#if 0 shc Version 3.8.6, Generic Script Compiler Copyright (c) 1994-2006 Francisco Rosales ./shc -v -f match #endif static char data [] = #define tst2_z 19 #define tst2 ((&data[2])) "\152\176\033\253\256\070\121\210\306\073\171\047\125\046\257\045" "\121\071\220\202\021\265\075\130\010" #define opts_z 1 #define opts ((&data[25])) "\016" #define date_z 4 #define date ((time_t*)(&data[28])) "\207\314\143\216\017\162\126" #define shll_z 8 #define shll ((&data[33])) "\125\310\036\166\063\165\063\035\245\267" #define lsto_z 1 #define lsto ((&data[43])) "\231" #define inlo_z 3 #define inlo ((&data[44])) "\265\213\023" #define chk2_z 19 #define chk2 ((&data[49])) "\143\136\260\030\244\161\352\175\170\324\213\200\036\117\356\051" "\325\050\163\137\005\015\342\024" #define xecc_z 15 #define xecc ((&data[71])) "\335\156\116\177\272\265\142\315\211\222\064\300\135\352\307" #define pswd_z 256 #define pswd ((&data[116])) "\100\153\346\310\067\074\006\100\365\253\367\137\060\216\250\003" "\103\237\201\346\003\337\364\345\364\077\040\021\120\230\364\053" "\216\125\316\224\334\201\362\011\205\032\256\217\112\260\230\157" "\011\261\260\211\253\204\107\323\116\262\365\064\373\352\137\211" "\077\056\036\034\260\020\046\065\053\324\305\166\205\135\345\217" "\016\226\030\272\032\137\215\151\022\202\236\015\154\375\227\254" "\054\266\310\334\307\356\022\362\303\327\150\110\065\116\330\103" "\344\360\376\377\120\213\151\143\016\007\161\173\005\011\050\061" "\277\360\016\206\337\040\171\242\370\342\353\055\060\303\161\025" "\264\157\025\005\373\176\150\012\205\332\205\213\343\255\275\243" "\236\313\052\175\354\243\040\344\206\013\021\267\317\202\314\203" "\361\342\211\355\140\361\367\346\314\174\161\257\052\057\122\311" "\372\175\107\346\041\147\312\247\163\333\136\103\136\053\306\120" "\015\120\075\156\102\064\124\016\261\306\275\334\365\020\245\360" "\215\354\326\256\124\241\126\307\175\265\012\333\341\321\054\356" "\042\151\135\144\236\261\162\117\170\057\053\155\100\321\135\316" "\275\064\174\022\325\323\331\122\210\344\056\151\266\132\130\330" "\304\265\074\142\147\256\261\337\336\335\115\037\256\253\145\220" "\004\113\131\073\210\137\174\175\012\164\335\072\002\205\075\106" "\045\276\054" #define tst1_z 22 #define tst1 ((&data[396])) "\016\222\140\070\016\103\215\310\206\271\342\152\344\103\346\363" "\100\255\054\315\024\341\217\303\264" #define chk1_z 22 #define chk1 ((&data[421])) "\307\011\100\307\015\041\216\345\373\306\214\113\101\247\077\146" "\224\337\264\223\333\106\324\055\316\313\124\232\007" #define text_z 337 #define text ((&data[529])) "\132\003\370\070\075\372\276\173\100\343\072\155\014\331\216\032" "\154\356\111\020\236\020\031\337\333\156\171\343\113\162\147\246" "\166\137\336\264\132\235\057\233\200\152\010\215\103\227\247\257" "\206\360\277\045\001\330\004\334\107\176\300\222\361\047\071\150" "\207\030\034\341\265\114\174\066\266\205\303\371\034\153\251\242" "\133\150\124\223\357\302\017\022\173\246\340\203\241\276\334\243" "\134\101\023\141\214\240\346\077\167\162\156\332\033\106\266\370" "\367\070\266\027\040\230\337\302\326\054\312\166\161\075\047\262" "\070\363\345\156\201\016\251\270\325\132\273\053\212\374\012\171" "\170\244\252\175\030\227\104\006\171\170\163\051\122\046\032\356" "\030\210\131\266\326\006\132\137\337\247\241\157\274\241\307\120" "\033\306\114\304\236\004\343\321\161\267\277\075\132\322\227\177" "\253\216\111\313\273\120\215\355\065\031\216\102\155\176\246\277" "\123\007\053\267\232\116\362\343\063\334\143\373\351\160\256\105" "\054\004\312\067\355\331\015\322\200\354\337\075\056\134\120\202" "\175\147\052\353\062\056\253\360\232\332\222\377\007\005\137\212" "\070\000\021\301\156\241\036\162\340\375\126\304\072\231\323\043" "\351\033\227\233\112\354\125\317\226\123\151\311\347\063\034\351" "\065\047\042\351\064\332\055\165\001\242\261\025\370\037\060\046" "\017\014\010\060\030\226\236\010\262\144\060\060\255\263\345\107" "\063\200\314\003\245\065\310\220\352\140\250\141\040\374\044\304" "\060\325\132\310\374\170\302\361\254\050\035\076\046\241\250\262" "\044\357\044\027\262\156\156\052\140\204\122\377\134\256\231\170" "\005\017\255\220\257\215\074\301\205\005\374\211\342\060\345\134" "\231\001\222\266\144\012\322\124\026\232\272\145\056\267\102\306" "\372\172\215\064\233\044\111\173\217\334\127\332\231\366\027\174" "\275\026\272\310\134\101\314\071\211\113\372\033\075\041\125\245" "\251\155\302\212\042\016\007\131\304\215\034\276\251\207\147\114" "\343\320\024\100\022\341\171\233\055\163\267\152\225\014" #define