journals

spells

Access the Windows Registry using PowerShell

Add Windows users at the command line

Aircrack-NG

ARP scanning

ARP

AS-REP roasting with Impacket

AS-REP roasting With Rubeus

AS-REP roasting

Automate Netlify builds with IFTTT

Automatically stabilize a reverse shell with socat

Avoid dropping privileges with SUID Bash

awk

Backdoor Visual Basic Scripts

basenc

Bash reverse shell

Bash scripting

Bulk edit Windows permissions

Burp Suite

Bypass the PowerShell execution policy

Bypass Windows antivirus with C Sharp

Calculate a file hash on Windows with CertUtil

Call Mimikatz from a meterpreter shell

cat

cewl

Change a branch name in Git

Change an RSA key passphrase with OpenSSL

Cisco IOS

Common Windows user types

Compact VM disk images

Confirm the existence of a Gmail address

crackmapexec

Create a GPG key with SSH support

Create a zip bomb

CUPP

Day One to Obsidian conversion script

DCERPC

Debugging Bash scripts

Easy reverse DNS lookups

enum4linux

Enumerate AD CS templates with CertUtil

Equivalent Windows and UNIX commands

Evil-WinRM

Exploit LD_LIBRARY_PATH

Exploit LD_PRELOAD

Exploit local Windows services

Exploit local Windows tasks

Exploit remote Windows services

Exploit remote Windows tasks

Exploit the Bash PS4 prompt

Exploit the Windows DLL search order

Exploit the Windows FoDHelper

Exploit the WinLogon initialization sequence

Exploit VBA scripts with msfvenom

Exploit weak etc-passwd permissions

Exploit weak etc-shadow permissions

Exploit Windows file associations

Exploit Windows HTML applications with msfvenom

Exploit Windows services

Exploit Windows shortcut files

Exploit Windows tasks

Export highlights and annotations from Kobo eReaders

Extract the webpage title from a URL

ffmpeg

Find and replace a single line in a large text file

Find executables with SUID capabilities

find

findstr

finger

Fix EXIF data on Google Photos exports

Gemini compatible markdown

Get a shell from ViM

Get an SSL certificate

Golden and silver ticket attacks

IIS configuration data

Kerberoasting with Impacket

Kerberoasting with Rubeus

Load a shell with a simple executable

Local file inclusion attacks

Look up unicode symbols and emojis

MAC address

Magic numbers

man

Match files to packages in Debian-based operating systems

Match files to packages in Red Hat-based operating systems

Metasploit MS SQL modules

meterpreter

Mimikatz

MITRE ATTaCK emulation plans

PHP local file inclusion attacks

PHP

ping

Poison null byte attack

Poison null byte in PHP

Polkit

Pop a SYSTEM shell on the Windows login screen using sticky keys

Pop a SYSTEM shell on the Windows login screen using Utilman

POP3

Port scanning with Bash

POSIX process signals

Powercat

PowerShell reverse shell

PowerView

Pull SSL certificates from an external server

Python

Quick-n-dirty Python web server

Quickly bypass ssh-agent

Quickly find the canonical path of a file

RCE via XXE in PHP

Read a file beginning with a dash

reg

RegEx metacharacters

Remotely install a Windows package with PowerShell

Remove duplicate lines in Bash

Retrieve AIX fileset information

Retrieve AIX system information

Rubeus

Ruby

Run a remote Windows command using PowerShell

Run commands directly with PowerShell

RunAs

Send a command using OpenSSL

Set the PATH in a session on UNIX-like operating systems

Set the PATH in a session on Windows

Set up WMI in PowerShell

SQL injection attacks

Transfer files over FTP using netcat

UDP

unbuffer

Uniform resource locators

UNIX file descriptors

UNIX password hashes

UNIX permissions

Unquoted path handling in Windows

Upgrade PostgreSQL

Use a Raspberry Pi 4B as hacking accessory

Use an alternate SSH key with Git

Use Bash functions to backdoor executables

Use Burp Suite with Firefox

Use Burp Suite with mobile apps

Use curl and jq with web APIs

Use OpenSSL to encrypt and decrypt files

Use the Windows Firewall to relay ports

Use unsupported display resolutions with Samsung DeX

Use WinRM with PowerShell

Useful built-in commands for Linux reconnaissance

Useful built-in commands for Windows reconnaissance

Useful Linux reconnaissance scripts

Useful scripts for Windows reconnaissance

ViM

Visual Basic for Applications

wfuzz

whoami

Wi-Fi

Windows DLL search order

Windows event IDs

Windows event logs

Windows local service accounts

Windows logon scripts

Windows permissions

Windows reconnaissance with PowerShell

Windows Remote Management

Windows Run and RunOnce Registry keys

Windows Scripting Host

Windows SeBackup and SeRestore permissions

Windows SeImpersonate and SeAssignPrimaryToken permissions

Windows service ACLs

Windows services

Windows SeTakeOwnership permission

Windows Startup folder

Windows unattended installation data

winrs

Wireshark

wmic

Work with base64 encoding using PowerShell

Work with remote services using WMI and PowerShell

Work with remote tasks using WMI and PowerShell

Working with services in PowerShell

Cardboard Iguana Security

permalink: spells/ftp
tags:
  - Application/ftp
  - Protocol/FTP
  - Application/sudo
  - AttackCycle/PrivEsc

FTP

Commands

LIST - List contents of the supplied directory (or user's FTP root)
PASS - Specify the password for the account logging on
PASV - Switch to passive mode
QUIT - End the current session/connection
RETR - Retrieve the provided file
STAT - Provide connection/server information
SYST - Provide system "type" information
TYPE - Switch between ASCII (A) and binary (I) transfer modes
USER - Specify the username for the account logging on

There are a lot more obscure commands as well, though the above is sufficient for basic operations.

File transfers

Transfer files over FTP using netcat

permalink: spells/transfer-files-over-ftp-using-netcat
tags:
  - Application/netcat
  - Protocol/FTP
  - HowTo

Transfer files over FTP using netcat

Note that you cannot receive files using FTP with a single telnet/netcat session, as file transfers are conducted over a separate channel (either a channel originating from port 20 on the server for "active" mode or a random port above 1023 on the client for "passive" mode).

However, you can retrieve files using two sessions.

Switch to passive mode (PASV).
The FTP server will reply with a string of the form (o1,o2,o3,o4,p1,p2), where o1 - o4 are the four octets of the server's IP address and p1 - p2 are the high + low bytes of the port number to connect to.
Use (256 x p1) + p2 to determine the decimal port number. For example, if p1 = 117 and p2 = 85, then then port number you need to connect to is 30037.
Connect a second telnet/netcat client to the IP + port provided by the server.
Issue the appropriate file retrieval (RETR) command in the original telnet/netcat client. The file will be sent to the second client.

Which is a lot of work, but sometimes you just don't have an FTP client.

FTPS

permalink: spells/ftps
tags:
  - Protocol/FTPS

FTPS

FTPS (FTP over SSL) uses port 990 by default. Mostly supplanted by SFTP.

ftp binary shell escape

If the ftp binary can be run with NOPASSWD via sudo, then you can break out into a root shell using !/bin/sh.

FTP

Interactive graph

On this page

FTP

Commands

File transfers

FTPS

ftp binary shell escape