mysqldump --all-databases > all_databases.sql
wget https://dev.mysql.com/get/mysql-apt-config_0.8.9-1_all.deb
| #!/bin/bash | |
| NEW_USER=$1 | |
| set -e | |
| if [ -z "$NEW_USER" ];then | |
| echo "Please provide user as arg... exiting." | |
| exit 1 | |
| fi | 
| <?php | |
| // Checking reCAPTCHA | |
| $recaptcha_site_secret = "xxxxx"; | |
| if(isset($_POST) && !empty($_POST)) | |
| { | |
| $captcha_response = filter_input(INPUT_POST, 'g-recaptcha-response', | 
| <?php | |
| function RandomString() | |
| { | |
| $characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; | |
| $randstring = ''; | |
| for ($i = 0; $i < 10; $i++) { | |
| $randstring = $characters[rand(0, strlen($characters))]; | |
| } | 
| #!/usr/bin/env php | |
| <?php | |
| /** | |
| * | |
| * @param type $custom | |
| * @return type | |
| */ | |
| function build_list($custom) | |
| { | |
| $basePath = realpath($custom); | 
| [Unit] | |
| Description=Iwatch trigger | |
| After=network.target | |
| StartLimitIntervalSec=0[Service] | |
| Type=simple | |
| Restart=always | |
| RestartSec=1 | |
| User=ubuntu | |
| ExecStart=/usr/bin/env php /path/to/server.php | 
| <?php | |
| class scramble{ | |
| /** | |
| * | |
| * @return type | |
| */ | |
| public function getRandonPhone($number_limit = 11) | |
| { | 
| <?php | |
| function is_local() { | |
| $url = get_site_url(); | |
| if (preg_match('/local/', $url)) { | |
| return true; | |
| } | |
| return false; | |
| } | 
| <?php | |
| /* | |
| * To change this license header, choose License Headers in Project Properties. | |
| * To change this template file, choose Tools | Templates | |
| * and open the template in the editor. | |
| */ | |
| require_once 'abstract.php'; | |
| class Roddy_Shell_ExportCat extends Mage_Shell_Abstract { | 
| Cut down your network | |
| The trojan has raw file coming from /lib/libudev.so, it will copy and fork again. It will also add cron.hourly job named gcc.sh, then it will add initial script in your /etc/rc*.d (Debian, CentOS may be /etc/rc.d/{init,rc{1,2,3,4,5}}.d) | |
| Use root to run the script below to change the folder privileges: chmod 0000 /lib/libudev.so && rm -rf /lib/libudev.so && chattr +i /lib/ | |
| Delete all /etc/rc{0,1,2,3,4,5,6,S}.d files which were created today, The name looks like S01????????. | |
| Edit your crontab, delete the gcc.sh script in your /etc/cron.hourly, delete the gcc.sh file (/etc/cron.hourly/gcc.sh) then add privileges for your crontab: sed '/gcc.sh/d' /etc/crontab && chmod 0000 /etc/crontab && chattr +i /etc/crontab |