{"id":21736,"date":"2026-09-12T10:40:28","date_gmt":"2026-09-12T07:10:28","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%b4%d9%86%d8%a7%d8%b3%d8%a7%db%8c%db%8c-reverse-shell-%d8%af%d8%b1-%d9%84%db%8c%d9%86%d9%88%da%a9%d8%b3\/"},"modified":"2026-09-12T13:21:15","modified_gmt":"2026-09-12T09:51:15","slug":"reverse-shell-linix","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/security\/reverse-shell-linix\/","title":{"rendered":"\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0647\u0645 \u0646\u0641\u0648\u0630 \u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0648\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u06cc\u062c\u0627\u062f \u06cc\u06a9 <strong>Reverse Shell<\/strong> \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06cc\u06a9 \u0627\u062a\u0635\u0627\u0644 \u0639\u0627\u062f\u06cc \u0645\u0627\u0646\u0646\u062f SSH\u060c \u0645\u062f\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 \u0628\u06cc\u0631\u0648\u0646 \u0628\u0647 \u0633\u0631\u0648\u0631 \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Administrator\n      |\n      v\nLinux Server\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u062f\u0631 Reverse Shell \u062c\u0647\u062a \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0639\u06a9\u0633 \u0627\u0633\u062a. \u0633\u06cc\u0633\u062a\u0645 \u0622\u0644\u0648\u062f\u0647 \u062e\u0648\u062f\u0634 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u06cc\u06af\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0647\u0645\u0627\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 \u0642\u0627\u062f\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc Command \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0647\u06cc\u0686 SSH Login \u062c\u062f\u06cc\u062f\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0646\u0634\u0648\u062f.<\/li>\n\n\n\n<li>\u0647\u06cc\u0686 \u067e\u0648\u0631\u062a Listener \u0645\u0634\u06a9\u0648\u06a9\u06cc \u0628\u0627\u0632 \u0646\u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>Firewall \u0648\u0631\u0648\u062f\u06cc \u0646\u06cc\u0632 \u0627\u062a\u0635\u0627\u0644 \u062e\u0627\u0635\u06cc \u0631\u0627 \u062b\u0628\u062a \u0646\u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>\u0627\u0645\u0627 \u0647\u0645\u0686\u0646\u0627\u0646 \u06cc\u06a9 Shell \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0645\u0647\u0627\u062c\u0645 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0628\u0627\u0634\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645 \u0686\u06af\u0648\u0646\u0647 \u0628\u0627 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633\u060c Connection\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9\u060c Process \u0645\u0631\u062a\u0628\u0637\u060c Parent Process\u060c File Descriptor\u0647\u0627\u060c Log\u0647\u0627 \u0648 Persistence \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u067e\u0627\u0633\u062e \u0628\u0647 Reverse Shell \u0631\u0648\u06cc \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u062a\u062d\u062a \u0645\u062f\u06cc\u0631\u06cc\u062a \u062e\u0648\u062f\u062a\u0627\u0646 \u0627\u0633\u062a \u0648 \u0634\u0627\u0645\u0644 \u0633\u0627\u062e\u062a \u06cc\u0627 \u0627\u062c\u0631\u0627\u06cc Reverse Shell \u0646\u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Reverse Shell \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u062d\u0627\u0644\u062a \u0639\u0627\u062f\u06cc \u0627\u06af\u0631 \u0628\u062e\u0648\u0627\u0647\u06cc\u0645 \u0628\u0647 \u06cc\u06a9 Linux Server \u0645\u062a\u0635\u0644 \u0634\u0648\u06cc\u0645\u060c Client \u0628\u0647 Server \u0627\u062a\u0635\u0627\u0644 \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u062f\u0631 SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client\n   |\n   | TCP Connection\n   v\nServer:22\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u062f\u0631 Reverse Shell \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0633\u06cc\u0633\u062a\u0645 \u0642\u0631\u0628\u0627\u0646\u06cc Connection \u062e\u0631\u0648\u062c\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Compromised Server\n        |\n        | Outbound Connection\n        v\nRemote System\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 Input \u0648 Output \u06cc\u06a9 Shell \u06cc\u0627 Process \u062f\u06cc\u06af\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0627\u06cc\u0646 Connection \u0645\u0646\u062a\u0642\u0644 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u06cc\u0646 \u062a\u0641\u0627\u0648\u062a \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u0641\u0642\u0637 \u0628\u0627 \u0628\u0631\u0631\u0633\u06cc \u067e\u0648\u0631\u062a\u200c\u0647\u0627\u06cc Listening \u06a9\u0627\u0641\u06cc \u0646\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 Reverse Shell \u062e\u0637\u0631\u0646\u0627\u06a9 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0645\u0647\u0627\u062c\u0645 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0627\u06cc\u062c\u0627\u062f Reverse Shell \u0634\u0648\u062f\u060c \u0628\u0633\u062a\u0647 \u0628\u0647 Permission Process \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u062a\u0648\u0627\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Command \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0633\u0631\u0648\u0631 \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>Configuration\u0647\u0627 \u0631\u0627 \u0628\u062e\u0648\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Credential\u0647\u0627 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631\u06cc \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>Persistence \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u0628\u0647 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631 \u0634\u0628\u06a9\u0647 \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0628\u0627 Permission \u0628\u0627\u0644\u0627 \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c Impact \u062d\u0627\u062f\u062b\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0633\u06cc\u0627\u0631 \u062c\u062f\u06cc\u200c\u062a\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0622\u06cc\u0627 \u0647\u0631 Connection \u062e\u0631\u0648\u062c\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u06cc\u0631.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633\u06cc \u0645\u0639\u0645\u0648\u0644\u0627\u064b Connection\u0647\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u0645\u062e\u062a\u0644\u0641\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\nNTP\nPackage Repository\nMonitoring\nBackup\nAPI\nSMTP\nDatabase\nCloud Services\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0645\u0634\u0627\u0647\u062f\u0647 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Reverse Shell \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u06cc\u062f \u0686\u0646\u062f \u0646\u0634\u0627\u0646\u0647 \u0631\u0627 \u06a9\u0646\u0627\u0631 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0642\u0631\u0627\u0631 \u062f\u0647\u06cc\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network Connection\n       +\nProcess\n       +\nParent Process\n       +\nCommand Line\n       +\nUser\n       +\nLogs\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631\u0686\u0647 \u0627\u06cc\u0646 \u0634\u0648\u0627\u0647\u062f \u0628\u06cc\u0634\u062a\u0631 \u0628\u0627 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0647\u0645\u200c\u062e\u0648\u0627\u0646\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0627\u062d\u062a\u0645\u0627\u0644 Incident \u0628\u06cc\u0634\u062a\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0648\u0644\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647: \u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc \u0641\u0639\u0627\u0644<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ss\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc TCP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-t\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0639\u0646\u06cc \u0641\u0642\u0637 TCP \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0628\u062f\u0647.