Linux

Basic commands

System Management

Print Info about the system

uname -a 

Print Environment

env

Shows details about all block devices

lsblk -f

List PCI devices

lspci

Display Disk Usage

df -h

Show the size of files and directories in the current directory

du -sh *

Shows the 10 largest directories on the system

sudo du -hsx /* | sort -rh | head -n 10

Display RAM info

free -h

Displays the maximum allowed size of a process's lockable memory

ulimit -l

Display overall system performance stats

vmstat

Print stats every 5 seconds

vmstat 5

Print stats every 5 seconds for 10 iterations

vmstat 5 10

Show the system uptime

uptime

File & Directory Management

List all files + details

ls -al

List all files recursively

ls -lAR

Read raw binary data

cat example | hexdump -C

Count number of lines in a file

wc -l myfile.txt

Print full path

realpath file.txt

Copy recursively

cp -r dir/ /home/user/

Find all .txt files

find /home/user -name "*.txt"

Find files larger than 10MB

find / -type f -size +10M

Search with regex

sudo find / -regex ".*alacritty.*" 2>/dev/null

Update locate db

sudo updatedb

Look file from the database

locate file.txt

Full path of a binary

which binary

Delete recursively

rm -rf <dir>

Process Management

List process

ps -ef | grep process

Processes by Trees

ps -auxwf

User process tree + PID

pstree -p user

Current process ID

echo $$

Background process

bg

List background process

jobs

Foreground process

fg

Users/Groups

Edit sudoers file

sudo visudo

Users

Creates a new user

sudo useradd newuser

Creates a new user with home directory and bash shell

sudo useradd -m -s /bin/bash newuser

Add user to the sudo group

sudo usermod -aG sudo newuser

Set or change password

sudo passwd newuser

Set zsh as default shell

sudo usermod --shell /usr/bin/zsh alice

Groups

Create group

sudo groupadd newgroup

Delete Group

sudo groupdel group

Add user to group

sudo gpasswd -a newuser newgroup

File Ownership

Set file permissions to rwxr-xr-x

sudo chmod 755 file.txt

Read permissions for all users

sudo chmod a+r shell.sh

Add execution permission

sudo chmod +x script.sh

Change file owner and group

sudo chown user:group file.txt

Change group ownership

sudo chgrp group file.txt

Logs

Current login user

w

Display login records

last

Display bad login attempts

lastb

Kernel and boot messages

dmesg

journalctl

Shows logs live

journalctl -f 

Logs from the current boot

journalctl -b

Logs from the previous boot

journalctl -b -1

Logs from a specific service

journalctl -u <service>

Logs for a specific process

journalctl _PID=<pid>

Shows logs from the kernel

journalctl -k

Logs by time-frame

journalctl --since "2024-11-01" --until "2024-11-10"

Priority Levels

journalctl -p <level>

• 0 --> emergency

• 1 --> alert

• 2 --> critical

• 3 --> error

• 4 --> warning

• 5--> notice

• 6 --> informational

• 7 --> debug

Security

Prevent world-writable files

umask 022

Display SELinux mode

getenforce

Disable SELinux

sudo setenforce 0

Access Control Lists

Show the ACL

getfacl file.txt

Grant read/write permissions to 'user' on file.txt

setfacl -m u:user:rw file.txt

tripwire

Initialize the Tripwire database

sudo tripwire --init

Check the integrity of the system

sudo tripwire --check

Generate a report

sudo tripwire --update

Networking

Ping and TCPdump Network Analysis for RCE Detection

• Simply ping your own host, you can use the command directly or as a payload for a script:

ping -c 1 10.10.14.6

• And catch it with tcpdump:

sudo tcpdump -ni <interface> icmp

Enumeration

Show accessible via VPN

netstat -rn

Show listening TCP/UDP ports

netstat -tuln

Listening ports & services

ss -tuln

Listening ports + PID

ss -tulnp | grep PID

Trace the network path

traceroute example.com

Change a route's metric

sudo route change -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.254 metric 200

ip

Bring interface up

sudo ip link set eth0 up

Display the Routing Table

ip route show

Add a route

sudo ip route add 192.168.2.0/24 via 192.168.1.254

Delete a Route

sudo ip route del 192.168.2.0/24

Add a Default Gateway

sudo ip route add default via 192.168.1.1

Chroot

Decrypt the system

Decrypt partition

sudo cryptsetup luksOpen /dev/sda3 cryptdisk

Mounts the decrypted device

sudo mount /dev/mapper/cryptdisk /mnt

Mounts the boot partion

sudo mount /dev/sda1 /mnt/boot

chroot into a mounted partition

sudo arch-chroot /mnt

Connect using WPA

Shows connection status

wpa_cli status

Creates the passphrase

sudo wpa_passphrase "MyWiFi" "mypassword123" | sudo tee /etc/wpa_supplicant/wpa_supplicant.conf

Connect using passphrase

sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf

Boot/UEFI Management

Displays the current boot entries in the UEFI firmware

efibootmgr

deletes the boot entry "0"

sudo efibootmgr --delete-bootnum --bootnum 0

base64

Generate MD5 hash

md5sum <file>

Generates a SHA256 hash

sha256sum file.txt

Encoding

Encode File + Redirect Output

base64 file.txt > hash.txt

Encode String + Redirect Output

echo "your_string_here" | base64 > encoded_file.txt

• In Base64 encoding, by default, some implementations add line breaks every 76 characters (following the RFC 2045 standard).

Encode File Without line break

base64 -w 0 <file>

Encode String without line breaks

echo -n "your_string_here" | base64 -w 0

---

Safe URL encoding

base64 -w 0 <file> | tr '+/' '-_' > url_safe_encoded.txt

Decoding

Decode String + Output to a file

echo <string> | base64 -d > <file>

Decode File + Output to a file

base64 -d -i <file> > <decoded_file>

Decode File without line breaks

base64 -d -w 0 file.txt > decoded_output.bin