Zdravim, dostal sa nam do ruk Mikrotik RB951Ui-2HnD ktory mal starsi firmware a bol mu planovany upgrade na 6.42.3. Po upgrade sa nerozbehol (restart nepomohol), tak sme ho vymenili za novy kus.
Teraz som ho zapol, nabehol v defaulte a vo files mame taktiez jb_cislo_cislo.backup, ale bol tam aj nejaky subor "467", ktoreho obsah je prinajmensom zaujimavy a vyzera, ze nejaka dobra dusa spravila tool na kontrolu, ak nie aj fix.
Vie to nejaky linuxak pozriet ? Nejde mi ju sem prilozit tak posielam obsah.
#!/bin/bash
echo "<< Owari Anti-Virus ( `cat /flash/rw/logs/VERSION` ) >>"
# Sets PPID to the Parent Process ID.
find_ppid () {
PD=`cat /proc/$1/status 2>/dev/null`;
PDL=`expr length "$PD"`;
CNT=1;
while [ $CNT -le $PDL ];do
CS=`expr substr "$PD" $CNT 5`;
if [ "$CS" = "PPid:" ];then
C2=$((CNT+6));
TS=`expr substr "$PD" $C2 5`;
STOP=0;
PPID="";
while [ "$STOP" -lt 1 ];do
NS=`expr substr "$PD" $C2 1`;
if [ "$NS" = "" ];then
STOP=1;
fi;
if [ ! "$NS" = "" ];then
PPID="$PPID$NS";
fi;
C2=$((C2+1));
done;
CNT=99999;
fi;
CNT=$((CNT+1));
done;
}
##### 'FatKid' prevention #####
CF="/tmp/a.txt";
if [ ! -e $CF ];then
echo -n "[ Adding 'FatKid' prevention file: $CF ... ";
echo 1 > /tmp/a.txt
echo "Done ]"
fi
CF="/tmp/stop.txt";
if [ ! -e $CF ];then
echo -n "[ Adding 'FatKid' prevention file: $CF ... ";
echo 1 > /tmp/stop.txt
echo "Done ]"
fi
##### 'FatKid' winbox.idx fix #####
CF="/ram/winbox.idx";
if [ ! -e $CF ];then
echo -n "[ FatKid removed $CF. Fixing ... ";
for i in $(path --postfix .info /home/web/winbox); do cat $i >>/ram/winbox.idx; done
echo "Done ]"
fi
##### PROCESS DETECTION #####
echo "Starting process detection. Stage 1."
for FU in `find /proc/*/comm 2>/dev/null`;do
CL=`cat $FU 2>/dev/null`;
SP=`expr index "$FU" m`;
SP=$((SP-6-4));
PPID=`expr substr "$FU" 7 $SP`;
if [ "$CL" = '.s0x' ];then
echo "[!! Found suspicious PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
if [ "$CL" = '.sox' ];then
echo "[!! Found suspicious PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
if [ "$CL" = 'dropbear' ];then
echo "[!! Found suspicious PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
if [ "$CL" = '.nttpd' ];then
echo "[!! Found suspicious PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
if [ "$CL" = '.dnstest' ];then
echo "[!! Found suspicious PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
if [ "$CL" = '.i' ];then
echo "[!! Found suspicious PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
##### 'FatKid' process detection #####
if [ ! "$PPID" = "self" ];then
CMDL=`cat /proc/$PPID/cmdline 2>/dev/null`;
if [ -n "$CMDL" ];then
CV=`expr "$CMDL" : ".*$CL"`;
if [ $CV -eq 0 ];then
if [ $PPID -gt 256 ];then
echo "[!! Found suspicious PID: $PPID [Cmdline: $CMDL] [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
fi;
fi;
fi;
done;
echo "Starting process detection. Stage 2."
