用 Arch Linux 打造完美渗透环境

$ sudo nano /etc/pacman.conf # 编辑pacman.conf文件

[blackarch]
SigLevel = Optional TrustAll
Server = https://mirrors.ustc.edu.cn/blackarch/$repo/os/$arch

$ sudo pacman -Syyu

$ sudo pacman -S nmap

$ nmap <目标IP地址> # 简单的扫描

$ sudo nmap -O <目标IP地址> # 扫描目标的操作系统情况

$ sudo nmap -sP <目标IP地址> # ping扫描

$ sudo pacman -S xerosploit

$ sudo xerosploit

$ sudo pacman -S dnsutils

$ sudo pacman -S nbtscan

$ sudo nbtscan  -r  192.168.16.0/24

"Human-readable service names" (-h) option cannot be used without verbose (-v) option.
Usage:
nbtscan [-v] [-d] [-e] [-l] [-t timeout] [-b bandwidth] [-r] [-q] [-s separator] [-m retransmits] (-f filename)|(<scan_range>) 
	-v		verbose output. Print all names received
			from each host
	-d		dump packets. Print whole packet contents.
	-e		Format output in /etc/hosts format.
	-l		Format output in lmhosts format.
			Cannot be used with -v, -s or -h options.
	-t timeout	wait timeout milliseconds for response.
			Default 1000.
	-b bandwidth	Output throttling. Slow down output
			so that it uses no more that bandwidth bps.
			Useful on slow links, so that ougoing queries
			don't get dropped.
	-r		use local port 137 for scans. Win95 boxes
			respond to this only.
			You need to be root to use this option on Unix.
	-q		Suppress banners and error messages,
	-s separator	Script-friendly output. Don't print
			column and record headers, separate fields with separator.
	-h		Print human-readable names for services.
			Can only be used with -v option.
	-m retransmits	Number of retransmits. Default 0.
	-f filename	Take IP addresses to scan from file filename.
			-f - makes nbtscan take IP addresses from stdin.
	<scan_range>	what to scan. Can either be single IP
			like 192.168.1.1 or
			range of addresses in one of two forms: 
			xxx.xxx.xxx.xxx/xx or xxx.xxx.xxx.xxx-xxx.
Examples:
	nbtscan -r 192.168.1.0/24
		Scans the whole C-class network.
	nbtscan 192.168.1.25-137
		Scans a range from 192.168.1.25 to 192.168.1.137
	nbtscan -v -s : 192.168.1.0/24
		Scans C-class network. Prints results in script-friendly
		format using colon as field separator.
		Produces output like that:
		192.168.0.1:NT_SERVER:00U
		192.168.0.1:MY_DOMAIN:00G
		192.168.0.1:ADMINISTRATOR:03U
		192.168.0.2:OTHER_BOX:00U
		...
	nbtscan -f iplist
		Scans IP addresses specified in file iplist.

$ sudo pacman -S burpsuite

$ sudo pacman -S hydra

$ hydra -l <用户名> -P <密码字典.txt> -v -e ns -t <次数> <目标IP> ssh

$ sudo pacman -S crunch

'%' 插入数字

'@' 插入小写字母

',' 插入大写字母

'^' 插入符号

-b #按大小分割字典文件，比如后跟20mib

-c #密码个数（行数），比如8000

-d #限制出现相同元素的个数（至少出现元素个数），-d 3就不会出现aabbbb之类的情况

-e #定义停止生成密码 ，比如-e abcd：到abcd停止生成密码

-f #调用密码库文件，比如-f charset.lst mixalpha-numeric 意为调用密码库 charset.lst中的 mixalpha-numeric项目字符

-i #改变输出格式

-l #与-t搭配使用

-m #与-p搭配使用

-o #保存为

-p #定义密码元素

-q #读取字典

-r #定义从某一个地方重新开始

-s #第一个密码，从xxx开始

-t #定义输出格式

-z #打包压缩，格式支持 gzip, bzip2, lzma, 7z

$ crunch 1 8 >> 1.txt

$ crunch 1 4 abcd >> 2.txt

$ crunch 4 5 -p yale test

$ sudo pacman -S metasploit

$ sudo msfconsole

$ sudo pacman -S postgresql

$ sudo passwd postgres

$ sudo su - postgres -c "initdb --locale en_US.UTF-8 -E UTF8 -D '/var/lib/postgres/data'"

$ sudo systemctl start postgresql

$ sudo su postgres

$ psql

postgres=#

postgres=# CREATE USER msf4 WITH PASSWORD '123456';

postgres=# CREATE DATABASE msfdb OWNER msf4;

postgres=# GRANT ALL PRIVILEGES ON DATABASE msfdb TO msf4;

postgres=# \q

$ sudo useradd msf4

msf5> db_connect msf4:123456@127.0.0.1/msfdb

msf5 > db_status
[*] Connected to msf3. Connection type: postgresql. Connection name: DFz5oEX3.

msf5 > db_save

$ sudo systemctl enable postgresql

$ sudo pacman -S sqlmap

$ sudo pacman -S ettercap

$ sudo pacman -S ettercap-gtk

$ sudo ettercap -G

$ sudo pacman -S apache

$ sudo systemctl start httpd

$ sudo systemctl restart httpd