Hello,
So a fun one for you guys tonight.
This guy : xBℓαcΚ is selling backdoored scripts on this thread.
I actually bought his OVHX script to see what it was looking like.
First odd thing, my antivirus detected it, while it never rings the bell for any of the scripts I own. That was awkward. I said it was a false positive, and uploaded it to my "sandbox" server (a 5$ DigitalOcean VPS where I test everything before putting into production). Before running it, I did a "strings" on the file, and, surprise, you'll never guess what I found !
The first thing the script does is this :
![[Image: 3977c58fcbadc46e487301db43d4c41c.png]](https://i.gyazo.com/3977c58fcbadc46e487301db43d4c41c.png)
It loads a shortened link. This shortened link is hiding the URL to a IP-grabbing service (grabify.link), so it grabs the IP of your server when you load it.
It then goes into /etc/passwd and gives permission to a user that hasn't been created yet (it's coming). And it deletes all the log files with "rm -rf /var/log".
Then it does this :
![[Image: 96897796831e5e131f8c48dfd4314274.png]](https://i.gyazo.com/96897796831e5e131f8c48dfd4314274.png)
It actually adds the user that was given permissions above into the Unix password manager.
It's then very easy for this guy to access your server, as he obtained the IP with grabify and added his own credentials into it.
As a broader advice, always strings scripts you found on the internet. You never know what's inside.
Regards
So a fun one for you guys tonight.
This guy : xBℓαcΚ is selling backdoored scripts on this thread.
I actually bought his OVHX script to see what it was looking like.
First odd thing, my antivirus detected it, while it never rings the bell for any of the scripts I own. That was awkward. I said it was a false positive, and uploaded it to my "sandbox" server (a 5$ DigitalOcean VPS where I test everything before putting into production). Before running it, I did a "strings" on the file, and, surprise, you'll never guess what I found !
The first thing the script does is this :
It loads a shortened link. This shortened link is hiding the URL to a IP-grabbing service (grabify.link), so it grabs the IP of your server when you load it.
It then goes into /etc/passwd and gives permission to a user that hasn't been created yet (it's coming). And it deletes all the log files with "rm -rf /var/log".
Then it does this :
It actually adds the user that was given permissions above into the Unix password manager.
It's then very easy for this guy to access your server, as he obtained the IP with grabify and added his own credentials into it.
As a broader advice, always strings scripts you found on the internet. You never know what's inside.
Regards