for FU in `find /proc/*/cmdline 2>/dev/null`;do
if [ ! "$FU"=="self" ];then
CL=`cat $FU 2>/dev/null`;
if [ -n "$CL" ];then
CN=`echo -n -e "\x62\x61\x73\x68\x00\x2f\x74\x6d\x70\x2f\x61\x2e\x73\x68\x00"`
if [ "$CL"=="$CN" ];then
SP=`expr index "$FU" e`;
SP=$((SP-8-6));
EVILPID=`expr substr "$FU" 7 $SP`;
if [ ! "$EVILPID" = "self" ];then
if [ $PPID -gt 256 ];then
echo "[!! Found 'FatKid' botnet process running !!] Killing PID: $EVILPID PN: '$CL'";
kill -9 $EVILPID;
fi;
fi;
fi;
CN=`echo -n -e "\x2f\x62\x69\x6e\x2f\x62\x61\x73\x68\x00\x2f\x74\x6d\x70\x2f\x61\x2e\x73\x68\x00"`
if [ "$CL"=="$CN" ];then
SP=`expr index "$FU" e`;
SP=$((SP-8-6));
EVILPID=`expr substr "$FU" 7 $SP`;
if [ ! "$EVILPID" = "self" ];then
if [ $PPID -gt 256 ];then
echo "[!! Found 'FatKid' botnet process running !!] Killing PID: $EVILPID PN: '$CL'";
kill -9 $EVILPID;
fi;
fi;
fi;
fi;
fi;
done;
echo "Starting process detection. Stage 3."
##### Hajime process detection #####
for FU in `find /proc/*/cmdline 2>/dev/null`;do
CL=`cat $FU 2>/dev/null`;
SP=`expr index "$FU" e`;
SP=$((SP-8-6));
PP=`expr substr "$FU" 7 $SP`;
if [ -n "$CL" ];then
# echo "Checking PID: $PP CMDLINE: $CL"
if [ "$CL" = "telnetd " ];then
SP=`expr index "$FU" e`;
SP=$((SP-8-6));
if [ ! "$PP" = "self" ];then
if [ $PP -gt 100 ];then
PPID="";
find_ppid $PP;
echo "[!! Found 'Hajime' botnet process running !!] Killing PID: $PP PPID: $PPID PN: '$CL'";
kill -9 $PP;
fi;
fi;
fi;
if [ "$CL" = "./.telnetd" ];then
SP=`expr index "$FU" e`;
SP=$((SP-8-6));
if [ ! "$PP" = "self" ];then
if [ $PP -gt 100 ];then
find_ppid $PP
echo "[!! Found 'Hajime' botnet process running !!] Killing PID: $PP PPID: $PPID PN: '$CL'";
kill -9 $PP;
fi;
fi;
fi;
fi;
done;
echo "Starting process detection. Stage 4."
for FU in `find /proc/*/comm 2>/dev/null`;do
CL=`cat $FU 2>/dev/null`;
SP=`expr index "$FU" m`;
SP=$((SP-6-4));
PP=`expr substr "$FU" 7 $SP`;
if [ "$CL" = "telnetd" ];then
find_ppid $PP
if [ -n "$PPID" ];then
PN=`cat /proc/$PPID/comm`;
if [ ! "$PN" = "sermgr" ];then
if [ ! "$PN" = "self" ];then
echo "[!! Found fake 'telnetd' running. PID: $PP PPID: $PPID [Comm: $CL] ... Killed";
kill -9 $PP;
fi;
fi;
fi;
fi;
done;
echo "Starting process detection. Stage 5."
for FU in `find /proc/*/comm 2>/dev/null`;do
CL=`cat $FU 2>/dev/null`;
SP=`expr index "$FU" m`;
SP=$((SP-6-4));
PP=`expr substr "$FU" 7 $SP`;
CMDL=`cat /proc/$PPID/comm 2>/dev/null`;
COMM=`cat /proc/$PPID/cmdline 2>/dev/null`;
CV=`expr "$CMDL" : ".*$COMM"`;
CZ=`expr "$COMM" : ".*$CMDL"`;
FS=`expr index "$COMM" "/"`;
if [ -n "$COMM" ];then
if [ "$FS" -eq 0 ];then
if [ ! "$CMDL" = "bash" ];then
if [ ! "$CMDL" = "catlog" ];then
if [ ! "$CMDL" = "usleep" ];then
find_ppid $PP
PN=`cat /proc/$PPID/comm`;
if [ ! "$PN" = "sermgr" ];then
echo "[!! Found suspicious PID: $PP PPID: $PPID PNAME: $PN [Cmdline: $CMDL Comm: $COMM] ... Killed";
kill -9 $PP
fi;
fi;
fi;
fi;
fi;
fi;
done;
echo "Starting file detection."
