para saber con qué herramienta abrirla o saber si esta cifrada
$ file archivo