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f IP \u0648 Port \u0628\u0647\u200c\u0635\u0648\u0631\u062a Numeric \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-p\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Process \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 Socket \u0631\u0627 \u062f\u0631 \u0635\u0648\u0631\u062a \u062f\u0627\u0634\u062a\u0646 Permission \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc Established<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062a\u0645\u0631\u06a9\u0632 \u0631\u0648\u06cc Connection\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u0628\u0631\u0642\u0631\u0627\u0631 \u0647\u0633\u062a\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp state established\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u062e\u0631\u0648\u062c\u06cc \u0645\u0634\u0627\u0628\u0647 \u0632\u06cc\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ESTAB 0 0 10.10.10.20:45822 203.0.113.10:4444 users:((\"bash\",pid=24891,fd=3))\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645 \u0627\u06cc\u0646 \u062e\u0637 \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local IP:\n10.10.10.20\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Port:\n45822\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote IP:\n203.0.113.10\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote Port:\n4444\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Process:\nbash\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>PID:\n24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f <code>bash<\/code> \u0628\u0627 Connection \u0645\u0633\u062a\u0642\u06cc\u0645 \u0628\u0647 \u06cc\u06a9 IP \u062e\u0627\u0631\u062c\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 <strong>\u062f\u0644\u06cc\u0644 \u062e\u0648\u0628\u06cc \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0641\u0648\u0631\u06cc \u0627\u0633\u062a<\/strong>\u060c \u0627\u0645\u0627 \u0647\u0646\u0648\u0632 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Reverse Shell \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u0645\u0627\u0645 Connection\u0647\u0627\u06cc TCP \u0648 UDP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc TCP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc UDP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -unap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0647\u0631 \u062f\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tunap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident Response \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u0627\u06cc\u062c\u0627\u062f \u062a\u063a\u06cc\u06cc\u0631\u060c \u062e\u0631\u0648\u062c\u06cc \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tunap &gt; \/root\/ir-network-connections.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0627\u06cc\u0646 \u062a\u0631\u062a\u06cc\u0628 \u0648\u0636\u0639\u06cc\u062a Connection\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u062f\u0631 \u0644\u062d\u0638\u0647 \u0628\u0631\u0631\u0633\u06cc \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 lsof \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0628\u06a9\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u0632\u0627\u0631 \u0645\u0647\u0645 \u062f\u06cc\u06af\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Network Connection\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -nP -i\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc TCP \u0628\u0631\u0642\u0631\u0627\u0631\u0634\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -nP -iTCP -sTCP:ESTABLISHED\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>COMMAND   PID     USER      FD   TYPE   NAME\n\nbash      24891   www-data  3u   IPv4   TCP 10.10.10.20:45822-&gt;203.0.113.10:4444 (ESTABLISHED)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Process = bash\nUser = www-data\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Web Server \u0628\u0627 User\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>www-data\napache\nnginx\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0631\u0627 \u0634\u0648\u062f\u060c \u0648\u062c\u0648\u062f Shell \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 \u0647\u0645\u0627\u0646 User \u06a9\u0647 Connection \u062e\u0627\u0631\u062c\u06cc \u0646\u06cc\u0632 \u062f\u0627\u0631\u062f\u060c \u0628\u0627\u06cc\u062f \u062c\u062f\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process \u0627\u0632 \u0631\u0648\u06cc PID<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 <code>ss<\/code> \u0646\u0634\u0627\u0646 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pid=24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -fp 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o pid,ppid,user,lstart,etime,args -p 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645 \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PID\nPPID\nUSER\nSTART TIME\nELAPSED TIME\nCOMMAND\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PPID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PPID \u0634\u0646\u0627\u0633\u0647 <strong>Parent Process<\/strong> \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 Parent Process \u0645\u0647\u0645 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Process \u0645\u0648\u0631\u062f\u0646\u0638\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Bash \u0631\u0648\u06cc Linux \u06a9\u0627\u0645\u0644\u0627\u064b \u0639\u0627\u062f\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Parent \u0622\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sshd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Bash \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 \u06cc\u06a9 Session \u0639\u0627\u062f\u06cc SSH \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0627\u06af\u0631 Process Tree \u0686\u0646\u06cc\u0646 \u0686\u06cc\u0632\u06cc \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nginx\n   |\n   v\nphp-fpm\n   |\n   v\nsh\n   |\n   v\nbash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0636\u0648\u0639 \u0628\u0633\u06cc\u0627\u0631 \u0645\u0634\u06a9\u0648\u06a9\u200c\u062a\u0631 \u062e\u0648\u0627\u0647\u062f \u0628\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Web Application \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0628\u0627\u06cc\u062f \u0628\u062f\u0648\u0646 \u062f\u0644\u06cc\u0644 \u06cc\u06a9 Shell \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u06a9\u0647 \u0647\u0645\u200c\u0632\u0645\u0627\u0646 Connection \u062e\u0627\u0631\u062c\u06cc \u0646\u06cc\u0632 \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Process Tree<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Process Tree \u06a9\u0627\u0645\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -ap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 PID \u0645\u0634\u062e\u0635 \u062f\u0627\u0631\u06cc\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -asp 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0686\u06cc\u0632\u06cc \u0634\u0628\u06cc\u0647 \u0632\u06cc\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemd\n  \u2514\u2500apache2\n      \u2514\u2500php-fpm\n          \u2514\u2500sh\n              \u2514\u2500bash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0632\u0646\u062c\u06cc\u0631\u0647 \u0628\u0627\u06cc\u062f \u0628\u0627 \u0631\u0641\u062a\u0627\u0631 \u0637\u0628\u06cc\u0639\u06cc Application \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Command Line Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Command Line:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -p 24891 -o args=\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Process \u062f\u0627\u062e\u0644 <code>\/proc<\/code> \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/proc\/24891\/cmdline\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 \u062e\u0648\u0627\u0646\u0627\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tr '\\0' ' ' &lt; \/proc\/24891\/cmdline\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Command \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647<\/li>\n\n\n\n<li>\u0627\u062c\u0631\u0627\u06cc Shell \u062a\u0648\u0633\u0637 Web Server<\/li>\n\n\n\n<li>Script \u062f\u0627\u062e\u0644 <code>\/tmp<\/code><\/li>\n\n\n\n<li>Script \u062f\u0627\u062e\u0644 <code>\/dev\/shm<\/code><\/li>\n\n\n\n<li>Binary \u0628\u0627 \u0646\u0627\u0645 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc<\/li>\n\n\n\n<li>Argument\u0647\u0627\u06cc \u0645\u0628\u0647\u0645<\/li>\n\n\n\n<li>\u0627\u062c\u0631\u0627\u06cc Interpreter \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Executable \u0648\u0627\u0642\u0639\u06cc Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/24891\/exe\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/bash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0633\u06cc\u0631 \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\/.cache\/example\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0631\u0627\u06cc Binary \u0627\u0632 Directory\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\n\/var\/tmp\n\/dev\/shm\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u062a\u0648\u0633\u0637 User \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Web Server\u060c \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Working Directory<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Current Working Directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/24891\/cwd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0645\u0634\u06a9\u0648\u06a9 \u0627\u0632 Directory\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\n\/dev\/shm\n\/var\/www\/...\/uploads\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0633\u0631\u0646\u062e \u0645\u0647\u0645\u06cc \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc File Descriptor\u0647\u0627\u06cc Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Process \u062f\u0631 Linux \u062f\u0627\u0631\u0627\u06cc File Descriptor \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -la \/proc\/24891\/fd\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062e\u0631\u0648\u062c\u06cc \u0645\u0634\u0627\u0628\u0647 \u0632\u06cc\u0631 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0 -&gt; socket:&#91;123456]\n1 -&gt; socket:&#91;123456]\n2 -&gt; socket:&#91;123456]\n3 -&gt; socket:&#91;123456]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u062a\u0631\u06a9\u06cc\u0628\u06cc \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>socket\npipe\nfile\n\/dev\/null\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0647 File Descriptor \u0645\u0647\u0645 \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0 = Standard Input\n1 = Standard Output\n2 = Standard Error\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Input \u0648 Output \u06cc\u06a9 Shell \u0628\u0647 Socket\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u06cc\u06a9\u06cc \u0627\u0632 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0647\u0645\u0631\u0627\u0647 \u0633\u0627\u06cc\u0631 Evidence\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0648\u0636\u0639\u06cc\u062a \u06a9\u0627\u0645\u0644 Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/proc\/24891\/status\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f \u0645\u0647\u0645 \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name\nState\nPid\nPPid\nUid\nGid\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Environment Process \u0631\u0627 \u0628\u0627 Permission \u0645\u0646\u0627\u0633\u0628 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tr '\\0' '\\n' &lt; \/proc\/24891\/environ\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06af\u0627\u0647\u06cc Environment \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631\u0628\u0627\u0631\u0647 Application \u06cc\u0627 \u0646\u062d\u0648\u0647 \u0627\u062c\u0631\u0627\u06cc Process \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0627\u0631\u0627\u0626\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0633\u062a\u062c\u0648\u06cc Shell\u0647\u0627\u06cc \u0641\u0639\u0627\u0644<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Shell Process\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps auxww | grep -E '&#91;b]ash|&#91;d]ash|&#91;s]h|&#91;z]sh'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0646\u062a\u06cc\u062c\u0647 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u0631\u0632\u0634\u06cc \u0628\u0631\u0627\u06cc \u062a\u0634\u062e\u06cc\u0635 \u0642\u0637\u0639\u06cc Reverse Shell \u0646\u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bash\nsh\ndash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Linux \u0637\u0628\u06cc\u0639\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 \u0686\u0647 User\u06cc \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>Parent \u0622\u0646 \u0686\u06cc\u0633\u062a\u061f<\/li>\n\n\n\n<li>Network Connection \u062f\u0627\u0631\u062f\u061f<\/li>\n\n\n\n<li>\u0627\u0632 \u0686\u0647 \u0645\u0633\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627 \u0634\u062f\u0647\u061f<\/li>\n\n\n\n<li>\u0686\u0647 \u0632\u0645\u0627\u0646\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u061f<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc Web Server<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 \u0645\u06cc\u200c\u062f\u0647\u06cc\u062f \u0646\u0641\u0648\u0630 \u0627\u0632 Web Application \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c Process\u0647\u0627\u06cc User \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Web Server \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Ubuntu \u0648 Debian:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -u www-data -f\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u0639\u0636\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc Apache:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -u apache -f\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Nginx:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -u nginx -f\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Process\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sh\nbash\npython\nperl\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 User\u0647\u0627 \u0644\u0632\u0648\u0645\u0627\u064b \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a\u060c \u0627\u0645\u0627 \u0639\u0644\u062a \u0622\u0646\u0647\u0627 \u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f\u061b \u0645\u062e\u0635\u0648\u0635\u0627\u064b \u0627\u06af\u0631 Network Connection \u062e\u0627\u0631\u062c\u06cc \u0646\u06cc\u0632 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc \u06cc\u06a9 PID \u0645\u0634\u062e\u0635<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 PID \u0645\u0648\u0631\u062f\u0646\u0638\u0631 \u0645\u0634\u062e\u0635 \u0634\u062f\u0647 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -Pan -p 24891 -i\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp | grep 'pid=24891'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Connection \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 Process \u0631\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Destination IP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f \u0627\u0632 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Remote IP \u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f \u0627\u06cc\u0646 IP \u0686\u0647 \u0627\u0631\u062a\u0628\u0627\u0637\u06cc \u0628\u0627 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0624\u0627\u0644\u0627\u062a \u0645\u0647\u0645:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0622\u06cc\u0627 IP \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 Monitoring Provider \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>Backup Provider \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>API \u0631\u0633\u0645\u06cc Application \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>CDN \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>SMTP Relay \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>Database \u062e\u0627\u0631\u062c\u06cc \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>\u06cc\u0627 \u0647\u06cc\u0686 \u0627\u0631\u062a\u0628\u0627\u0637 \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647\u200c\u0627\u06cc \u0628\u0627 Server \u0646\u062f\u0627\u0631\u062f\u061f<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Server Production \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Baseline \u0645\u0634\u062e\u0635\u06cc \u0627\u0632 Destination\u0647\u0627\u06cc \u0637\u0628\u06cc\u0639\u06cc \u062e\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Port \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u0628\u0647 \u0645\u0639\u0646\u06cc Reverse Shell \u0646\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Port\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4444\n5555\n8081\n9001\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u0648\u062c\u0647 \u0645\u062f\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u062c\u0644\u0628 \u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0634\u0645\u0627\u0631\u0647 Port \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0639\u06cc\u0627\u0631 \u062a\u0634\u062e\u06cc\u0635 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0632 \u0637\u0631\u0641 \u062f\u06cc\u06af\u0631\u060c Connection \u0645\u0634\u06a9\u0648\u06a9 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0631\u0648\u06cc Port\u0647\u0627\u06cc \u06a9\u0627\u0645\u0644\u0627\u064b \u0645\u0639\u0645\u0648\u0644\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>80\n443\n53\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06cc\u0632 \u0628\u0631\u0642\u0631\u0627\u0631 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062a\u0634\u062e\u06cc\u0635 \u0628\u0627\u06cc\u062f \u0628\u06cc\u0634\u062a\u0631 \u0628\u0631 \u0627\u0633\u0627\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Process\n+\nParent\n+\nDestination\n+\nBehaviour\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Connection\u0647\u0627\u06cc \u0637\u0648\u0644\u0627\u0646\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Established Connection \u0628\u0647 \u0647\u0645\u0631\u0627\u0647 Timer:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnpo state established\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062f\u0648\u0631\u0647\u200c\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>watch -n 2 'ss -tnp state established'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Connection \u0637\u0648\u0644\u0627\u0646\u06cc\u200c\u0645\u062f\u062a \u0628\u0647 IP \u0646\u0627\u0634\u0646\u0627\u0633 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0631\u0632\u0634 \u0628\u0631\u0631\u0633\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f\u060c \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0627\u06af\u0631 Process \u0645\u0631\u062a\u0628\u0637 \u0646\u06cc\u0632 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Log\u0647\u0627\u06cc systemd<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Log\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl --since \"1 hour ago\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Nginx:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u nginx\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Apache:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u apache2\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Real-time:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -f\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 Event\u0647\u0627\u06cc \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u0632\u0645\u0627\u0646 \u0627\u06cc\u062c\u0627\u062f Process \u0645\u0634\u06a9\u0648\u06a9 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Authentication Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Ubuntu \u0648 Debian:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo less \/var\/log\/auth.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 AlmaLinux\u060c Rocky Linux \u0648 RHEL:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo less \/var\/log\/secure\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SSH Login<\/li>\n\n\n\n<li>sudo<\/li>\n\n\n\n<li>Authentication Failure<\/li>\n\n\n\n<li>Session Start<\/li>\n\n\n\n<li>User Creation<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0644\u0628\u062a\u0647 \u0646\u0628\u0648\u062f SSH Login \u0645\u0634\u06a9\u0648\u06a9\u060c Reverse Shell \u0631\u0627 \u0631\u062f \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Web Server Log\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 \u0645\u06cc\u200c\u062f\u0647\u06cc\u062f Incident \u0627\u0632 Web Application \u0622\u063a\u0627\u0632 \u0634\u062f\u0647 \u0627\u0633\u062a\u060c Access Log \u0648 Error Log \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Nginx:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/nginx\/access.log\n\/var\/log\/nginx\/error.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Apache \u062f\u0631 Ubuntu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/apache2\/access.log\n\/var\/log\/apache2\/error.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0622\u062e\u0631\u06cc\u0646 Request\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tail -n 200 \/var\/log\/nginx\/access.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tail -n 200 \/var\/log\/apache2\/access.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 Request\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u0646\u0632\u062f\u06cc\u06a9 \u0632\u0645\u0627\u0646 \u0627\u06cc\u062c\u0627\u062f Process \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0632\u0645\u0627\u0646 Process \u0631\u0627 \u0628\u0627 Log \u062a\u0637\u0628\u06cc\u0642 \u062f\u0647\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0632\u0645\u0627\u0646 \u0622\u063a\u0627\u0632 Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o pid,lstart,args -p 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Process \u062f\u0631 \u0633\u0627\u0639\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>14:32\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 Log \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0647\u0645\u0627\u0646 \u0632\u0645\u0627\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep '14:32' \/var\/log\/nginx\/access.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep '14:32' \/var\/log\/apache2\/access.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u06cc\u06a9 HTTP Request \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u062f\u0631\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u0627\u06cc\u062c\u0627\u062f Process \u062b\u0628\u062a \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c Correlation \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 \u0646\u0641\u0648\u0630 \u0627\u0632 Web Application \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647 \u0637\u06cc 24 \u0633\u0627\u0639\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo find \/var\/www -type f -mtime -1 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647 \u062f\u0631 60 \u062f\u0642\u06cc\u0642\u0647 \u06af\u0630\u0634\u062a\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo find \/var\/www -type f -mmin -60 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062e\u0635\u0648\u0635 Directory\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uploads\ncache\ntmp\npublic\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062c\u062f\u06cc\u062f \u0628\u0648\u062f\u0646 \u0641\u0627\u06cc\u0644 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0646\u0634\u0627\u0646\u0647 Malware \u0646\u06cc\u0633\u062a \u0648 \u0628\u0627\u06cc\u062f \u0628\u0627 \u0641\u0639\u0627\u0644\u06cc\u062a \u0639\u0627\u062f\u06cc Application \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \/tmp \u0648 \/dev\/shm<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Directory\u0647\u0627\u06cc Writable \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\n\/var\/tmp\n\/dev\/shm\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06cc\u0632 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u06cc\u062c\u0627\u062f \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647 \u062f\u0631 \u062f\u0648 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo find \/tmp \/var\/tmp \/dev\/shm -type f -mmin -120 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0641\u0627\u06cc\u0644 \u0645\u062e\u0641\u06cc<\/li>\n\n\n\n<li>Executable \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>\u0646\u0627\u0645 \u062a\u0635\u0627\u062f\u0641\u06cc<\/li>\n\n\n\n<li>Owner \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Web Server<\/li>\n\n\n\n<li>Timestamp \u0646\u0632\u062f\u06cc\u06a9 Incident<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0630\u0641\u200c\u0634\u062f\u0647 \u0648\u0644\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06af\u0627\u0647\u06cc \u06cc\u06a9 Process \u0647\u0646\u0648\u0632 \u0641\u0627\u06cc\u0644\u06cc \u0631\u0627 \u0628\u0627\u0632 \u0646\u06af\u0647 \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 Filesystem \u062d\u0630\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof +L1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0686\u0646\u06cc\u0646 \u0641\u0627\u06cc\u0644\u06cc \u0647\u0645\u06cc\u0634\u0647 \u0628\u0647 \u0645\u0639\u0646\u06cc Malware \u0646\u06cc\u0633\u062a\u060c \u0627\u0645\u0627 Process\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0631\u0648\u062c\u06cc \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Persistence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062d\u062a\u06cc \u0627\u06af\u0631 Reverse Shell \u067e\u06cc\u062f\u0627 \u0648 \u0645\u062a\u0648\u0642\u0641 \u0634\u0648\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0647\u0627\u062c\u0645 \u0631\u0648\u0634 \u062f\u06cc\u06af\u0631\u06cc \u0628\u0631\u0627\u06cc \u0628\u0627\u0632\u06af\u0634\u062a \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0628\u0631\u0631\u0633\u06cc Persistence \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Cron Job\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cron \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo crontab -l\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cron User \u0641\u0639\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -la \/etc\/cron.d\/\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -la \/etc\/cron.daily\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0628\u0633\u062a\u0647 \u0628\u0647 Distribution:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -la \/var\/spool\/cron\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Job\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u06cc\u0627 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc systemd Service\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc Running:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl --type=service --state=running\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Service\u0647\u0627\u06cc Enable \u0634\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=service --state=enabled\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -la \/etc\/systemd\/system\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Service \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0627\u06cc \u06a9\u0647 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0627\u06cc \u0631\u0627 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\n\/dev\/shm\n\/home\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0628\u0627\u06cc\u062f \u062c\u062f\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc systemd Timer\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Timer\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Timer \u062c\u062f\u06cc\u062f \u06cc\u0627 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06cc\u06a9 Persistence Mechanism \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc SSH Authorized Keys<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cat \/root\/.ssh\/authorized_keys\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc User \u0641\u0639\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/.ssh\/authorized_keys\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Authorized Keys:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo find \/home \/root -path '*\/.ssh\/authorized_keys' -type f -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Key \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc User\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0645\u0627\u0645 User\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">User\u0647\u0627\u06cc\u06cc \u06a9\u0647 Login Shell \u062f\u0627\u0631\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '$7 !~ \/(nologin|false)$\/ {print $1,$3,$6,$7}' \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 Account\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f\u060c UID \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u06cc\u0627 User\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u0646\u062a\u0638\u0627\u0631 \u0646\u062f\u0627\u0631\u06cc\u062f Login \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Auditd<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 Linux Audit \u0641\u0639\u0627\u0644 \u0627\u0633\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u0631\u0632\u0634\u0645\u0646\u062f\u06cc \u062f\u0631\u0628\u0627\u0631\u0647 \u0627\u062c\u0631\u0627\u06cc Process\u0647\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl status auditd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062c\u0633\u062a\u062c\u0648\u06cc Event\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -m EXECVE -ts recent\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 PID \u0645\u0634\u062e\u0635 \u062f\u0627\u0631\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ausearch -p 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Audit Logging \u0642\u0628\u0644 \u0627\u0632 Incident \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u062f\u061b Auditd \u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Event\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u0642\u0628\u0644\u0627\u064b \u062b\u0628\u062a \u0646\u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u0639\u062f\u0627\u064b \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 \u0633\u0646\u0627\u0631\u06cc\u0648\u06cc \u0639\u0645\u0644\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u062f\u0633\u062a\u0648\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp state established\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0631\u0648\u062c\u06cc \u0632\u06cc\u0631 \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>10.10.10.20:45822 -&gt; 203.0.113.10:4444\nusers:((\"bash\",pid=24891,fd=3))\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: \u0628\u0631\u0631\u0633\u06cc Process<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o pid,ppid,user,lstart,args -p 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 User:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>www-data\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0627\u0631\u0632\u0634 \u0628\u0631\u0631\u0633\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: \u0628\u0631\u0631\u0633\u06cc Parent Process<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -asp 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 \u0646\u062a\u06cc\u062c\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apache2\n \u2514\u2500php-fpm\n    \u2514\u2500sh\n       \u2514\u2500bash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 \u0627\u062d\u062a\u0645\u0627\u0644 \u0631\u0641\u062a\u0627\u0631 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: \u0628\u0631\u0631\u0633\u06cc Socket\u0647\u0627<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -la \/proc\/24891\/fd\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f File Descriptor\u0647\u0627\u06cc Process \u0628\u0647 \u0686\u0647 \u0645\u0646\u0627\u0628\u0639\u06cc \u0645\u062a\u0635\u0644 \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: \u062a\u0639\u06cc\u06cc\u0646 \u0632\u0645\u0627\u0646 \u0622\u063a\u0627\u0632 Process<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o lstart= -p 24891\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>14:32\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: \u0628\u0631\u0631\u0633\u06cc Web Log<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>grep '14:32' \/var\/log\/apache2\/access.