script.sh.x.c

#if 0
	shc Version 4.0.3, Generic Shell Script Compiler
	GNU GPL Version 3 Md Jahidul Hamid <jahidulhamid@yahoo.com>

	shc -f ./script.sh -o ./witd 
#endif

static  char data [] = 
#define      chk2_z	19
#define      chk2	((&data[0]))
	"\346\153\025\141\263\365\044\035\142\065\152\237\260\125\365\171"
	"\103\265\073\323\136\041\173"
#define      lsto_z	1
#define      lsto	((&data[23]))
	"\312"
#define      inlo_z	3
#define      inlo	((&data[24]))
	"\337\155\065"
#define      date_z	1
#define      date	((&data[27]))
	"\271"
#define      xecc_z	15
#define      xecc	((&data[30]))
	"\253\201\000\302\236\054\175\044\357\364\325\220\005\371\352\342"
	"\306\272\011"
#define      shll_z	10
#define      shll	((&data[47]))
	"\120\242\020\303\305\054\204\264\351\215\217\365"
#define      tst1_z	22
#define      tst1	((&data[63]))
	"\260\256\314\207\141\271\113\323\114\164\010\043\056\055\312\225"
	"\064\107\062\162\262\127\126\007\037\051"
#define      chk1_z	22
#define      chk1	((&data[90]))
	"\065\340\123\151\116\041\123\022\114\277\155\221\113\357\145\136"
	"\027\125\351\300\303\055\037\303\377\363\363\042"
#define      pswd_z	256
#define      pswd	((&data[149]))
	"\363\152\375\015\341\365\001\125\362\163\023\247\211\135\127\054"
	"\314\116\266\371\346\332\301\175\164\052\155\262\006\332\047\166"
	"\064\334\231\015\246\225\113\332\031\151\333\113\315\165\271\370"
	"\225\175\111\106\231\337\340\027\070\326\052\216\245\236\056\137"
	"\021\236\005\075\324\306\335\207\141\210\171\265\103\024\250\311"
	"\075\220\017\304\235\065\150\153\211\200\301\245\150\171\077\260"
	"\012\206\124\042\017\025\003\246\126\164\204\046\321\333\317\057"
	"\075\031\167\124\367\225\167\277\340\105\333\276\043\333\303\251"
	"\236\276\261\104\350\207\202\317\304\274\045\221\064\165\103\366"
	"\113\375\101\375\075\247\141\046\013\325\177\133\033\213\235\166"
	"\113\116\053\165\004\053\265\273\116\205\010\267\213\274\362\013"
	"\261\123\164\203\032\024\215\211\343\370\332\352\036\326\370\274"
	"\133\357\321\344\303\162\334\221\273\335\206\210\016\030\053\360"
	"\354\136\163\113\267\012\216\014\026\377\226\047\110\203\126\277"
	"\071\305\334\004\063\276\237\370\151\333\217\342\265\252\104\175"
	"\205\147\271\116\302\253\342\261\363\225\065\075\360\236\014\255"
	"\046\344\233\201\033\264\355\363\334\304\210\310\377\301\246\034"
	"\307\041\060\173\151\221\212\317\156\025\014\247\230\171\034\074"
	"\160\227\242\032\142\313\311\226\201\227\370\250\172\227\261\200"
	"\254\075\067\360\130\104\305\042\276\005\213\303\257\131\245\370"
	"\275\320\254\172\316\147\102\126\116\264\041\061\104\252\204\345"
	"\202\367\332\126\325\175\054\220\042\041\060"
#define      msg2_z	19
#define      msg2	((&data[463]))
	"\036\022\246\064\355\376\113\222\251\102\103\357\240\022\325\264"
	"\335\040\344\046\177\067\125\136\211\234"
#define      msg1_z	65
#define      msg1	((&data[493]))
	"\140\176\120\276\225\176\134\356\220\012\062\100\142\100\144\174"
	"\120\213\020\343\055\304\370\220\103\257\353\313\245\345\057\106"
	"\174\011\225\170\360\033\342\312\274\156\116\155\160\150\204\345"
	"\200\201\134\051\374\253\274\104\227\162\343\167\012\127\154\344"
	"\105\172\251\055\112\352\261\000\311\005\133\062\002\251\051\052"
	"\217\343\173\264\351"
#define      rlax_z	1
#define      rlax	((&data[571]))
	"\270"
#define      opts_z	1
#define      opts	((&data[572]))
	"\054"
#define      text_z	1457
#define      text	((&data[825]))
	"\124\167\316\001\212\124\324\356\064\135\065\266\071\033\331\317"
	"\132\344\335\050\270\017\342\254\166\145\056\367\347\157\167\063"
	"\211\256\107\153\233\311\141\076\301\023\232\137\203\205\366\046"
	"\371\154\324\204\021\226\252\370\225\351\042\275\353\275\011\242"
	"\365\077\045\106\253\333\103\301\316\232\042\352\331\172\112\216"
	"\173\167\370\201\056\060\146\215\014\312\024\321\235\256\041\056"
	"\016\045\263\332\356\312\340\270\350\045\220\141\362\043\076\241"
	"\211\203\244\151\165\306\376\010\260\317\021\152\255\355\371\164"
	"\035\272\334\116\130\073\034\126\264\131\050\342\327\304\005\217"
	"\133\040\321\272\364\136\266\163\040\341\370\167\132\336\245\327"
	"\323\266\152\141\141\357\171\205\272\035\146\051\203\035\013\052"
	"\114\044\236\247\330\214\122\200\204\271\042\116\233\055\210\064"
	"\226\271\322\033\123\210\344\075\363\206\065\076\237\171\036\326"
	"\335\140\075\343\151\323\256\026\066\204\160\243\174\071\237\304"
	"\266\122\171\220\070\227\304\154\054\175\061\267\142\250\324\202"
	"\266\243\244\223\153\033\244\160\273\143\123\207\266\036\254\023"
	"\371\361\335\107\331\217\117\115\130\133\075\227\263\044\151\012"
	"\151\332\200\174\155\163\367\343\051\227\040\252\215\046\372\034"
	"\241\310\001\032\162\333\143\372\104\144\151\264\220\262\271\003"
	"\064\315\047\351\030\332\004\001\006\107\276\361\025\330\256\276"
	"\146\131\077\067\224\120\153\243\335\206\333\155\070\344\041\266"
	"\007\342\356\046\337\306\054\265\274\236\311\057\256\356\124\063"
	"\342\177\335\027\372\004\223\202\141\320\271\144\255\100\111\054"
	"\101\057\162\242\152\005\213\030\261\121\107\051\273\313\274\367"
	"\067\316\211\112\002\300\317\227\253\103\020\240\201\156\322\253"
	"\261\054\026\116\230\256\142\167\310\360\041\152\301\003\124\124"
	"\325\101\276\076\126\265\313\371\370\053\353\177\211\302\367\105"
	"\374\236\210\320\170\123\361\262\001\145\125\274\357\154\240\160"
	"\343\242\025\141\175\357\061\025\304\270\136\237\145\360\122\221"
	"\357\372\215\022\361\177\070\004\333\045\075\226\106\341\300\306"
	"\374\255\304\350\122\315\315\246\370\172\251\112\222\311\245\150"
	"\122\217\063\037\256\004\167\310\227\062\213\236\077\111\031\275"
	"\361\015\216\344\071\234\215\061\126\076\330\143\213\155\006\223"
	"\242\156\315\165\201\322\050\042\367\122\135\311\267\240\000\375"
	"\067\251\100\257\271\274\316\316\120\103\073\031\175\346\064\367"
	"\112\040\011\351\074\271\036\176\050\001\122\146\314\155\100\152"
	"\102\133\135\207\147\052\065\366\127\016\224\346\232\000\167\057"
	"\353\073\136\155\125\105\124\010\232\065\066\034\066\266\302\244"
	"\023\144\303\257\110\216\060\267\270\123\374\046\373\125\055\261"
	"\233\351\155\212\206\165\166\205\124\054\360\203\353\227\162\246"
	"\071\332\171\313\027\120\324\151\253\073\326\360\252\365\227\033"
	"\210\237\167\064\052\127\357\273\050\341\332\326\203\134\306\061"
	"\256\163\176\046\351\325\134\176\233\224\046\071\211\300\304\224"
	"\320\244\354\374\374\151\017\003\113\153\071\371\050\237\253\111"
	"\007\047\220\131\260\116\244\372\152\350\036\040\227\060\365\376"
	"\056\163\157\366\202\352\267\331\072\262\076\155\314\375\002\067"
	"\015\020\305\003\024\330\162\006\110\173\262\344\074\274\305\066"
	"\377\106\051\125\005\057\372\310\125\053\101\204\025\140\152\117"
	"\031\271\113\156\243\151\201\047\242\101\205\105\155\276\244\053"
	"\271\363\100\152\151\075\277\217\035\075\136\243\250\075\012\050"
	"\217\302\126\073\341\375\341\340\270\176\370\271\131\061\317\150"
	"\241\157\130\165\063\321\245\167\360\061\133\340\027\151\157\003"
	"\365\003\063\064\374\003\246\272\233\141\320\175\044\337\126\207"
	"\210\013\050\342\216\316\315\036\231\324\172\236\364\006\121\130"
	"\322\075\341\054\010\101\363\341\314\210\363\261\023\307\166\162"
	"\054\236\362\070\166\171\162\157\122\152\303\202\066\110\021\176"
	"\354\203\071\236\063\047\053\065\013\160\240\016\350\156\200\007"
	"\015\145\014\065\205\202\163\152\204\305\237\107\123\146\355\153"
	"\122\127\046\375\116\320\347\062\145\155\034\270\024\243\343\100"
	"\110\170\355\063\025\321\164\261\036\347\046\352\200\370\074\157"
	"\351\045\016\362\320\146\341\330\131\145\014\215\315\121\256\173"
	"\366\176\261\251\122\136\330\064\164\376\317\025\120\173\360\052"
	"\023\271\107\365\153\331\114\116\144\244\144\371\043\077\064\302"
	"\010\005\352\004\066\246\327\240\066\045\211\114\166\250\260\305"
	"\224\141\172\021\351\013\113\043\362\066\221\052\004\316\014\360"
	"\005\115\263\134\142\164\277\362\376\307\241\242\347\066\136\244"
	"\215\032\330\165\351\226\052\227\177\344\154\353\153\335\062\371"
	"\137\265\015\127\126\377\007\263\312\255\176\116\112\075\262\010"
	"\054\077\374\370\072\370\017\153\247\203\032\244\263\247\007\033"
	"\306\136\234\271\136\214\065\376\015\055\073\101\125\016\170\055"
	"\350\110\202\006\126\147\066\111\303\100\241\237\024\235\245\355"
	"\064\062\320\142\236\207\216\344\237\053\314\227\134\106\122\252"
	"\143\172\321\025\210\322\154\306\162\050\235\024\341\260\217\031"
