ysf

# download, from_repo, and commit_state methods swiped from 
# http://github.com/Sutto/rails-template/blob/07b044072f3fb0b40aea27b713ca61515250f5ec/rails_template.rb

require 'open-uri'
 
def download(from, to = from.split("/").last)
  #run "curl -s -L #{from} > #{to}"
  file to, open(from).read
rescue
  puts "Can't get #{from} - Internet down?"

ysf

set :application, "application_name"                                 
set :rails_env, 'production'                                # only needed for migrations

set :user, "webXX"                                          
role :web, "serverX.domaincamp.de"                          # Your HTTP server, Apache/etc
role :app, "serverX.domaincamp.de"                          # This may be the same as your `Web` server
role :db,  "serverX.domaincamp.de", :primary => true        # This is where Rails migrations will run

set :scm, :git
set :repository,  "git@yourgithost.tld:username/project/project.git"

ysf

# Copyright © 2010-2011 Tech-Angels. All Rights Reserved.

# CollectorTransaction will be created each time the Collector needs
# to trace an activity.
#
# Attributes:
# * id [integer, primary, not null] - primary key
# * before_tr [binary] - associated model serialized before transaction
# * created_at [datetime] - creation time
# * model_id [integer] - belongs_to Model (polymorphic)

ysf

#!/usr/bin/env python

# hack to provide a repeat statement in reply to: https://gist.github.com/ychaouche/f30d5e07012454fff0d2

import inspect


def repeat(count):
    if not hasattr(repeat, "loops"):
        repeat.loops = {}

ysf

Keybase proof

I hereby claim:

• I am ysf on github.
• I am ysf (https://keybase.io/ysf) on keybase.
• I have a public key whose fingerprint is C164 E108 8854 3B27 F961 6703 9DDA 5F79 EFE3 EBDF

To claim this, I am signing this object:

ysf

# source from .bashrc for lazy pipe grep magic

command_not_found_handle () 
{ 
  # only run within an input pipe
  if [[ -p /dev/stdin ]]; then 
    grep -- "$*"
    return $?
  fi

ysf

from datetime import datetime
from time import sleep

from dnslib import DNSLabel, QTYPE, RD, RR
from dnslib import A, AAAA, CNAME, MX, NS, SOA, TXT
from dnslib.server import DNSServer

EPOCH = datetime(1970, 1, 1)
SERIAL = int((datetime.utcnow() - EPOCH).total_seconds())

ysf

.text

.global _start

_start:
	
	# setresuid() syscall
	# Narnia FIX: Bash drop the setuid bit if EUID != RUID
	# I need to call setresuid() to set a different RUID
	xor %eax, %eax		# Cleaning syscall number

ysf

#!/usr/bin/env python3
"""
ChaCha20 string decoder for validator.malware strings

    python3 decode.py validator.malware
    python3 decode.py validator.malware --json > strings.json
    python3 decode.py validator.malware --keys

at launch the malware decrypts all strings at once. each string has its own
ChaCha20 key and nonce. I found 4 tables of 154 entries in .rodata with ciphertext:

ysf

validator.malware

ELF64 x86-64 PIE, stripped, 43,640 bytes sha256 2d25d2ea313767fae5808164224cf6ad610ab09546d1e5a6f033eedbfd98a281

first-stage loader that installs itself, builds its own tor transport, fetches stage 2 from an .onion, runs it, then goes inactive.

it contains 154 ChaCha20 encrypted strings, see https://gist.github.com/ysf/c1b8cc85f4063367fddb85c443589f5b

first it checks: