Wednesday, June 10, 2015

astu command in Linux

ASTU is a fictional command used in Mr.Robot TV series. He use this command to restore the hacked server. The command used in Mr.Robot TV series while fixing server are

At 30:20 minute in Mr.Robot TV series.

eterm##$ locate server WBKUW300PS345672
eterm##$ ps aux | grep root
eterm##$ ps aux | grep root | cpuset
eterm##$ astu trace -pid 344 -cmd
eterm##$ astu -ls ./root/fsociety/ -a
eterm##$ fsociety00.dat

Above commands were used by Elliot to restore the server. Among all the above commands, only ps and locate is a real Unix command. PS command is used to list the running process. According to the series, there was a rootkill running in the server. He use ps command to find out the list of running process under root user. He finds out fsociety00.dat is process that made the downtime of server.

Locate command is used to search file in your filesystem. It searches for files only in the path located in /var/lib/mlocate/mlocate.db database file.


  1. Replies
    1. Of Course grep is a unix command. So does cpuset.

  2. It's not rootkill, it's rootkit.

  3. A decent rootkit would not have shown up in the process list, as the ps command would have been replaced to hide the hacker's activity. I'm guessing fsociety wanted Elliott to find that pid.

    1. Guess you where wrong lol Elliot IS fsociety

  4. This comment has been removed by the author.

  5. This comment has been removed by the author.

  6. The fact rootkill is used instead of rootkit discredits this article entirely.

  7. a good security guy would come with his own toolkit to avoid this kind of ps replacement stuff. anyway you can always scan /proc with a bash script.

  8. atsu could easily be a real unix command we just dont know what it is. Its just an arbitrary unknown program. After all there are commands that have to be unix, lots of them are just there by convention as they are generally useful

  9. Elliot, as the diligent guy he is, would have used trusted binaries on a separate PATH rather than relying on the default ones on a rooted machine.

    I imagine setting a PATH wasn't as exciting and was left out :)

  10. atsu could have been an alias.

  11. It's an alias. He used a shred followed by a rm. Or a custom shred to override hundreds of time the file to make it unrecoverable.