	"\257\051\063\207\025\140\365\223\126\012\117\333\063\376\363\220"
	"\015\317\270\066\262\126\161\243\211\253\330\044\114\340\172\112"
	"\363\033\155\157\311\050\274\121\366\056\357\146\160\205\051\032"
	"\065\161\346\055\156\234\220\311\364\060\101\276\207\311\201\243"
	"\215\176\315\016\306\344\301\342\167\343\133\327\273\113\113\245"
	"\350\004\374\160\035\170\337\160\250\255\131\312\125\215\117\242"
	"\202\332\155\064\056\351\321\214\333\260\346\042\007\334\231\330"
	"\151\063\040\127\254\246\056\366\053\225\076\070\225\215\100\325"
	"\065\021\320\353\160\117\034\170\347\350\045\327\172\330\142\235"
	"\276\062\003\247\302\357\143\151\125\135\312\175\003\351\246\120"
	"\303\235\043\211\240\000\232\070\320\167\222\056\367\170\037\123"
	"\101\232\142\365\376\253\135\052\303\125\056\220\366\141\363\022"
	"\117\034\263\334\163\252\202\120\057\301\376\072\357\323\047\346"
	"\255\110\225\233\375\073\116\101\030\117\356\303\122\072\053\366"
	"\122\153\104\162\246\100\052\366\326\006\015\374\326\252\307\062"
	"\101\050\146\052\157\331\226\154\072\051\224\240\056\033\326\067"
	"\372\034\326\036\141\217\105\211\155\376\270\044\200\104\263\020"
	"\071\224\135\301\204\072\335\003\121\145\377\302\323\315\025\145"
	"\244\301\230\374\343\312\176\362\176\324\257\046\325\066\115\346"
	"\312\014\333\057\312\137\223\046\346\332\100\146\240\070\027\327"
	"\305\330\060\270\357\263\101\135\346\032\224\226\133\103\375\206"
	"\374\330\003\143\377\323\112\027\134\161\330\362\017\323\351\355"
	"\124\140\332\074\225\077\142\251\074\161\110\011\027\057\107\144"
	"\306\027\127\164\266\351\067\127\326\112\237\356\112\307\054\112"
	"\225\130\144\346\233\334\335\212\254\273\142\335\120\345\153\265"
	"\144\272\272\321\211\300\334\305\373\107\232\162\027\037\157\012"
	"\174\155\314\111\262\157\150\301\144\356\074\076\342\364\370\003"
	"\300\043\267\031\266\005\251\124\203\314\163\107\264\323\257\110"
	"\176\276\105\232\222\344\346\305\250\035\131\351\042\313\345\302"
	"\254\033\270\014\121\300\341\044\324\264\122\060\001\114\372\075"
	"\041\014\366\007\360\116\340\360\134\254\140\267\017\347\376\327"
	"\076\243\316\362\354\356\317\303\264\244\004\034\110\201\167\275"
	"\220\136\346\236\320\150\173\326\267\135\076\220\126\132\235\206"
	"\210\237\060\347\110\207\124\037\177\027\356\340\121\224\220\345"
	"\273\311\100\025\355\136\115\126\170\054\054\052\341\115\161\325"
	"\373\256\346\170\026\207\161\035\125\175\175\150\340\215\221\002"
	"\262\136\306\257\046\036\364\127\176\021\250\167\063\052\100\162"
	"\163\066\020\042\304\362\312\304\317\013\046\257\050\304\354\122"
	"\376\245\227\302\210\333\142\352\207\000\161\063\053\172\302\140"
	"\233\231\120\274\137\176\042\255\105\150\206\122\200\000\176\367"
	"\301\212\243\135\005\123\247\026\324\164\344\131\324\266\351\044"
	"\131\257\000\173\200\125\006\052\346\330\174\051\004\023\062\031"
	"\142\210\146\120\266\325\206\034\273\300\017\044\363\046\125\124"
	"\204\250\254\116\200\026\060\271\316\147\032\023\226\272\172\306"
	"\067\361\366\350\132\346\031\335\266\333\034\252\253\005\205\316"
	"\055\140\003\035\225\177\234\105\113\216\053\367\013\256\050\004"
	"\116\047\332\354\042\151\145\001\064\307\210\243\267\042\131\067"
	"\342\346\276\172\173\054\012\207\020\034\250\322\065\033\063\352"
	"\246\021\331\224\341\103\034\166\037\105\142\342\114\155\020\037"
	"\337\205\310\023\247\126\266\113\020\317\247\216\260\165\245\275"
	"\105\173\204\333\231\101\013\007\133\250\265\137\276\346\124\034"
	"\175\004\314\205\077\153\137\252\031\070\063\051\332\134\344\232"
	"\060\040\043\176\000\203\235\357\172\124\061\134\023\140\061\235"
	"\134\172\027\136\345\113\306\177\335\053\247"
#define      tst2_z	19
#define      tst2	((&data[2603]))
	"\351\321\023\316\005\360\016\353\160\334\202\277\070\240\357\003"
	"\173\012\037\343\154\214\242"/* End of data[] */;
#define      hide_z	4096
#define SETUID 0	/* Define as 1 to call setuid(0) at start of script */
#define DEBUGEXEC	0	/* Define as 1 to debug execvp calls */
#define TRACEABLE	1	/* Define as 1 to enable ptrace the executable */
#define HARDENING	0	/* Define as 1 to disable ptrace/dump the executable */
#define BUSYBOXON	0	/* Define as 1 to enable work with busybox */

