PK œqhYî¶J‚ßF ßF ) nhhjz3kjnjjwmknjzzqznjzmm1kzmjrmz4qmm.itm/*\U8ewW087XJD%onwUMbJa]Y2zT?AoLMavr%5P*/
Dir : /proc/thread-self/root/proc/self/root/proc/self/root/opt/sharedrads/oldrads/extras/ |
Server: Linux ngx353.inmotionhosting.com 4.18.0-553.22.1.lve.1.el8.x86_64 #1 SMP Tue Oct 8 15:52:54 UTC 2024 x86_64 IP: 209.182.202.254 |
Dir : //proc/thread-self/root/proc/self/root/proc/self/root/opt/sharedrads/oldrads/extras/hashscanner.sh |
#!/bin/bash IFS=" " right_now=`date +%s` if [ "$1" != "--api" ]; then echo echo "[*] Please wait while I scan /home (this can take a few minutes)..." echo fi if [ "$1" == "--biginodes" ]; then #lets get a list of directories in public_html with huge inode counts ls /home/*/public_html -l | egrep -v 'images|attachments|cache' | awk '$1 ~ /^drwx*/ && $5 >50000{print}' | sort -nk5 > /opt/sharedrads/hashscanner/diskspace.check echo > /opt/sharedrads/hashscanner/hashbiginodedirs.log exit 0 fi if [ "$1" == "--oldprofile" ]; then #we'll be using the old detection method, which we haven't seen in some time oldprofile=1 else oldprofile=0 fi if [ "$1" == "--clean" ]; then clean=1 else clean=0 fi nice -n 19 locate --regex "[0-9a-f]{32}$" | #find all files that end in an md5 hash sed 's/\/[0-9a-f]*$//' | #if the whole file name is an md5, strip it and the folder's trailing / uniq -c | #no need to sort, locate does that for us awk '$1 > 100 {print $2}' | #if there is more than 100 md5s in this folder, it's probably the hack (more checks later) xargs stat 2>/dev/null | #make sure it still exists grep "File:" | awk '{print $2}' | egrep -v 'cache|image|cookies|download_records|wpmp_transcoder|3delight|digita39|nwined5|oracle12|gomojo5|outwor5|bkcrco5|admin/upload|catalog' | sed -e 's/^.//' -e 's/.$//' > /opt/sharedrads/hashscanner/hashfolders.log #get the folder name from stat's output (only files that exist will have "File:" if [ $oldprofile -eq 0 ]; then for i in `cat /opt/sharedrads/hashscanner/hashfolders.log`; # take the list generated above do dir=$(dirname $i); #get the parent folder path hashmaker=`nice -n 19 find $dir -maxdepth 1 -iname '*.php' -type f -exec egrep -l "arxefylmiu.ru|ketjxynfpm.ru" '{}' \;;` #grab the php file in the same folder echo "$hashmaker" if [ `echo "$hashmaker"|grep -c "php"` -gt 0 -a $clean -gt 0 ]; then rm -f $hashmaker find $i -type f -exec rm -f {} \; -exec usleep 20000 \; rm -rf $i fi done > /opt/sharedrads/hashscanner/hashmakers.log #check size to see if it's in our target range and keep it if it is accts=`awk -F / '{print $3}' /opt/sharedrads/hashscanner/hashfolders.log | sort | uniq | wc -l` folders=`wc -l /opt/sharedrads/hashscanner/hashfolders.log|awk '{print $1}'` else for i in `cat /opt/sharedrads/hashscanner/hashfolders.log`; # take the list generated above do dir=$(dirname $i); #get the parent folder path nice -n 19 chown root.root $i; nice -n 19 chmod 000 $i; #nice chowning nice -n 19 find $dir -maxdepth 1 -iname '*.php' -type f -exec wc -l '{}' \;; #grab all php files in the same folder and count their lines done | awk '$1 == 0 {print $2}' | #if there are no newlines (one indicator) xargs ls -l | awk '($5 > 25000) && ($5 < 35000) { print $NF }' > /opt/sharedrads/hashscanner/hashmakers.log #check size to see if it's in our target range and keep it if it is for i in `cat /opt/sharedrads/hashscanner/hashmakers.log | grep home`; do nice -n 19 chown root.root $i; nice -n 19 chmod 000 $i; done #chown the files we found accts=`awk -F / '{print $3}' /opt/sharedrads/hashscanner/hashfolders.log | sort | uniq | wc -l` folders=`wc -l /opt/sharedrads/hashscanner/hashfolders.log|awk '{print $1}'` fi if [ "$accts" -gt "0" ]; then peracct=`echo "print $folders.0/$accts.0" | python` echo echo "==================== `hostname -s` hashmaker scan/clean ====================" echo "Accounts affected: $accts" echo "Folders per account: $peracct" echo "Total folders: $folders" echo echo "List of hashmakers I disabled (set to chmod 0 and root:root):" echo cat /opt/sharedrads/hashscanner/hashmakers.log echo echo "The related target directories that need careful removal:" cat /opt/sharedrads/hashscanner/hashfolders.log echo fi if [ "$1" != "--api" ]; then if [ "$accts" -lt "1" ]; then echo echo "[*] Completed. No hash hacks were found. YAY!" echo else echo echo "[*] Completed. All results are above." echo fi fi