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Request \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644\u06cc \u062f\u0642\u06cc\u0642\u0627\u064b \u0646\u0632\u062f\u06cc\u06a9 \u0627\u06cc\u0646 \u0632\u0645\u0627\u0646 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f\u060c \u0634\u0648\u0627\u0647\u062f \u0642\u0648\u06cc\u200c\u062a\u0631 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc\u06a9\u0631\u062f \u0635\u062d\u06cc\u062d Detection \u0628\u0647 \u0627\u06cc\u0646 \u0634\u06a9\u0644 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network\n   +\nProcess\n   +\nParent\n   +\nFile Descriptors\n   +\nTimeline\n   +\nApplication Logs\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u06af\u0631 Reverse Shell \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u06cc\u0645 \u0686\u0647 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0634\u0648\u0627\u0647\u062f \u062c\u062f\u06cc \u0627\u0632 Compromise \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0627\u0648\u0644\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u0646\u0628\u0627\u06cc\u062f \u0635\u0631\u0641\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kill PID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627 Kill \u06a9\u0631\u062f\u0646 \u0633\u0631\u06cc\u0639 Process \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u062e\u0634\u06cc \u0627\u0632 Evidence \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0645\u06a9\u0627\u0646 \u0648\u0636\u0639\u06cc\u062a \u0641\u0639\u0644\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0648\u0644\u06cc\u0647 Evidence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0632\u0645\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>date\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Network Connection\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tunap &gt; \/root\/ir-network.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Process\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps auxwwf &gt; \/root\/ir-processes.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open File\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -nP &gt; \/root\/ir-lsof.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Logged-in User\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>who\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>w\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0627\u06cc\u062f \u0642\u0628\u0644 \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631 \u06af\u0633\u062a\u0631\u062f\u0647 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u062b\u0628\u062a \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: Containment<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Compromise \u062a\u0623\u06cc\u06cc\u062f \u06cc\u0627 \u0628\u0633\u06cc\u0627\u0631 \u0645\u062d\u062a\u0645\u0644 \u0628\u0627\u0634\u062f\u060c \u0628\u0627\u06cc\u062f \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0633\u062a\u0647 \u0628\u0647 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall<\/li>\n\n\n\n<li>Security Group<\/li>\n\n\n\n<li>VLAN<\/li>\n\n\n\n<li>Hypervisor<\/li>\n\n\n\n<li>Cloud Network Policy<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Containment<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident \u062c\u062f\u06cc\u060c Server \u0631\u0627 \u0628\u062f\u0648\u0646 \u0628\u0631\u0646\u0627\u0645\u0647 \u062e\u0627\u0645\u0648\u0634 \u0646\u06a9\u0646\u06cc\u062f\u061b \u0632\u06cc\u0631\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Volatile \u0645\u0627\u0646\u0646\u062f Process\u0647\u0627 \u0648 Connection\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u0627\u0632 \u0628\u06cc\u0646 \u062e\u0648\u0627\u0647\u0646\u062f \u0631\u0641\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: \u062d\u0641\u0638 Evidence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0631\u0627\u06cc Investigation \u0644\u0627\u0632\u0645 \u0628\u0627\u0634\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process List<\/li>\n\n\n\n<li>Network Connection\u0647\u0627<\/li>\n\n\n\n<li>Open Files<\/li>\n\n\n\n<li>Logged-in User\u0647\u0627<\/li>\n\n\n\n<li>Process Tree<\/li>\n\n\n\n<li>Command Line\u0647\u0627<\/li>\n\n\n\n<li>Log\u0647\u0627<\/li>\n\n\n\n<li>Timeline<\/li>\n\n\n\n<li>Hash \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/li>\n\n\n\n<li>Persistence Mechanism\u0647\u0627<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident\u0647\u0627\u06cc \u0645\u0647\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Memory Capture \u0648 Disk Image \u0646\u06cc\u0632 \u0637\u0628\u0642 \u0631\u0648\u06cc\u0647 Forensics \u0633\u0627\u0632\u0645\u0627\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: Credential\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0645\u0647\u0627\u062c\u0645 \u062a\u0648\u0627\u0646\u0633\u062a\u0647 \u0631\u0648\u06cc Server Command \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f\u060c Secret\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f \u0631\u0648\u06cc \u0622\u0646 \u0633\u0631\u0648\u0631 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SSH Private Key<\/li>\n\n\n\n<li>API Token<\/li>\n\n\n\n<li>Database Password<\/li>\n\n\n\n<li>Cloud Credential<\/li>\n\n\n\n<li>Backup Credential<\/li>\n\n\n\n<li>Application Secret<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u062a\u0623\u06cc\u06cc\u062f Incident\u060c Credential\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u0633\u0627\u0633 Scope \u062d\u0627\u062f\u062b\u0647 Rotate \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rotation \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0627\u0632 \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u0633\u0627\u0644\u0645 \u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: Root Cause \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062d\u0630\u0641 Reverse Shell \u0645\u0634\u06a9\u0644 \u0627\u0635\u0644\u06cc \u0631\u0627 \u062d\u0644 \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u0645\u0647\u0627\u062c\u0645 \u0686\u06af\u0648\u0646\u0647 \u0648\u0627\u0631\u062f Server \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Vulnerable Web Application<\/li>\n\n\n\n<li>Plugin \u0642\u062f\u06cc\u0645\u06cc<\/li>\n\n\n\n<li>Credential \u0633\u0631\u0642\u062a\u200c\u0634\u062f\u0647<\/li>\n\n\n\n<li>Weak Password<\/li>\n\n\n\n<li>Misconfiguration<\/li>\n\n\n\n<li>Exposed Management Panel<\/li>\n\n\n\n<li>Vulnerable Service<\/li>\n\n\n\n<li>Compromised Deployment Credential<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0627 Root Cause \u0631\u0641\u0639 \u0646\u0634\u0648\u062f\u060c \u0627\u062d\u062a\u0645\u0627\u0644 \u0628\u0627\u0632\u06af\u0634\u062a \u0645\u0647\u0627\u062c\u0645 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: Rebuild \u06cc\u0627 Cleanup\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0645\u0647\u0627\u062c\u0645 \u062f\u0633\u062a\u0631\u0633\u06cc \u0633\u0637\u062d \u0628\u0627\u0644\u0627 \u062f\u0627\u0634\u062a\u0647 \u06cc\u0627 Root Compromise \u0645\u062d\u062a\u0645\u0644 \u0628\u0627\u0634\u062f\u060c Cleanup \u062f\u0633\u062a\u06cc \u0647\u0645\u06cc\u0634\u0647 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0686\u0646\u06cc\u0646 \u0634\u0631\u0627\u06cc\u0637\u06cc \u0628\u0627\u06cc\u062f \u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Rebuild \u0627\u0632 Image \u0633\u0627\u0644\u0645<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062c\u062f\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f \u0627\u0632 Rebuild \u0646\u06cc\u0632 \u0644\u0627\u0632\u0645 \u0627\u0633\u062a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Patch<\/li>\n\n\n\n<li>Hardening<\/li>\n\n\n\n<li>Credential Rotation<\/li>\n\n\n\n<li>Log