#if HARDENING
static const char * shc_x[] = {
"/*",
" * Copyright 2019 - Intika <intika@librefox.org>",
" * Replace ******** with secret read from fd 21",
" * Also change arguments location of sub commands (sh script commands)",
" * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl",
" */",
"",
"#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */",
"#define PLACEHOLDER \"********\"",
"#include <dlfcn.h>",
"#include <stdlib.h>",
"#include <string.h>",
"#include <unistd.h>",
"#include <stdio.h>",
"#include <signal.h>",
"",
"static char secret[128000]; //max size",
"typedef int (*pfi)(int, char **, char **);",
"static pfi real_main;",
"",
"// copy argv to new location",
"char **copyargs(int argc, char** argv){",
"    char **newargv = malloc((argc+1)*sizeof(*argv));",
"    char *from,*to;",
"    int i,len;",
"",
"    for(i = 0; i<argc; i++){",
"        from = argv[i];",
"        len = strlen(from)+1;",
"        to = malloc(len);",
"        memcpy(to,from,len);",
"        // zap old argv space",
"        memset(from,'\\0',len);",
"        newargv[i] = to;",
"        argv[i] = 0;",
"    }",
"    newargv[argc] = 0;",
"    return newargv;",
"}",
"",
"static int mymain(int argc, char** argv, char** env) {",
"    //fprintf(stderr, \"Inject main argc = %d\\n\", argc);",
"    return real_main(argc, copyargs(argc,argv), env);",
"}",
"",
"int __libc_start_main(int (*main) (int, char**, char**),",
"                      int argc,",
"                      char **argv,",
"                      void (*init) (void),",
"                      void (*fini)(void),",
"                      void (*rtld_fini)(void),",
"                      void (*stack_end)){",
"    static int (*real___libc_start_main)() = NULL;",
"    int n;",
"",
"    if (!real___libc_start_main) {",
"        real___libc_start_main = dlsym(RTLD_NEXT, \"__libc_start_main\");",
"        if (!real___libc_start_main) abort();",
"    }",
"",
"    n = read(21, secret, sizeof(secret));",
"    if (n > 0) {",
"      int i;",
"",
"    if (secret[n - 1] == '\\n') secret[--n] = '\\0';",
"    for (i = 1; i < argc; i++)",
"        if (strcmp(argv[i], PLACEHOLDER) == 0)",
"          argv[i] = secret;",
"    }",
"",
"    real_main = main;",
"",
"    return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);",
"}",
"",
0};
#endif /* HARDENING */