msg1_z 42 #define msg1 ((&data[911])) "\322\312\130\244\273\173\364\242\325\303\076\147\211\117\311\272" "\357\077\223\261\236\142\036\150\337\065\357\034\140\065\071\325" "\160\307\265\266\202\275\336\065\211\364\342\204\235\340\321\366" "\245" #define msg2_z 19 #define msg2 ((&data[958])) "\023\343\206\223\241\026\330\175\362\236\305\117\017\201\122\117" "\253\333\357\010" #define rlax_z 1 #define rlax ((&data[978])) "\054"/* End of data[] */; #define hide_z 4096 #define DEBUGEXEC 0 /* Define as 1 to debug execvp calls */ #define TRACEABLE 0 /* Define as 1 to enable ptrace the executable */ /* rtc.c */ #include #include #include #include #include #include #include #include /* 'Alleged RC4' */ static unsigned char stte[256], indx, jndx, kndx; /* * Reset arc4 stte. */ void stte_0(void) { indx = jndx = kndx = 0; do { stte[indx] = indx; } while (++indx); } /* * Set key. Can be used more than once. */ void key(void * str, int len) { unsigned char tmp, * ptr = (unsigned char *)str; while (len > 0) { do { tmp = stte[indx]; kndx += tmp; kndx += ptr[(int)indx % len]; stte[indx] = stte[kndx]; stte[kndx] = tmp; } while (++indx); ptr += 256; len -= 256; } } /* * Crypt data. */ void arc4(void * str, int len) { unsigned char tmp, * ptr = (unsigned char *)str; while (len > 0) { indx++; tmp = stte[indx]; jndx += tmp; stte[indx] = stte[jndx]; stte[jndx] = tmp; tmp += stte[indx]; *ptr ^= stte[tmp]; ptr++; len--; } } /* End of ARC4 */ /* * Key with file invariants. */ int key_with_file(char * file) { struct stat statf[1]; struct stat control[1]; if (stat(file, statf) < 0) return -1; /* Turn on stable fields */ memset(control, 0, sizeof(control)); control->st_ino = statf->st_ino; control->st_dev = statf->st_dev; control->st_rdev = statf->st_rdev; control->st_uid = statf->st_uid; control->st_gid = statf->st_gid; control->st_size = statf->st_size; control->st_mtime = statf->st_mtime; control->st_ctime = statf->st_ctime; key(control, sizeof(control)); return 0; } #if DEBUGEXEC void debugexec(char * sh11, int argc, char ** argv) { int i; fprintf(stderr, "shll=%s\n", sh11 ? sh11 : ""); fprintf(stderr, "argc=%d\n", argc); if (!argv) { fprintf(stderr, "argv=\n"); } else { for (i = 0; i <= argc ; i++) fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : ""); } } #endif /* DEBUGEXEC */ void rmarg(char ** argv, char * arg) { for (; argv && *argv && *argv != arg; argv++); for (; argv && *argv; argv++) *argv = argv[1]; } int chkenv(int argc) { char buff[512]; unsigned mask, m; int l, a, c; char * string; extern char ** environ; mask = (unsigned)chkenv; mask ^= (unsigned)getpid() * ~mask; sprintf(buff, "x%x", mask); string = getenv(buff); #if DEBUGEXEC fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : ""); #endif l = strlen(buff); if (!string) { /* 1st */ sprintf(&buff[l], "=%u %d", mask, argc); putenv(strdup(buff)); return 0; } c = sscanf(string, "%u %d%c", &m, &a, buff); if (c == 2 && m == mask) { /* 3rd */ rmarg(environ, &string[-l - 1]); return 1 + (argc - a); } return -1; } #if !TRACEABLE #define _LINUX_SOURCE_COMPAT #include #include #include #include #include #include #include #if !defined(PTRACE_ATTACH) && defined(PT_ATTACH) # define PTRACE_ATTACH PT_ATTACH #endif void untraceable(char * argv0) { char proc[80]; int pid, mine; switch(pid = fork()) { case 0: pid = getppid(); /* For problematic SunOS ptrace */ #if defined(__FreeBSD__) sprintf(proc, "/proc/%d/mem", (int)pid); #else sprintf(proc, "/proc/%d/as", (int)pid); #endif close(0); mine = !open(proc, O_RDWR|O_EXCL); if (!mine && errno != EBUSY) mine = !ptrace(PTRACE_ATTACH, pid, 0, 0); if (mine) { kill(pid, SIGCONT); } else { perror(argv0); kill(pid, SIGKILL); } _exit(mine); case -1: break; default: if (pid == waitpid(pid, 0, 0)) return; } perror(argv0); _exit(1); } #endif /* !TRACEABLE */ char * xsh(int argc, char ** argv) { char * scrpt; int ret, i, j; char ** varg; stte_0(); key(pswd, pswd_z); arc4(msg1, msg1_z); arc4(date, date_z); if (date[0] && date[0] 1) ? ret : 0; /* Args numbering correction */ while (i < argc) varg[j++] = argv[i++]; /* Main run-time arguments */ varg[j] = 0; /* NULL terminated array */ #if DEBUGEXEC debugexec(shll, j, varg); #endif execvp(shll, varg); return shll; } int main(int argc, char ** argv) { #if DEBUGEXEC debugexec("main", argc, argv); #endif #if !TRACEABLE untraceable(argv[0]); #endif argv[1] = xsh(argc, argv); fprintf(stderr, "%s%s%s: %s\n", argv[0], errno ? ": " : "", errno ? strerror(errno) : "", argv[1] ? argv[1] : "" ); return 1; }