##### File detection #####
FILES="""/flash/etc/rc.d/run.d/S2up
/flash/etc/rc.d/run.d/S99tr096
/flash/etc/rc.d/run.d/S99telnetd
/flash/etc/rc.d/run.d/S99own
/flash/etc/rc.d/run.d/busybox
/flash/etc/rc.d/run.d/dropbear
/flash/etc/rc.d/run.d/dss
/flash/etc/rc.d/run.d/libpcap.so.1.3
/flash/etc/rc.d/run.d/rsa
/flash/etc/rc.d/run.d/tcpdump
/flash/bin/.telnetd
/flash/bin/fifo
/flash/bin/.p/.d
/flash/bin/.p/.i.mipseb
/flash/bin/.p/.i.mipsel
/flash/bin/.p/.i.arm5
/flash/bin/.p/.i.arm6
/flash/bin/.p/.i.arm7
/flash/bin/.p/atk.mipseb
/flash/bin/.p/atk.mipsel
/flash/bin/.p/atk.arm5
/flash/bin/.p/atk.arm6
/flash/bin/.p/atk.arm7
/flash/bin/echo
/flash/bin/.test
/flash/bin/.dnstest
/flash/rw/pckg/checkupdate
/flash/rw/pckg/fileinfo
/flash/rw/pckg/.p/.i.mipseb
/flash/rw/pckg/.p/atk.mipseb
/flash/rw/pckg/fifo
/tmp/tmp.l
/tmp/.stl
/tmp/.fph
/tmp/.ipt
/tmp/.dns
/tmp/.s0x
/tmp/.sox
/tmp/.nttpd
/tmp/.s0x.ps
/tmp/.nttpd.ps
/tmp/.sox.pid
/tmp/.nttpd.pid
/tmp/update.sh
/tmp/a.sh
/tmp/o.sh
/tmp/zxcvbnm.txt
/tmp/zxcvbnm
/flash/rw/store/wget
/ram/f
"""
FLIST=`echo -e "$FILES"`
for FILE in $FLIST;do
if [ -e "$FILE" ];then
echo -n "[!! Found bad file !!] Removing $FILE ...";
rm -f "$FILE";
test ! -e "$FILE" && echo " Success. :)" || echo " Failed. :("
fi;
done;
echo "Starting directory detection."
##### File detection #####
DIRS="""/flash/bin/.p
/flash/rw/pckg/.p
/flash/rw/pckg/flash
"""
DLIST=`echo -e "$DIRS"`
for DIR in $DLIST;do
if [ -d "$DIR" ];then
echo -n "[!! Found bad directory !!] Removing $DIR ...";
rm -rf "$DIR";
[ ! -d "$DIR" ] && echo " Success. :)" || echo " Failed. :("
fi;
done;
echo "Starting process detection. Stage 6."
LC=0
while [ "$LC" -le 7 ];do
LC=$((LC+1))
FF=0
for FU in `find /proc/*/comm 2>/dev/null`;do
CL=`cat $FU 2>/dev/null`;
SP=`expr index "$FU" m`;
SP=$((SP-6-4));
PPID=`expr substr "$FU" 7 $SP`;
if [ "$CL" = "usleep" ];then
FF=1
echo "[!! Found usleep running. PID: $PPID [Comm: $CL] ... Killed";
kill -9 $PPID;
fi;
done;
if [ $FF -gt 0 ];then
usleep 500000;
fi;
if [ $FF -lt 1 ];then
LC=8;
fi;
done;
rm -f /tmp/owari* 2>/dev/null
rm -f /tmp/listproc.sh 2>/dev/null
echo "Owari Finished."
exit