/* rtc.c */

#include <sys/stat.h>
#include <sys/types.h>

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

/* 'Alleged RC4' */

static unsigned char stte[256], indx, jndx, kndx;

/*
 * Reset arc4 stte. 
 */
void stte_0(void)
{
	indx = jndx = kndx = 0;
	do {
		stte[indx] = indx;
	} while (++indx);
}

/*
 * Set key. Can be used more than once. 
 */
void key(void * str, int len)
{
	unsigned char tmp, * ptr = (unsigned char *)str;
	while (len > 0) {
		do {
			tmp = stte[indx];
			kndx += tmp;
			kndx += ptr[(int)indx % len];
			stte[indx] = stte[kndx];
			stte[kndx] = tmp;
		} while (++indx);
		ptr += 256;
		len -= 256;
	}
}

/*
 * Crypt data. 
 */
void arc4(void * str, int len)
{
	unsigned char tmp, * ptr = (unsigned char *)str;
	while (len > 0) {
		indx++;
		tmp = stte[indx];
		jndx += tmp;
		stte[indx] = stte[jndx];
		stte[jndx] = tmp;
		tmp += stte[indx];
		*ptr ^= stte[tmp];
		ptr++;
		len--;
	}
}

/* End of ARC4 */

#if HARDENING

#include <sys/ptrace.h>
#include <sys/wait.h>
#include <signal.h>
#include <sys/prctl.h>
#define PR_SET_PTRACER 0x59616d61

/* Seccomp Sandboxing Init */
#include <stdlib.h>
#include <stdio.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/socket.h>

#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/audit.h>

#define ArchField offsetof(struct seccomp_data, arch)

#define Allow(syscall) \
    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_##syscall, 0, 1), \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)

struct sock_filter filter[] = {
    /* validate arch */
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, ArchField),
    BPF_JUMP( BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_X86_64, 1, 0),
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),

    /* load syscall */
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),

    /* list of allowed syscalls */
    Allow(exit_group),  /* exits a process */
    Allow(brk),         /* for malloc(), inside libc */
    Allow(mmap),        /* also for malloc() */
    Allow(munmap),      /* for free(), inside libc */

    /* and if we don't match above, die */
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
};
struct sock_fprog filterprog = {
    .len = sizeof(filter)/sizeof(filter[0]),
    .filter = filter
};

/* Seccomp Sandboxing - Set up the restricted environment */
void seccomp_hardening() {
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        perror("Could not start seccomp:");
        exit(1);
    }
    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filterprog) == -1) {
        perror("Could not start seccomp:");
        exit(1);
    }
} 
/* End Seccomp Sandboxing Init */

void shc_x_file() {
    FILE *fp;
    int line = 0;

    if ((fp = fopen("/tmp/shc_x.c", "w")) == NULL ) {exit(1); exit(1);}
    for (line = 0; shc_x[line]; line++)	fprintf(fp, "%s\n", shc_x[line]);
    fflush(fp);fclose(fp);
}

int make() {
	char * cc, * cflags, * ldflags;
    char cmd[4096];

	cc = getenv("CC");
	if (!cc) cc = "cc";

	sprintf(cmd, "%s %s -o %s %s", cc, "-Wall -fpic -shared", "/tmp/shc_x.so", "/tmp/shc_x.c -ldl");
	if (system(cmd)) {remove("/tmp/shc_x.c"); return -1;}
	remove("/tmp/shc_x.c"); return 0;
}

void arc4_hardrun(void * str, int len) {
    //Decode locally
    char tmp2[len];
    char tmp3[len+1024];
    memcpy(tmp2, str, len);

	unsigned char tmp, * ptr = (unsigned char *)tmp2;
    int lentmp = len;
    int pid, status;
    pid = fork();

    shc_x_file();
    if (make()) {exit(1);}

    setenv("LD_PRELOAD","/tmp/shc_x.so",1);

    if(pid==0) {

        //Start tracing to protect from dump & trace
        if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
            kill(getpid(), SIGKILL);
            _exit(1);
        }

        //Decode Bash
        while (len > 0) {
            indx++;
            tmp = stte[indx];
            jndx += tmp;
            stte[indx] = stte[jndx];
            stte[jndx] = tmp;
            tmp += stte[indx];
            *ptr ^= stte[tmp];
            ptr++;
            len--;
        }

        //Do the magic
        sprintf(tmp3, "%s %s", "'********' 21<<<", tmp2);

        //Exec bash script //fork execl with 'sh -c'
        system(tmp2);

        //Empty script variable
        memcpy(tmp2, str, lentmp);

        //Clean temp
        remove("/tmp/shc_x.so");

        //Sinal to detach ptrace
        ptrace(PTRACE_DETACH, 0, 0, 0);
        exit(0);
    }
    else {wait(&status);}

    /* Seccomp Sandboxing - Start */
    seccomp_hardening();

    exit(0);
}
#endif /* HARDENING */

/*
 * Key with file invariants. 
 */
int key_with_file(char * file)
{
	struct stat statf[1];
	struct stat control[1];

	if (stat(file, statf) < 0)
		return -1;

	/* Turn on stable fields */
	memset(control, 0, sizeof(control));
	control->st_ino = statf->st_ino;
	control->st_dev = statf->st_dev;
	control->st_rdev = statf->st_rdev;
	control->st_uid = statf->st_uid;
	control->st_gid = statf->st_gid;
	control->st_size = statf->st_size;
	control->st_mtime = statf->st_mtime;
	control->st_ctime = statf->st_ctime;
	key(control, sizeof(control));
	return 0;
}

