Agent 47 | Persistent NETSTAT

July 2, 2020 // echel0n

Hello fellas!

I decided to code this stupid awkward script.

When you have very low privileges (let's say `www-data`) but you would like to note every connections on the server while you are being away, you can just put this thing in somewhere on victim server.

DO YOU FEEL THAT, YOU ARE BEING APT NOW*chuckles*


So here it is:




  1. #!/usr/bin/env bash
  2. export TERM=xterm-256color
  3. clear
  4. echo
  5. echo
  6. echo " * ***"
  7. echo " ** ***"
  8. echo " ** **"
  9. echo " ** **"
  10. echo " ** ** ****"
  11. echo " *** **** ** *** *** ** * *** * *** **** "
  12. echo " * *** * *** * ** * *** * *** ** * **** **** **** * "
  13. echo " * *** * **** *** *** * *** ** ** ** ** **** "
  14. echo "** *** ** ** ** ** *** ** ** ** ** ** "
  15. echo "******** ** ** ** ******** ** ** ** ** ** "
  16. echo "******* ** ** ** ******* ** ** ** ** ** "
  17. echo "** ** ** ** ** ** ** ** ** ** "
  18. echo "**** * *** * ** ** **** * ** ****** ** ** "
  19. echo " ******* ******* ** ** ******* *** * **** *** *** "
  20. echo " ***** ***** ** ** ***** *** *** *** "
  21. echo " * "
  22. echo " * "
  23. echo " * "
  24. echo " * "
  25. echo
  26. echo "Agent 47"
  27. sleep 3
  28. touch /dev/shm/monitoring
  29. touch /dev/shm/new
  30. file=$(mktemp)
  31. progress() {
  32. pc=0;
  33. while [ -e $file ]
  34. do
  35. clear
  36. cat /dev/shm/monitoring
  37. echo -ne "$pc sec\033[0K\033[0K\r"
  38. sleep 1
  39. ((pc++))
  40. done
  41. }
  42. progress &
  43. while [[ true ]]; do
  44. (netstat -antp | grep -iv ":80" | grep ".*ESTABLISHED" | sort -u > /dev/shm/new) &> /dev/null &&
  45. cat /dev/shm/new /dev/shm/monitoring | sort -u > /dev/shm/monitoring &&
  46. rm /dev/shm/new
  47. done