#!/bin/bash # ## #Done -> Menue personalisation | softlink /var.../siewar9wirwarn9.de | EEC | test -z and if statements | made .panther history #TODO -> Make then search in /var | grep -v "blowfish on xcom string" | ausbauen der Suchfunktion | kleines ps auxfffwww widget grep mail http | umformen der find funktion exec anstatt xargs | Enter und ctrl c am anfang keinen fehler produzieren lassen | intro uberspringen | langsamer logo aufbau mit echo |make it not search for itself set +e set -u # Must be changed as versions go along for the fucking logger to work Panther=`basename "$0"` v="0.5.9 (Semi-Hidden Matrix Panther)" # "getopts" are awesome :) # "set" is as well while getopts "xplhdv" opt; do case $opt in v) echo "V.: $v" >&2 #Debugger + Cleanup (0.2) #Purge mode + EEC + logger (0.3) #Hardend the Script with set options #Logger may work now ... eventually #tweaked the ending to ME:3 Level of BS (0.4) #Logger is now on strace base ... #this ought to change #more functionallity was addet #incl show log and cleanup (0.4.5 midnight) #added TODO at the top #made a cronjob to back up files /ext/ (0.4.5 daylight) #Cleaned minor Bugs out with a spray #I am Going Higher Tonight |tweaked EEC (0.5) #Tweaked much from Toms suggestions: #removed the .panther_log hidden dir in #tmp to please the script lords (0.5.5) #Matrix Screensaver by circut static #Cleaned up furthermore (0.5.9) exit ;; d) echo echo "............" echo "Debugging On" echo "............" echo sleep 0.1 set -x set -v set -o >&2 ;;& l) # GOD FUCK ... that was hard -,- echo echo ".........." echo "Logging On" echo ".........." echo set -m if [ -f /tmp/panther_log/ ] #Just ... why ? then echo "the dir needn't be created because it exists" else echo "the dir does not exist so it will be created" mkdir -p /tmp/panther_log/ fi #test -z /tmp/panther_log/panther.log #touch /tmp/panther_log/panther.log #DON'T NEED IT CC #MaxFileSize ( strace -f -ttt -o /tmp/panther_log/panther.log -p $$ ) & sleep 0.1 >&2 ;;& x) echo "Accessing Log Files" echo "." sleep 0.3 echo ".." sleep 0.3 echo "..." sleep 0.8 echo "done" sleep 0.7 cat /tmp/panther_log/panther.log | less clear exit ;; p) echo read -p "Purging Data -- Ctrl+C to abort" rm -fr /tmp/panther_log/ echo "Done..." >&2 sleep 1 clear exit ;; h) echo echo ".............................." echo ":Experience Enrichment Center:" echo ".............................." echo echo "DISCLAMER:" echo "The Panther-Script-Hunter Suit $v is a simple but handsome" echo "solution written in Bash (#!/bin/bash) for finding," echo "only finding(!), nasty scripts." echo echo "This Script will consume a good amout of CPU, IO and RAM" echo "resources as well as take all your cookies." echo "This is a necessary and fully intended side effect." echo echo "----------------------------------------------------------------------" echo "- -" echo "- The Panther Experience Enrichment Center would like -" echo "- to offer these valuable and extensively tested Tips: -" echo "- -" echo "-.......... -" echo "-:sidenote: no shells where harmed during those tests -" echo "-.......... not even those who got killed -" echo "- -" echo "----------------------------------------------------------------------" echo echo "Tip#1" echo "^" echo "^- Don't Panic !" echo echo "Tip#2" echo "^" echo "^- Try Purging all the Data if hickups start to happen (-p option)." echo echo "Tip#3" echo "^" echo "^- The Experience Enrichment Center would like to remind you" echo " that all invoked commands do distract from the originaly" echo " intended and tested Experience." echo echo "Tip#4" echo "^" echo "^- In the Matrix, use the return key for ultimate Benchmark" echo echo "----------------------------------------------------------------------" echo "----------------------------------------------------------------------" echo echo "-v brings up Version Number" echo echo "-d enables Debugger (uses set -x wich i hope someone got fired over)" echo echo "-p Purge all created data" echo echo "-l Enables Logging (takes quite a bit lot longer)" echo echo "-x Show Printed Log" echo >&2 exit ;; \?) echo "Invalid option... try -h for Panther-EEC" >&2 exit ;; esac done ################################Here is all the stuff stored########################### mkdir -p /tmp/panther_log/ ################################ACHTUAL HUNTER########################################## read -p "Start