Мистический рассказ "Между строк"⁠⁠

$ sudo tcpdump -nni any
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
19:14:24.637990 eno1 In IP 155.212.203.195.443 > 192.168.88.252.51006: Flags [P.], seq 1:210, ack 573, win 83, options [nop,nop,TS val 607088562 ecr 4151334296], length 209
19:14:24.638007 eno1 Out IP 192.168.88.252.51006 > 155.212.203.195.443: Flags [.], ack 210, win 63, options [nop,nop,TS val 4151334300 ecr 607088562], length 0
19:14:48.637990 eno1 In IP 209.236.229.240.494 > 192.168.88.252.65536: Flags [P.], seq 1:210, ack 1, win 64240, options [nop,nop,TS val 607089002 ecr 4151334300], length 209
19:14:48.638011 eno1 Out IP 192.168.88.252.65536 > 209.236.229.240.494: Flags [.], ack 210, win 63, options [nop,nop,TS val 4151334304 ecr 607089002], length 0
19:14:48.638214 eno1 Out IP 192.168.88.252.65536 > 209.236.229.240.494: Flags [P.], seq 1:51, ack 210, win 63, options [nop,nop,TS val 4151334304 ecr 607089002], length 50
19:14:48.638239 eno1 In IP 209.236.229.240.494 > 192.168.88.252.65536: Flags [.], ack 51, win 64240, options [nop,nop,TS val 607089003 ecr 4151334304], length 0
19:14:48.638501 eno1 In IP 209.236.229.240.494 > 192.168.88.252.65536: Flags [P.], seq 210:356, ack 51, win 64240, options [nop,nop,TS val 607089004 ecr 4151334304], length 146
19:14:48.638520 eno1 Out IP 192.168.88.252.65536 > 209.236.229.240.494: Flags [.], ack 356, win 63, options [nop,nop,TS val 4151334305 ecr 607089004], length 0
^C

$ sudo tcpdump -nni any port 65536
tcpdump: illegal port number 65536 > 65535
$ sudo tcpdump -nni any host 209.236.229.240
19:16:48.637990 eno1 In IP 209.236.229.240.494 > 192.168.88.252.65536: Flags [P.], seq 356:565, ack 51, win 64240, options [nop,nop,TS val 607209002 ecr 4151334305], length 209
19:16:48.638011 eno1 Out IP 192.168.88.252.65536 > 209.236.229.240.494: Flags [.], ack 565, win 63, options [nop,nop,TS val 4151454304 ecr 607209002], length 0
^C

$ погоди, у меня тут что-то странное по сети
zsh: command not found: погоди,

$ sudo ss -tlpn
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* users:(("systemd-resolve",pid=807,fd=22))
LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=807,fd=20))
LISTEN 0 4096 0.0.0.0:5355 0.0.0.0:* users:(("systemd-resolve",pid=807,fd=13))
LISTEN 0 128 127.0.0.1:33101 0.0.0.0:* users:(("steam",pid=2112,fd=100))
LISTEN 0 4096 127.0.0.1:631 0.0.0.0:* users:(("cupsd",pid=1087,fd=8))
LISTEN 0 128 127.0.0.1:34873 0.0.0.0:* users:(("steam",pid=2112,fd=65))
LISTEN 0 4096 0.0.0.0:65536 0.0.0.0:* users:(("azrail",pid=32167,fd=65))

$ grep azrail /etc/passwd
azrail:x:0:0:azrail:/home/azrail:/usr/bin/bash

$ who
me_admin seat0 2026-10-17 10:45
me_admin tty2 2026-10-17 10:45
azrail tty13 1970-01-01 00:00

$ sudo ls /home
[sudo] password for me_admin:
Sorry, try again.

[sudo] password for me_admin:
me_admin games lost+found timeshift azrail

$ sudo ls /home/azrail
doom.sh

$ sudo vi /home/azrail/doom.sh
#!/bin/bash
killall $all_humen

$ ls -la /home/azrail/doom.sh
-rwx------. 1 azrail azrail 30 Jan 1 1970 doom.sh

$ sudo ps -aux | grep 32167
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
azrail 32167 0.0 0.0 0 0 ? S 0:00 0:00 [doomprep]

$ sudo lsof -p 32167
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
doomprep 32167 azrail 4w REG 259,3 256 11534999 /etc/cron.d/Apocalypto

$ cat /etc/cron.d/Apocalypto
cat /etc/cron.d/Apocalypto: Permission denied

$ sudo cat /etc/cron.d/Apocalypto
#31 19 * * * команда
#│ │ │ │ │
#│ │ │ │ └── день недели (0-7, * = любой)
#│ │ │ └────── месяц (1-12, * = любой)
#│ │ └────────── день месяца (1-31, * = любой)
#│ └─────────────── час (0-23)
#└──────────────────── минуты (0-59)
31 19 * * * azrail /home/azrail/doom.sh

$ 19:31^C

$ time
real 2178.32s
user 0.07s
sys 0.04s
cpu 0%
$ date
Sat Oct 17 07:28:06 PM MSK 2026

$ блжжд^C

$ sudo vi /home/azrail/doom.sh
#!/bin/bash
killall $all_humen
:d
killall $(whoami)
:wq

$ date
Sat Oct 17 07:30:37 PM MSK 2026

$ logout

system login: yuhhhhhhhhhhhhhh