Skip to content

Instantly share code, notes, and snippets.

@duzvik

duzvik/check_Exaramel.sh

Created February 16, 2021 13:00
Show Gist options
  • Save duzvik/466395826b209565f9464b6534e75c3d to your computer and use it in GitHub Desktop.
Save duzvik/466395826b209565f9464b6534e75c3d to your computer and use it in GitHub Desktop.
Download ZIP
Raw
check_Exaramel.sh
#!/bin/bash
declare -a arr=(
"/tmp/.applocktx"
"/tmp/.applock"
"/usr/local/centreon/www/search.php"
"/usr/share/centreon/www/search.php"
"/usr/share/centreon/www/modules/Discovery/include/DB−Drop.php"
"/usr/share/centreon/www/htmlHeader.php"
)
clean=true
for i in "${arr[@]}"
do
if [ -e $i ]
then
echo "File $i found. Host Possible infected with Exaramel. Details: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
clean=false
fi
done
if [ "$clean" = true ] ; then
echo 'Host clean'
fi
@duzvik
Copy link
Author

duzvik commented Feb 16, 2021

One liner to run it:
curl -s https://gist.githubusercontent.com/duzvik/466395826b209565f9464b6534e75c3d/raw/26cae7a156e3f03e57bab3e58f68192a72b0cc3f/check_Exaramel.sh | bash

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment