This document provides instructions for various tasks related to networking and system administration on Linux systems, including: 1) Configuring network interfaces using dhclient or manually assigning an IP address and route. 2) Installing and configuring OpenSSH for remote access and using SSH, SCP for secure file transfers. 3) Using common Linux commands like tcpdump, tshark, ps, kill, service to monitor network traffic, view processes, kill processes, and control services. 4) Additional instructions are provided for using shell commands like head, tail, awk, sed, grep to view logs and parse output from other commands. Guidance is given for capturing network traffic to PCAP files using tcp

2. GET THE ROOT

3. GET THE ROOT

4. TRY
root@vm :# dhclient eth0
• dhclient, provides a means for configuring one or more network interfaces using the
Dynamic Host Configuration Protocol
ANOTHER WAY
root@vm :# ip a add dev <interface> <cidr>
• <interface> – interface currently connected to the network, usually eth0
• <cidr> – IP address and mask in a CIDR form, e.g. 10.13.203.77/24
root@vm :# ip r add <subnet> via <gateway>
• <subnet> – subnet address in CIDR form, e.g. 10.13.0.0/16
• <gateway> – gateway that will be used to access that subnet, e.g. 192.168.203.1

5. SCRIPT EXAMPLE
root@vm :# ./network.sh eth0 77
• Example of script that can be used on classic CTF trainings
• Download link https://transfer.sh/3Irqv/network.sh

6. SSH
root@vm :# apt-get install openssh-server
• Install SHH server if it was not installed
• SSH is a cryptographic(encrypted) network protocol to allow remote login and other
network services to operate securely over an insecure network.
root@vm :# vim /etc/ssh/sshd_config
• Permit root login
any_user@any_shell :$ ssh root@10.13.203.77
• User it!

7. SCP
• Secure copy or SCP is a means of securely transferring computer files between a local
host and a remote host or between two remote hosts. It is based on the Secure
Shell (SSH) protocol.
user@shell :$ scp some_file user2@any_host:/some/path
• Usage

8. OR JUST

9. SHELL
• find - search for files which names matches the <pattern> in a directory
hierarchy starting from <directory>
user@shell :$ find /var/log -name *apache*
Looking for something
user@shell :$ find <directory> -name <pattern>
• grep searches the named input <file>s (or standard input if no files are
named) match to the given <pattern>. By default, grep prints the matching
lines.
user@shell :$ dmesg | grep error
user@shell :$ grep <pattern> <file>
> I need a file
> I need file’s content

10. SHELL
• ss is used to dump socket statistics. It allows showing information similar to
netstat. It can display more TCP and state informations than other tools.
user@shell :$ ss –nlp | grep 31337
Collecting system information
user@shell :$ ss
• ps displays information about a selection of the active processes.
user@shell :$ ps aux | grep python
user@shell :$ ps
> I need open sockets
> I need running processes

11. SHELL
Collecting system information
user@shell :$ glances
> I need MOAR information
• glances is a free (LGPL) cross-platform curses-based monitoring tool which
aims to present a maximum of information in a minimum of space, ideally to fit
in a classical 80x24 terminal or higher to have additionnal information. Glances
can adapt dynamically the displayed information depending on the terminal
size. It can also work in a client/server mode for remote monitoring.

13. SHELL
• head - output the first part of files
 -c K: print the first K bytes of each file
 -n K: print the first K lines of each file
• tail - output the last part of files
 same as head
root@shell :# tail /var/log/auth.log -n 11 | grep yalegko
Parsing output.
user@shell :$ head [options] <file>
> I want only part of file or output
user@shell :$ tail[options] <file>
user@shell :$ ps aux | head -n 2

14. SHELL
• awk - pattern scanning and processing language
 print $n – prints n-th column of input
Parsing output.
user@shell :$ awk ‘{<commands>}’
> I want only some fields
user@shell :$ ps aux | grep rude_server | awk ‘{ print $2 }’
• sed - stream editor for filtering and transforming text
 s/old_word/new_word/ - substitute old_word to new_word
user@shell :$ sed [options] <script>
> I want to change something in input
user@shell :$ ps aux | grep yalegko | sed 's/yalegko/guest/'

15. SHELL
• kill - send a signal to a process
user@shell :$ kill –s TERM 25880
Restart that damn service!
user@shell :$ kill [options] <pid>
• service runs a System V init script or upstart job.
root@shell :# service nginx restart
root@shell :# service <service_name> [command]
> I want to kill existing process
> I want to stop/restart service

16. SHELL
More information can be found in man
user@shell :$ man <command>

17. NETWORKS
• -i eth0 : Listen on the eth0 interface.
• -q : Be less verbose (more quiet) with your output.
• -s : Define the snaplength (size) of the capture in bytes. Use -s0 to get
everything, unless you are intentionally capturing less.
• -w <capture_file> : Save the result to file
• -С <size> : Only <size> mbytes in one capture
• -G <nseconds> : New file name every <n_seconds> (use %H for hour, %M
for minute and so on)
• dst port 389 : capture only on specified port
• tcp and not dst port 22: another expression example
I need some pcaping!
user@shell :$ tcpdump [options] [expression]
root@shell :# tcpdump -i eth0 -s0 -C 10 -w ‘trace_p31337_’ port 31337
root@shell :# tcpdump -i eth0 -s0 -G 60 -w "trace_%H:%M:%S.pcap" port 3000

18. NETWORKS
• -i eth0 : Listen on the eth0 interface.
• -f : Set capture filter (WireShark syntax!)
• -w <capture_file> : Save the result to file
• -b <capture ring buffer option> :
 duration:value - switch to the next file after value seconds have elapsed,
even if the current file is not completely filled up.
 filesize:value - switch to the next file after it reaches a size of value kB.
I need some pcaping!
user@shell :$ tshark [options]
root@shell :# tshark- i eth0 -w ‘trace_p31337_’ -f ‘dst port eq 31337’ -b filesize:1000
root@shell :# tshark -i wlan0 -Y 'http.request.method == POST and tcp contains
"password"' | grep password

19. FUTURE READING
• OpenSSH
• Glances
• A tcpdump Primer with Examples
• How to Use Wireshark to Capture, Filter and Inspect
Packets
• The Basics of Using the Sed Stream Editor to
Manipulate Text in Linux

20. yalegko@sibears :$ echo “Thanx”