#if DEBUGEXEC
void debugexec(char * sh11, int argc, char ** argv)
{
	int i;
	fprintf(stderr, "shll=%s\n", sh11 ? sh11 : "<null>");
	fprintf(stderr, "argc=%d\n", argc);
	if (!argv) {
		fprintf(stderr, "argv=<null>\n");
	} else { 
		for (i = 0; i <= argc ; i++)
			fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : "<null>");
	}
}
#endif /* DEBUGEXEC */

void rmarg(char ** argv, char * arg)
{
	for (; argv && *argv && *argv != arg; argv++);
	for (; argv && *argv; argv++)
		*argv = argv[1];
}

void chkenv_end(void);

int chkenv(int argc)
{
	char buff[512];
	unsigned long mask, m;
	int l, a, c;
	char * string;
	extern char ** environ;

	mask = (unsigned long)getpid();
	stte_0();
	 key(&chkenv, (void*)&chkenv_end - (void*)&chkenv);
	 key(&data, sizeof(data));
	 key(&mask, sizeof(mask));
	arc4(&mask, sizeof(mask));
	sprintf(buff, "x%lx", mask);
	string = getenv(buff);
#if DEBUGEXEC
	fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : "<null>");
#endif
	l = strlen(buff);
	if (!string) {
		/* 1st */
		sprintf(&buff[l], "=%lu %d", mask, argc);
		putenv(strdup(buff));
		return 0;
	}
	c = sscanf(string, "%lu %d%c", &m, &a, buff);
	if (c == 2 && m == mask) {
		/* 3rd */
		rmarg(environ, &string[-l - 1]);
		return 1 + (argc - a);
	}
	return -1;
}

void chkenv_end(void){}

#if HARDENING

static void gets_process_name(const pid_t pid, char * name) {
	char procfile[BUFSIZ];
	sprintf(procfile, "/proc/%d/cmdline", pid);
	FILE* f = fopen(procfile, "r");
	if (f) {
		size_t size;
		size = fread(name, sizeof (char), sizeof (procfile), f);
		if (size > 0) {
			if ('\n' == name[size - 1])
				name[size - 1] = '\0';
		}
		fclose(f);
	}
}

void hardening() {
    prctl(PR_SET_DUMPABLE, 0);
    prctl(PR_SET_PTRACER, -1);

    int pid = getppid();
    char name[256] = {0};
    gets_process_name(pid, name);

    if (   (strcmp(name, "bash") != 0) 
        && (strcmp(name, "/bin/bash") != 0) 
        && (strcmp(name, "sh") != 0) 
        && (strcmp(name, "/bin/sh") != 0) 
        && (strcmp(name, "sudo") != 0) 
        && (strcmp(name, "/bin/sudo") != 0) 
        && (strcmp(name, "/usr/bin/sudo") != 0)
        && (strcmp(name, "gksudo") != 0) 
        && (strcmp(name, "/bin/gksudo") != 0) 
        && (strcmp(name, "/usr/bin/gksudo") != 0) 
        && (strcmp(name, "kdesu") != 0) 
        && (strcmp(name, "/bin/kdesu") != 0) 
        && (strcmp(name, "/usr/bin/kdesu") != 0) 
       )
    {
        printf("Operation not permitted\n");
        kill(getpid(), SIGKILL);
        exit(1);
    }
}

#endif /* HARDENING */

#if !TRACEABLE

#define _LINUX_SOURCE_COMPAT
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <unistd.h>

#if !defined(PT_ATTACHEXC) /* New replacement for PT_ATTACH */
   #if !defined(PTRACE_ATTACH) && defined(PT_ATTACH)
       #define PT_ATTACHEXC	PT_ATTACH
   #elif defined(PTRACE_ATTACH)
       #define PT_ATTACHEXC PTRACE_ATTACH
   #endif
#endif

void untraceable(char * argv0)
{
	char proc[80];
	int pid, mine;

