18:54:03authroot·password
18:54:03cmd/root$mount | head -5
18:54:03cmd/root$ls /var/log 2>/dev/null | wc -l
18:54:03cmd/root$ps aux | head -15
18:54:03cmd/root$crontab -l 2>/dev/null | head -5
18:54:03cmd/root$cat /etc/issue 2>/dev/null
18:54:03cmd/root$df -h / 2>/dev/null | tail -1
18:54:03cmd/root$grep MemTotal /proc/meminfo 2>/dev/null
18:54:03cmd/root$hostname
18:54:03cmd/root$netstat -tulpn | head -10
18:54:03cmd/root$history | tail -5
18:54:03cmd/root$ls /opt 2>/dev/null
18:54:04cmd/root$grep 'model name' /proc/cpuinfo 2>/dev/null | head -1
18:54:04cmd/root$cat /proc/version 2>/dev/null
18:54:04cmd/root$env | head -10
18:54:04cmd/root$ls /dev | wc -l
18:54:04cmd/root$uname -a
18:54:04cmd/root$last -n 3 2>/dev/null | head -3
18:54:04cmd/root$cat /etc/os-release 2>/dev/null | head -6
18:54:04cmd/root$ls -la /
18:54:04cmd/root$netstat -tulpn 2>/dev/null | grep LISTEN | head -20
18:54:05cmd/root$nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null
18:54:05cmd/root$ls -la /etc/network/interfaces /etc/sysconfig/network-scripts/ /etc/netplan/ 2>/dev/null | head -5
18:54:06cmd/root$ip addr show 2>/dev/null | grep -E '^[0-9]+:' | head -5
18:54:06cmd/root$ip route show 2>/dev/null | head -3
18:54:07cmd/root$echo 'test' > /tmp/test_1772736846
18:54:07cmd/root$rm -f /tmp/test_1772736846
18:54:08cmd/root$cat /etc/passwd 2>/dev/null | head -1
18:54:08cmd/root$cat /etc/shadow 2>/dev/null | head -1
18:54:09cmd/root$cat /proc/version 2>/dev/null | head -1
18:54:10cmd/root$echo 'testpipe' | grep 'testpipe' | wc -c
18:54:11cmd/root$cat /proc/cpuinfo | grep 'model name' | head -1
18:54:11cmd/root$which apt
18:54:12cmd/root$which yum
18:54:12cmd/root$which pacman
18:54:13cmd/root$which zypper
18:54:13cmd/root$systemctl list-units --type=service --state=running 2>/dev/null | head -10
18:54:13cmd/root$time dd if=/dev/zero of=/tmp/testio bs=1M count=10 2>&1
18:54:14cmd/root$rm -f /tmp/testio
18:54:14cmd/root$ss -tuln 2>/dev/null | wc -l
18:54:15cmd/root$cat /etc/passwd 2>/dev/null
18:54:15cmd/root$awk -F: '$3>=1000 && $7 !~ /nologin|false/ {print $1}' /etc/passwd 2>/dev/null | wc -l
18:54:16cmd/root$wget -q --timeout=3 -O /dev/null http://192.0.2.1/nonexistent 2>&1 | head -1
18:54:16cmd/root$test -d /opt/cowrie 2>/dev/null && echo EXISTS
18:54:17cmd/root$test -d /opt/kippo 2>/dev/null && echo EXISTS
18:54:17cmd/root$test -d /opt/honeytrap 2>/dev/null && echo EXISTS
18:54:17cmd/root$test -d /opt/dionaea 2>/dev/null && echo EXISTS
18:54:18cmd/root$test -d /home/cowrie 2>/dev/null && echo EXISTS
18:54:18cmd/root$test -d /home/kippo 2>/dev/null && echo EXISTS
18:54:19cmd/root$test -d /opt/glastopf 2>/dev/null && echo EXISTS
18:54:19cmd/root$test -d /opt/opencanary 2>/dev/null && echo EXISTS
18:54:20cmd/root$ps aux 2>/dev/null | grep -E 'tcpdump|snoopy|auditd' | grep -v grep
18:54:20cmd/root$test -f /etc/cowrie/cowrie.cfg 2>/dev/null && echo EXISTS
18:54:21cmd/root$test -f /home/cowrie/cowrie.cfg 2>/dev/null && echo EXISTS
18:54:21cmd/root$test -f /opt/cowrie/etc/cowrie.cfg 2>/dev/null && echo EXISTS