Review<\/li>\n\n\n\n<li>Monitoring<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06af\u0648\u0646\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 Reverse Shell \u0631\u0627 \u06a9\u0627\u0647\u0634 \u062f\u0647\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0642\u062f\u0627\u0645\u0627\u062a \u062f\u0641\u0627\u0639\u06cc \u0645\u0647\u0645 \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Patch \u0645\u0646\u0638\u0645 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644<\/li>\n\n\n\n<li>Update Web Application<\/li>\n\n\n\n<li>Update CMS \u0648 Plugin\u0647\u0627<\/li>\n\n\n\n<li>Least Privilege<\/li>\n\n\n\n<li>Egress Filtering<\/li>\n\n\n\n<li>Application Isolation<\/li>\n\n\n\n<li>SELinux \u06cc\u0627 AppArmor<\/li>\n\n\n\n<li>EDR<\/li>\n\n\n\n<li>Audit Logging<\/li>\n\n\n\n<li>File Integrity Monitoring<\/li>\n\n\n\n<li>Web Application Firewall<\/li>\n\n\n\n<li>Network Monitoring<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Outbound Traffic<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u062f\u0641\u0627\u0639\u06cc \u0645\u0647\u0645 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Connection\u0647\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Web Server \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0641\u0642\u0637 \u0628\u0647 \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\nNTP\nPackage Repository\nDatabase\nMonitoring\nApproved APIs\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06cc\u0627\u0632 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Server \u0628\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u0628\u0647 \u0647\u0631 IP \u0648 Port \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0645\u062a\u0635\u0644 \u0634\u0648\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u062f\u0634\u0648\u0627\u0631\u062a\u0631 \u062e\u0648\u0627\u0647\u062f \u0628\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Egress Filtering \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0633\u0637\u062d \u06a9\u0646\u062a\u0631\u0644 \u0628\u06cc\u0634\u062a\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u06cc\u062c\u0627\u062f Baseline \u0634\u0628\u06a9\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0645\u0634\u062e\u0635 \u0628\u0627\u0634\u062f Server \u062f\u0631 \u062d\u0627\u0644\u062a \u0639\u0627\u062f\u06cc \u0628\u0647 \u0686\u0647 Destination\u0647\u0627\u06cc\u06cc \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Web Server\n \u251c\u2500 DNS Resolver\n \u251c\u2500 Database\n \u251c\u2500 Monitoring Server\n \u251c\u2500 Backup Server\n \u2514\u2500 Approved APIs\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062a\u0635\u0627\u0644 \u062c\u062f\u06cc\u062f\u06cc \u062e\u0627\u0631\u062c \u0627\u0632 \u0627\u06cc\u0646 Baseline \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c \u0647\u0646\u06af\u0627\u0645 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0628\u0631\u0631\u0633\u06cc \u0641\u0642\u0637 Listening Port\u0647\u0627<\/li>\n\n\n\n<li>\u062a\u0635\u0648\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0647\u0631 Bash \u0645\u062e\u0631\u0628 \u0627\u0633\u062a<\/li>\n\n\n\n<li>\u062a\u0635\u0648\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0647\u0631 Connection \u062e\u0627\u0631\u062c\u06cc \u0645\u062e\u0631\u0628 \u0627\u0633\u062a<\/li>\n\n\n\n<li>\u062a\u0645\u0631\u06a9\u0632 \u0641\u0642\u0637 \u0631\u0648\u06cc Port\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644<\/li>\n\n\n\n<li>Kill \u06a9\u0631\u062f\u0646 Process \u0642\u0628\u0644 \u0627\u0632 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc Evidence<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Parent Process<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Web Server Log<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Persistence<\/li>\n\n\n\n<li>Rotate \u0646\u06a9\u0631\u062f\u0646 Credential\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631<\/li>\n\n\n\n<li>\u062d\u0630\u0641 \u0641\u0627\u06cc\u0644 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u062f\u0648\u0646 \u06cc\u0627\u0641\u062a\u0646 Root Cause<\/li>\n\n\n\n<li>\u0627\u0639\u062a\u0645\u0627\u062f \u0645\u062c\u062f\u062f \u0628\u0647 Server \u0628\u062f\u0648\u0646 \u0628\u0631\u0631\u0633\u06cc Scope Compromise<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0635\u062d\u06cc\u062d Reverse Shell:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connection\u0647\u0627\u06cc Established \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>PID \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Connection \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>User Process \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Parent Process \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Process Tree \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Command Line \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Executable \u0648\u0627\u0642\u0639\u06cc \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Working Directory \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>File Descriptor\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Timeline \u0631\u0627 \u0628\u0627 Log\u0647\u0627 \u062a\u0637\u0628\u06cc\u0642 \u062f\u0647\u06cc\u062f.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Cron \u0648 systemd \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>SSH Key\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0642\u0628\u0644 \u0627\u0632 Kill \u06a9\u0631\u062f\u0646 Process Evidence \u0644\u0627\u0632\u0645 \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Root Cause \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u062f\u0631 Compromise \u062c\u062f\u06cc Rebuild \u0631\u0627 \u062f\u0631 \u0646\u0638\u0631 \u0628\u06af\u06cc\u0631\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 Reverse Shell \u0631\u0648\u06cc Linux Server \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connection\u0647\u0627\u06cc Established \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Remote IP\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u0634\u062e\u0635 \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Process \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Connection \u067e\u06cc\u062f\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>User Process \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Parent Process \u0645\u0634\u062e\u0635 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Process Tree \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Command Line \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Executable \u0648\u0627\u0642\u0639\u06cc Process \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Working Directory \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>File Descriptor\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Web Server Log\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Authentication Log\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li><code>\/tmp<\/code> \u0648 <code>\/dev\/shm<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Cron Job\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>systemd Service\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>systemd Timer\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>SSH Authorized Key\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Evidence \u0642\u0628\u0644 \u0627\u0632 Containment \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Root Cause \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Credential\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 Rotate \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0637\u0627\u0644\u0639\u0647 \u0628\u06cc\u0634\u062a\u0631 \u062f\u0631\u0628\u0627\u0631\u0647 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u0648 \u0628\u062e\u0634\u200c\u0647\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f\u060c \u0645\u0646\u0627\u0628\u0639 \u0632\u06cc\u0631 \u0645\u0646\u0627\u0633\u0628 \u0647\u0633\u062a\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc iproute2 \u062f\u0631\u0628\u0627\u0631\u0647 ss<\/strong><br>\u0645\u0631\u062c\u0639 \u06af\u0632\u06cc\u0646\u0647\u200c\u0647\u0627\u06cc <code>ss<\/code> \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Socket\u0647\u0627\u060c TCP State \u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Process.