Panther-Script-Hunter ? `echo $'\n>'` [yes|no] `echo $'\n>'` " CONT if [ "$CONT" == "n" ]; then echo "Terminating P-S-H" echo #trying to kill all the subshells of the -l flag trap "trap - SIGTERM && kill -- -$$" SIGINT SIGTERM EXIT trap "kill 0" SIGINT SIGTERM EXIT [ -f $$ ] && killall $$ jobs \ | perl -ne 'print "$1\n" if m/^\[(\d+)\][+-]? +Running/;' \ | while read -r ; do kill %"$REPLY" ; done # it reall is a problem sleep 0.5 echo "Bye" exit elif [ "$CONT" == "y" ]; then clear sleep 0.2 # Logo echo -e '\E[1;31;40m'" ..,co88oc.oo8888cc,.. o8o. ..,o8889689ooo888o#88888888oooc.. .88888 .o888896888#.88888888o'?888888888889ooo.... a888P ..c6888969##..,#o888888888o.?8888888888##.ooo8888oo. 088P ..atc88889##.,oo8o.86888888888o 88988889#,o888888888888. 888t ...coo688889#'.ooo88o88b.'86988988889 8688888'o8888896989^888o 888888888888#..ooo888968888888 #9o688888' '888988 8888868888'o88888 ##G8889##'ooo8888888888888898 .d8o9889##' #8688o.#88888988#o888888o . o8888''''''''''''' o868'' 88868. 888888.6898888##o8o. 88888o. '8888ooo. '8888. 88888.8898888o#888o. '888888' '888888' '''8o'8888.8869888oo8888o . . :.:::::::::::.: . . :.::::::::.: . . : ::.:.'8888 '888888888888o 01010000 01100001 01101110 01110100 01101000 :..8888,. '8888888x888. 01100101 01110010 00101101 01010011 .:o888.o8o. '866o9888o :888.o8888. '88.'89'. 01100011 01110010 01101001 01110000 01110100 00101101 . 89 888888 '88':. 01001000 01110101 01101110 :. '8888o ___ ____ _ _ ___ _ _ ____ ____ . '8888o. |__] |__| |\ | | |__| |___ |__/ 01110100 01100101 888888o. | | | | \| | | | |___ | \ 01100101 '888889, 01110010 . : :.:::::::.: :. '' ' ____ ____ ____ _ ___ ___ _ _ _ _ _ _ ___ ____ ____ [__ | |__/ | |__] | __ |__| | | |\ | | |___ |__/ ($v) ___] |___ | \ | | | | | |__| | \| | |___ | \ "; tput sgr0 sleep 2 #echo -e '\E[1;31;40m' " # # ___ ____ _ _ ___ _ _ ____ ____ ____ ____ ____ _ ___ ___ _ _ _ _ _ _ ___ ____ ____ # |__] |__| |\ | | |__| |___ |__/ __ [__ | |__/ | |__] | __ |__| | | |\ | | |___ |__/ # | | | | \| | | | |___ | \ ___] |___ | \ | | | | | |__| | \| | |___ | \ # "; tput sgr0 echo -ne '##### (33%)\r' sleep 1 echo -ne '############# (66%)\r' sleep 1 echo -ne '####################### (100%)\r' echo -ne '\n' #Menue with selection -> einfach -> intensiv -> logs -> exit # Store menu options selected by the user INPUT=/tmp/panther_log/menu.sh.$$ # Storage file for displaying cal and date command output OUTPUT=/tmp/panther_log/output.sh.$$ #--- TEMP FILES FuR DAS MENu--- # trap and delete temp files trap "rm -f $OUTPUT; rm -f $INPUT; exit" SIGHUP SIGINT SIGTERM EXIT # # Purpose - display output using msgbox # $1 -> set msgbox height # $2 -> set msgbox width # $3 -> set msgbox title # fi function display_output(){ local h=${1-10} # box height default 10 local w=${100-150} # box width default 41 local t=${5-Output} # box title dialog --backtitle "Panther-Script-Hunter" --title "${t}" --clear --msgbox "$(<$OUTPUT)" ${h} $ set +e return 2 } #########################################Functions and Menue-items################################################ # # simple Script Search # function simple_panther(){ #ps auxw | grep [Panther*] | awk '{print"-p " $2}' | xargs strace #^-Nope, Nope ... Fuck Nope sleep 0.5 echo -ne '## (10%)\r' sleep 0.1 find /var -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(base" > /tmp/panther_log/eval-base-report # eval-family find /var -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(ss" > /tmp/panther_log/eval-ss-report find /var -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(v" > /tmp/panther_log/eval-v-report echo -ne '#### (21%)\r' find / -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(gz" > /tmp/panther_log/eval-gz-report find / -type f -iname "*.php" -print0 | xargs -0 grep -l "PCT4BA6ODSE" > /tmp/panther_log/PCT4BA6ODSE-report #PCT4BA6ODSE echo -ne '####### (33%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "jaqquuy" > /tmp/panther_log/thatguy-report #that-guy-function echo -ne '########## (44%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "str_rot13" > /tmp/panther_log/str_rot13-report #str_rot13 echo -ne '############# (55%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "default_charset" > /tmp/panther_log/default_charset-report #default_charset echo -ne '############## (66%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "em26LA" > /tmp/panther_log/em26LA-report #em26LA echo -ne '################# (77%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "back_connect" > /tmp/panther_log/back_connect-report #back connect echo -ne '################### (85%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "blackhole" > /tmp/panther_log/blackhole-report #blackhole echo -ne '###################### (90%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "x64e" > /tmp/panther_log/xcom-report #xcom echo -ne '####################### (93%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "onfr64" > /tmp/panther_log/onfr64-report #onfr64 echo -ne '######################## (96%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "(unescape(" > /tmp/panther_log/unescape-report #(unescape( echo -ne '######################### (98%)\r' sleep 0.1 find / -type f -iname "*.php" -print0 | xargs -0 grep -l "o0=" > /tmp/panther_log/ibb-obb-report #o0= echo -ne '##########################(100%)\r' sleep 0.1 set +e #for Butt-Stallion Lvl. of Stable'ness return 2 } #so das war es # # complex Search # function complex_panther(){ mkdir -p /tmp/panther_log sleep 0.5 find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(base" > /tmp/panther_log/eval-base-report # eval-family find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(ss" > /tmp/panther_log/eval-ss-report find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(v" > /tmp/panther_log/eval-v-report find -type f -iname "*.php" -print0 | xargs -0 grep -l "eval(gz" > /tmp/panther_log/eval-gz-report set +e } #complex ...hja ..bald # # ergebnisse anzeigen lassen # function show_results(){ tail /tmp/panther_log/* | grep -v ".log" | less set +e } function matrix(){ # Welcome to the Matrix Bash terminal # Author: Circuit Static ### Customization: blue="\033[0;34m" brightblue="\033[1;34m" cyan="\033[0;36m" brightcyan="\033[1;36m" green="\033[0;32m" brightgreen="\033[1;32m" red="\033[0;31m" brightred="\033[1;31m" white="\033[1;37m" black="\033[0;30m" grey="\033[0;37m" darkgrey="\033[1;30m" # Choose the colors that will be used from the above list # space-separated list # e.g. `colors=($green $brightgreen $darkgrey $white)` colors=($green $brightgreen $cyan $brightcyan) ### End customization ### Do not edit below this line spacing=${1:-100} # the likelihood of a character being left in place scroll=${2:-0} # 0 for static, positive integer determines scroll speed screenlines=$(expr `tput lines` - 1 + $scroll) screencols=$(expr `tput cols` / 2 - 1) # chars=(a b c d e f g h i j k l m n o p q r s t u v w x y z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 ^) # charset via Carl: chars=(ｱ ｲ ｳ ｴ ｵ ｶ ｷ ｸ ｹ ｺ ｻ ｼ ｽ ｾ ｿ ﾀ ﾁ ﾂ ﾃ ﾄ ﾅ ﾆ ﾇ ﾈ ﾉ ﾊ ﾋ ﾌ ﾍ ﾎ ﾏ ﾐ ﾑ ﾒ ﾓ ﾔ ﾕ ﾖ ﾗ ﾘ ﾙ ﾚ ﾛ ﾜ ヲ ﾝ) count=${#chars[@]} colorcount=${#colors[@]} trap "tput sgr0; clear; exit;;" SIGTERM SIGINT #exit entfernt... schlechte idee ... clear tput cup 0 0 while : do for i in $(eval echo {1..$screenlines}) do for i in $(eval echo {1..$screencols}) do rand=$(($RANDOM%$spacing)) case $rand in 0) printf "${colors[$RANDOM%$colorcount]}${chars[$RANDOM%$count]} " ;; 1) printf " " ;; *) printf "\033[2C" ;; esac done printf "\n" sleep .005 done tput cup 0 0 done set +e } ################################################################################################################## # seti oo loop # while true do ### display main menu ### dialog --backtitle "Panther-Script-Hunter $v" \ --title "[ M A I N - M E N U ]" \ --menu "You can use the UP/DOWN arrow keys or the first \n\ letter of the choice as a hot key \n\ Enrichment !.\n\ Choose what to DO" 20 100 10 \ Simple-Search "Runs a Search for the most common script-strings" \ Complex-Search "Find all them nasty ones but is Return of the King Special E. length" \ Busted-and-Found "Will show you all that has been found before" \ Matrix-Screensaver "Maximize Enrichment with Circut Static's Matrix Screensaver" \ Exit "Exit to the shell" 2>"${INPUT}" menuitem=$(<"${INPUT}") # make decsion case $menuitem in Simple-Search) simple_panther;; Complex-Search) complex_panther;; Busted-and-Found) show_results;; Matrix-Screensaver) matrix;; Exit) break;; esac done echo "C Ya" sleep 0.5 clear # if temp files found, delete em [ -f $OUTPUT ] && rm -f $OUTPUT [ -f $INPUT ] && rm -f $INPUT killall -TERM -$Panther* trap "kill 0" SIGINT SIGTERM EXIT jobs \ | perl -ne 'print "$1\n" if m/^\[(\d+)\][+-]? +Running/;' \ | while read -r ; do kill %"$REPLY" ; done