Fabio Ros frosit

Keybase proof

I hereby claim:

I am frosit on github.
I am frosit (https://keybase.io/frosit) on keybase.
I have a public key ASDXR1Sio-N5zSrIe715CSYTJqsNRoUQatcnDmclTmxp2go

To claim this, I am signing this object:

Commands for hypernode

Quick note on command options

Due to the earlier analysis phase of this set. There are some option embedded which are redundant to some commands. These options will show available, but won't do anything at some newer commands. They are mostly available to analysis and benchmark commands.

Sometimes redundant options

--save (sometimes generates a HTML report)

Finding infected files with following bash commands

** Command to list all infected files:

grep -lr --include=*.php "eval(base64_decode" /path/to/webroot
grep -lr --include=*.php "eval" .
grep -lr --include=*.php "base64" .

Command to remove malicious code:

grep -lr --include=*.php "eval(base64_decode" /path/to/webroot | xargs sed -i.bak 's/<?php eval(base64_decode[^;]*;/<?php\n/g'

	#!/bin/bash

	# ----------------------------------------------------------------------------
	# "THE BEER-WARE LICENSE" (Revision 42):
	# <[email protected]> wrote this file. As long as you retain this notice you
	# can do whatever you want with this stuff. If we meet some day, and you think
	# this stuff is worth it, you can buy me a beer in return Blagovest Petrov
	# ----------------------------------------------------------------------------
	# The script fixes the "no iKVM64 in java.library.path" bug with the SuperMicro
	# iKVM Java S**t. You can do an alias of it, like: "alias javaws=/usr/local/bin/launchikvm"

	#!/usr/bin/env bash
	# == Minify JS/CSS/PNG Files (requires dependency's) ==
	# =================== POC =============================

	# == Variables
	BINDIR=$(dirname $0)
	PROJECTDIR=$(realpath "${BINDIR}/..")
	export Red='\033[0;31m' # Red
	export Green='\033[0;32m' # Green
	export Yellow='\033[0;33m' # Yellow

	#!/usr/bin/env php
	<?php
	/**
	* Hash Tool
	* =========
	*
	* Small helper script to PHP's hash functions.
	*
	* @author Fabio Ros
	*

	# Magento 1 Universal ignore V:1 ~ FROSIT.nl
	# Project: ...

	# IDE&OS files
	.DS_*
	*.swp
	*.lock
	__MACOSX
	.idea
	/nbproject/*

	<?php
	/**
	* == MageLock ==
	*
	* ~ Shows your Magento indexes' lock status.
	*
	* @description This file shows your index statuses and was meant to show when lock's became active or inactive.
	* @warning DO NOT LEAVE THIS FILE ON PRODUCTION
	* @note it requires the user to be logged in the backend for output to show, however this is not sufficient for proper security
	*

	#!/bin/bash
	# Backup all databases

	USER="XXX"
	PASSWORD="XXX"
	HOST="XXX"
	now="$(date +'%d-%m-%Y')"
	DATABASES=`mysql -u ${USER} -p${PASSWORD} -h ${HOST} -e "SHOW DATABASES;" \| tr -d "\| " \| grep -v Database`

	for db in ${DATABASES}; do

	<?xml version="1.0"?>
	<layout>
	<default>
	<action method="removeItem">
	<type>skin_js</type>
	<name>js/slideshow.js</name>
	</action>
	<action method="addStylesheet">
	<type>skin_css</type>
	<name>css/custom.css</name>