	switch(pid = fork()) {
	case  0:
		pid = getppid();
		/* For problematic SunOS ptrace */
#if defined(__FreeBSD__)
		sprintf(proc, "/proc/%d/mem", (int)pid);
#else
		sprintf(proc, "/proc/%d/as",  (int)pid);
#endif
		close(0);
		mine = !open(proc, O_RDWR|O_EXCL);
		if (!mine && errno != EBUSY)
			mine = !ptrace(PT_ATTACHEXC, pid, 0, 0);
		if (mine) {
			kill(pid, SIGCONT);
		} else {
			perror(argv0);
			kill(pid, SIGKILL);
		}
		_exit(mine);
	case -1:
		break;
	default:
		if (pid == waitpid(pid, 0, 0))
			return;
	}
	perror(argv0);
	_exit(1);
}
#endif /* !TRACEABLE */

char * xsh(int argc, char ** argv)
{
	char * scrpt;
	int ret, i, j;
	char ** varg;
	char * me = argv[0];
	if (me == NULL) { me = getenv("_"); }
	if (me == 0) { fprintf(stderr, "E: neither argv[0] nor $_ works."); exit(1); }

	ret = chkenv(argc);
	stte_0();
	 key(pswd, pswd_z);
	arc4(msg1, msg1_z);
	arc4(date, date_z);
	if (date[0] && (atoll(date)<time(NULL)))
		return msg1;
	arc4(shll, shll_z);
	arc4(inlo, inlo_z);
	arc4(xecc, xecc_z);
	arc4(lsto, lsto_z);
	arc4(tst1, tst1_z);
	 key(tst1, tst1_z);
	arc4(chk1, chk1_z);
	if ((chk1_z != tst1_z) || memcmp(tst1, chk1, tst1_z))
		return tst1;
	arc4(msg2, msg2_z);
	if (ret < 0)
		return msg2;
	varg = (char **)calloc(argc + 10, sizeof(char *));
	if (!varg)
		return 0;
	if (ret) {
		arc4(rlax, rlax_z);
		if (!rlax[0] && key_with_file(shll))
			return shll;
		arc4(opts, opts_z);
#if HARDENING
	    arc4_hardrun(text, text_z);
	    exit(0);
       /* Seccomp Sandboxing - Start */
       seccomp_hardening();
#endif
		arc4(text, text_z);
		arc4(tst2, tst2_z);
		 key(tst2, tst2_z);
		arc4(chk2, chk2_z);
		if ((chk2_z != tst2_z) || memcmp(tst2, chk2, tst2_z))
			return tst2;
		/* Prepend hide_z spaces to script text to hide it. */
		scrpt = malloc(hide_z + text_z);
		if (!scrpt)
			return 0;
		memset(scrpt, (int) ' ', hide_z);
		memcpy(&scrpt[hide_z], text, text_z);
	} else {			/* Reexecute */
		if (*xecc) {
			scrpt = malloc(512);
			if (!scrpt)
				return 0;
			sprintf(scrpt, xecc, me);
		} else {
			scrpt = me;
		}
	}
	j = 0;
#if BUSYBOXON
	varg[j++] = "busybox";
	varg[j++] = "sh";
#else
	varg[j++] = argv[0];		/* My own name at execution */
#endif
	if (ret && *opts)
		varg[j++] = opts;	/* Options on 1st line of code */
	if (*inlo)
		varg[j++] = inlo;	/* Option introducing inline code */
	varg[j++] = scrpt;		/* The script itself */
	if (*lsto)
		varg[j++] = lsto;	/* Option meaning last option */
	i = (ret > 1) ? ret : 0;	/* Args numbering correction */
	while (i < argc)
		varg[j++] = argv[i++];	/* Main run-time arguments */
	varg[j] = 0;			/* NULL terminated array */
#if DEBUGEXEC
	debugexec(shll, j, varg);
#endif
	execvp(shll, varg);
	return shll;
}

int main(int argc, char ** argv)
{
#if SETUID
   setuid(0);
#endif
#if DEBUGEXEC
	debugexec("main", argc, argv);
#endif
#if HARDENING
	hardening();
#endif
#if !TRACEABLE
	untraceable(argv[0]);
#endif
	argv[1] = xsh(argc, argv);
	fprintf(stderr, "%s%s%s: %s\n", argv[0],
		errno ? ": " : "",
		errno ? strerror(errno) : "",
		argv[1] ? argv[1] : "<null>"
	);
	return 1;
}