#!/bin/bash # ## set +e set -u # Must be changed as versions go along for the fucking logger to work Panther=`basename "$0"` v="0.4.5.1-midnight (Sneaky-Primal Panther)" : # tee -a /tmp/.panther_log/panther.log # getopts are awesome :) # set is as well while getopts "xplhdv" opt; do case $opt in v) echo "V.: $v)" >&2 #Debugger + Cleanup (0.2) #Purge mode + EEC + logger (0.3) #Hardend the Script with set options #Logger may work now ... eventually #tweaked the ending to ME:3 Level of BS (0.4) #Logger is now on strace base ... #this ought to change #more functionallity was addet #incl show log and cleanup (0.4.5 midnight) exit ;; d) echo echo "............" echo "Debugging On" echo "............" echo sleep 0.1 set -x set -o >&2 ;;& l) # GOD FUCK ... that was hard -,- echo echo ".........." echo "Logging On" echo ".........." echo set -m mkdir -p /tmp/.panther_log/ touch /tmp/.panther_log/panther.log MaxFileSize=2048 ( strace -f -ttt -o /tmp/.panther_log/panther.log -p $$ ) & sleep 0.1 >&2 ;;& x) echo "Accessing Log Files" echo "." sleep 0.3 echo ".." sleep 0.3 echo "..." sleep 0.8 echo "done" sleep 0.7 cat /tmp/.panther_log/panther.log | less clear exit ;; p) echo read -p "Purging Data -- Ctrl+C to abort" rm -fr /tmp/.panther_log/ echo "Done..." >&2 sleep 1 clear exit ;; h) echo echo echo "Experience Enrichment Center" echo "............................" echo echo "Tip#1" echo "^-Try Purging all the Data if hickups start to happen" echo echo "Tip#2" echo "^-The Experience Enrichment Center would like to remind" echo "you that all invoked commands do distract from the original" echo "intended and tested Experience" echo echo "-----------------------------------------------------------" echo "-v brings up Version Number" echo echo "-d enables Debugger" echo echo "-p Purge all created data" echo echo "-l Enables Logging (takes quite a lot longer)" echo echo "-x Show Printed Log" echo >&2 exit ;; \?) echo "Invalid option... try -h for Panther-EEC" >&2 exit ;; esac done ################################Here is all the stuff stored########################### mkdir -p /tmp/.panther_log ################################ACHTUAL HUNTER########################################## read -p "Start Panther-Script-Hunter ? `echo $'\n>'` [yes|no] `echo $'\n>'` " CONT if [ "$CONT" == "n" ]; then echo "Terminating P-S-H" echo #trying to kill all the subshells of the -l flag trap "trap - SIGTERM && kill -- -$$" SIGINT SIGTERM EXIT trap "kill 0" SIGINT SIGTERM EXIT [ -f $$ ] && killall $$ jobs \ | perl -ne 'print "$1\n" if m/^\[(\d+)\][+-]? +Running/;' \ | while read -r ; do kill %"$REPLY" ; done # it reall is a problem sleep 0.5 echo "Bye" exit elif [ "$CONT" == "y" ]; then #Menue with selection -> einfach -> intensiv -> logs -> exit # Store menu options selected by the user INPUT=/tmp/.panther_log/menu.sh.$$ # Storage file for displaying cal and date command output OUTPUT=/tmp/.panther_log/output.sh.$$ #--- TEMP FILES FuR DAS MENu--- # trap and delete temp files trap "rm -f $OUTPUT; rm -f $INPUT; exit" SIGHUP SIGINT SIGTERM EXIT # # Purpose - display output using msgbox # $1 -> set msgbox height # $2 -> set msgbox width # $3 -> set msgbox title # fi function display_output(){ local h=${1-10} # box height default 10 local w=${100-150} # box width default 41 local t=${5-Output} # box title dialog --backtitle "Panther-Script-Hunter" --title "${t}" --clear --msgbox "$(<$OUTPUT)" ${h} $ set +e return 2 } #########################################Functions and Menue-items################################################ # # simple Script Search # function simple_panther(){ #ps auxw | grep [Panther*] | awk '{print"-p " $2}' | xargs strace #^-Nope, Nope ... Fuck Nope sleep 0.5 echo -ne '## (10%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(base" > /tmp/.panther_log/eval-base-report # eval-family find / -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(ss" > /tmp/.panther_log/eval-ss-report find / -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(v" > /tmp/.panther_log/eval-v-report find / -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(gz" > /tmp/.panther_log/eval-gz-report find / -type f -iname "*.php" -print0 | xargs -0 grep -l "PCT4BA6ODSE" > /tmp/.panther_log/PCT4BA6ODSE-report #PCT4BA6ODSE echo -ne '####### (33%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "jaqquuy" > /tmp/.panther_log/thatguy-report #that-guy-function echo -ne '########## (44%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "str_rot13" > /tmp/.panther_log/str_rot13-report #str_rot13 echo -ne '############# (55%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "default_charset" > /tmp/.panther_log/default_charset-report #default_charset echo -ne '############## (66%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "em26LA" > /tmp/.panther_log/em26LA-report #em26LA echo -ne '################# (77%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "back_connect" > /tmp/.panther_log/back_connect-report #back connect echo -ne '################### (85%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "blackhole" > /tmp/.panther_log/blackhole-report #blackhole echo -ne '###################### (90%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "x64e" > /tmp/.panther_log/xcom-report #xcom echo -ne '####################### (93%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "onfr64" > /tmp/.panther_log/onfr64-report #onfr64 echo -ne '######################## (96%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "(unescape(" > /tmp/.panther_log/unescape-report #(unescape( echo -ne '######################### (98%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "o0=" > /tmp/.panther_log/ibb-obb-report #o0= echo -ne '##########################(100%)\r' sleep 0.1 set +e return 2 } #so das war es # # complex Search # function complex_panther(){ mkdir -p /tmp/.panther_log sleep 0.5 find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(base" > /tmp/.panther_log/eval-base-report # eval-family find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(ss" > /tmp/.panther_log/eval-ss-report find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(v" > /tmp/.panther_log/eval-v-report find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(gz" > /tmp/.panther_log/eval-gz-report set +e } #complex ...hja ..bald # # ergebnisse anzeigen lassen # function show_results(){ tail /tmp/.panther_log/* | less set +e } ################################################################################################################## # seti oo loop # while true do ### display main menu ### dialog --backtitle "Panther-Script-Hunter $v" \ --title "[ M A I N - M E N U ]" \ --menu "You can use the UP/DOWN arrow keys, the first \n\ letter of the choice as a hot key, or the \n\ number keys 1-4 to choose an option.\n\ Choose what to DO" 20 100 10 \ Simple-Search "Runs a Search for the most common script-strings" \ Complex-Search "Find all them nasty ones but is Return of the King Special E. length" \ Busted-and-Found "Will show you all that has been found before" \ Exit "Exit to the shell" 2>"${INPUT}" menuitem=$(<"${INPUT}") # make decsion case $menuitem in Simple-Search) simple_panther;; Complex-Search) complex_panther;; Busted-and-Found) show_results;; Exit) break;; esac done echo "C YÂa" sleep 0.5 clear # if temp files found, delete em [ -f $OUTPUT ] && rm -f $OUTPUT [ -f $INPUT ] && rm -f $INPUT #killall -TERM -$Panther* kill 0 trap "kill 0" SIGINT SIGTERM EXIT jobs \ | perl -ne 'print "$1\n" if m/^\[(\d+)\][+-]? +Running/;' \ | while read -r ; do kill %"$REPLY" ; done