<br><code>https:\/\/github.com\/iproute2\/iproute2\/blob\/main\/man\/man8\/ss.8?utm_source=maral.cloud<\/code><\/li>\n\n\n\n<li><strong>Linux man-pages \u2013 proc_pid_fd<\/strong><br>\u062a\u0648\u0636\u06cc\u062d \u0631\u0633\u0645\u06cc \u0633\u0627\u062e\u062a\u0627\u0631 <code>\/proc\/PID\/fd<\/code> \u0648 File Descriptor\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0641\u0627\u06cc\u0644\u060c Pipe \u0648 Socket.<br><code>https:\/\/man7.org\/linux\/man-pages\/man5\/proc_pid_fd.5.html?utm_source=maral.cloud<\/code><\/li>\n\n\n\n<li><strong>systemd \u2013 journalctl<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0648 Filter \u06a9\u0631\u062f\u0646 Log\u0647\u0627\u06cc systemd Journal.<br><code>https:\/\/www.freedesktop.org\/software\/systemd\/man\/latest\/journalctl.html?utm_source=maral.cloud<\/code><\/li>\n\n\n\n<li><strong>Linux Audit \u2013 auditd<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a Linux Audit Daemon \u0648 \u0646\u062d\u0648\u0647 \u062b\u0628\u062a Audit Event\u0647\u0627.<br><code>https:\/\/github.com\/linux-audit\/audit-userspace\/blob\/master\/docs\/auditd.8?utm_source=maral.cloud<\/code><\/li>\n\n\n\n<li><strong>Linux Kernel \/ Userspace Interface Documentation<\/strong><br>\u0645\u062c\u0645\u0648\u0639\u0647 \u0645\u0633\u062a\u0646\u062f\u0627\u062a Linux man-pages \u0628\u0631\u0627\u06cc Process\u0647\u0627\u060c <code>\/proc<\/code> \u0648 Interface\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645.<br><code>https:\/\/www.kernel.org\/doc\/man-pages\/?utm_source=maral.cloud<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Reverse Shell \u0628\u0627 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 Connection\u0647\u0627\u06cc \u0645\u0639\u0645\u0648\u0644 \u0634\u0628\u06a9\u0647 \u062a\u0641\u0627\u0648\u062a \u0645\u0647\u0645\u06cc \u062f\u0627\u0631\u062f: \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0627\u0644\u062a \u0633\u06cc\u0633\u062a\u0645 \u0622\u0644\u0648\u062f\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062e\u0648\u062f\u0634 Connection \u062e\u0631\u0648\u062c\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u0648 Shell \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0647\u0645\u0627\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0633\u06cc\u0633\u062a\u0645 Remote \u0642\u0631\u0627\u0631 \u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0628\u0631\u0631\u0633\u06cc \u0635\u0631\u0641 \u067e\u0648\u0631\u062a\u200c\u0647\u0627\u06cc Listening \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0622\u0646 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0628\u0647\u062a\u0631\u06cc\u0646 \u0646\u0642\u0627\u0637 \u0634\u0631\u0648\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp state established\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Connection \u0645\u0634\u06a9\u0648\u06a9\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c \u0628\u0627\u06cc\u062f Process\u060c PID\u060c User \u0648 Destination \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0646 \u0645\u0634\u062e\u0635 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0633 \u0627\u0632 \u0622\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o pid,ppid,user,lstart,args -p PID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -asp PID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u0645\u06a9 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f Process \u0627\u0632 \u0686\u0647 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0627\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f \u0628\u0627\u06cc\u062f <code>\/proc\/PID\/fd<\/code>\u060c Executable\u060c Working Directory\u060c Web Log\u0647\u0627 \u0648 Timeline \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0646\u06a9\u062a\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 <strong>\u0647\u06cc\u0686 \u0646\u0634\u0627\u0646\u0647\u200c\u0627\u06cc \u0631\u0627 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0628\u0646\u0627\u06cc \u062a\u0634\u062e\u06cc\u0635 Reverse Shell \u0642\u0631\u0627\u0631 \u0646\u062f\u0647\u06cc\u0645<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Bash\u060c \u06cc\u06a9 IP \u062e\u0627\u0631\u062c\u06cc \u06cc\u0627 \u06cc\u06a9 Port \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Incident \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0634\u062e\u06cc\u0635 \u0645\u0639\u062a\u0628\u0631 \u0632\u0645\u0627\u0646\u06cc \u0634\u06a9\u0644 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 \u0686\u0646\u062f Evidence \u06a9\u0646\u0627\u0631 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Suspicious Connection\n        +\nUnexpected Process\n        +\nSuspicious Parent\n        +\nSocket-backed File Descriptors\n        +\nMatching Timeline\n        +\nApplication or System Logs\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Compromise \u062a\u0623\u06cc\u06cc\u062f \u0634\u062f\u060c \u0641\u0642\u0637 \u0628\u0633\u062a\u0646 Connection \u06cc\u0627 Kill \u06a9\u0631\u062f\u0646 Process \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a. Evidence \u0628\u0627\u06cc\u062f \u062d\u0641\u0638 \u0634\u0648\u062f\u060c \u0633\u06cc\u0633\u062a\u0645 \u0645\u0647\u0627\u0631 \u0634\u0648\u062f\u060c Persistence \u0648 Root Cause \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f \u0648 Credential\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0646\u06cc\u0632 Rotate \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident\u0647\u0627\u06cc \u062c\u062f\u06cc\u060c \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 Root Compromise \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0628\u0627\u0632\u0633\u0627\u0632\u06cc Server \u0627\u0632 \u06cc\u06a9 Image \u0633\u0627\u0644\u0645 \u0628\u0627\u06cc\u062f \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9\u06cc \u0627\u0632 \u06af\u0632\u06cc\u0646\u0647\u200c\u0647\u0627\u06cc \u0627\u0635\u0644\u06cc Recovery \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0642\u062f\u0645\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0645\u0647\u0645 \u0646\u0641\u0648\u0630 \u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0648\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u06cc\u062c\u0627\u062f \u06cc\u06a9 Reverse Shell \u0628\u0627\u0634\u062f. \u062f\u0631 \u06cc\u06a9 \u0627\u062a\u0635\u0627\u0644 \u0639\u0627\u062f\u06cc \u0645\u0627\u0646\u0646\u062f SSH\u060c \u0645\u062f\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 \u0628\u06cc\u0631\u0648\u0646 \u0628\u0647 \u0633\u0631\u0648\u0631 \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f: \u0627\u0645\u0627 \u062f\u0631 Reverse Shell \u062c\u0647\u062a \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0639\u06a9\u0633 \u0627\u0633\u062a. \u0633\u06cc\u0633\u062a\u0645 \u0622\u0644\u0648\u062f\u0647 \u062e\u0648\u062f\u0634 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u06cc\u06af\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0647\u0645\u0627\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":21769,"parent":17595,"menu_order":55,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-21736","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1789947097","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=21736"}],"version-history":[{"count":2,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21736\/revisions"}],"predecessor-version":[{"id":21772,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21736\/revisions\/21772"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/21769"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=21736"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=21736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}