Cleanup unused code.
Remove unused code from repo.
This commit is contained in:
Sebastian Lenzlinger
GitHub
parent
2150441d48
commit
94cb159a49
@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# ===============================
|
||||
# Step1: Find keyboard file paths
|
||||
# ===============================
|
||||
|
||||
# Output file path
|
||||
kbd_output_file="kbd_file_paths.txt"
|
||||
|
||||
# Function to follow symbolic links recursively
|
||||
follow_symlinks() {
|
||||
local filepath=$1
|
||||
|
||||
if [[ -L $filepath ]]; then
|
||||
local resolved_path=$(readlink -f "$filepath")
|
||||
echo "$resolved_path" >> "$kbd_output_file"
|
||||
follow_symlinks "$resolved_path"
|
||||
fi
|
||||
}
|
||||
|
||||
# Traverse files in /dev/input/by-path
|
||||
echo -n > "$kbd_output_file"
|
||||
find /dev/input/by-path -type l -name '*kbd*' -print0 | while IFS= read -r -d '' filepath; do
|
||||
#echo "$filepath" >> "$kbd_output_file"
|
||||
follow_symlinks "$filepath"
|
||||
done
|
||||
|
||||
echo "Keyboard file paths written to $kbd_output_file"
|
||||
|
||||
# ===============================
|
||||
# Step2: Find pids using keyboard event files
|
||||
# ===============================
|
||||
|
||||
# Use found kbd file paths to find corresponding pids
|
||||
pids_input_file="$kbd_output_file"
|
||||
pids_output_file="pids.txt"
|
||||
|
||||
echo -n > "$pids_output_file"
|
||||
|
||||
declare -a pids_array
|
||||
|
||||
# Get pids of processes using the keyboard and put in array
|
||||
while IFS= read -r pathname; do
|
||||
pids=$(fuser "$pathname")
|
||||
# add pids to array
|
||||
for pid in $pids; do
|
||||
pids_array+=("$pid")
|
||||
done
|
||||
done < "$pids_input_file"
|
||||
|
||||
# sort and remove duplicates
|
||||
sorted_pids=$(printf '%s\n' "${pids_array[@]}" | sort -nu)
|
||||
|
||||
# write unique and sorted pids to file, separated by newlines
|
||||
printf '%s\n' "${sorted_pids[@]}" > "$pids_output_file"
|
||||
|
||||
echo "Pids written to $pids_output_file"
|
||||
|
||||
# ===============================
|
||||
# Step3: Find processes/program names using pids
|
||||
# ===============================
|
||||
exe_input_file="$pids_output_file"
|
||||
exe_output_file="suspicous_exes.txt"
|
||||
|
||||
# Clear output file
|
||||
echo -n > "$exe_output_file"
|
||||
|
||||
@ -1,24 +0,0 @@
|
||||
import os
|
||||
|
||||
# Output file path
|
||||
kbd_output_file = "kbd_file_paths.txt"
|
||||
|
||||
# Function to follow symbolic links recursively
|
||||
def follow_symlinks(filepath):
|
||||
if os.path.islink(filepath):
|
||||
resolved_path = os.path.realpath(filepath)
|
||||
with open(kbd_output_file, "a") as f:
|
||||
f.write(resolved_path + "\n")
|
||||
follow_symlinks(resolved_path)
|
||||
|
||||
# Traverse files in /dev/input/by-path
|
||||
with open(kbd_output_file, "w") as f:
|
||||
f.write("")
|
||||
for root, dirs, files in os.walk("/dev/input/by-path"):
|
||||
for filename in files:
|
||||
if "kbd" in filename:
|
||||
filepath = os.path.join(root, filename)
|
||||
follow_symlinks(filepath)
|
||||
|
||||
print("Keyboard file paths written to", kbd_output_file)
|
||||
|
||||
@ -1,40 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Output file path
|
||||
output_file="keyboard_info.txt"
|
||||
|
||||
# Step 1: Find keyboard device files
|
||||
keyboard_files=()
|
||||
while IFS= read -r -d '' file; do
|
||||
if [[ $file == *"kbd"* || $file == *"keyboard"* ]]; then
|
||||
keyboard_files+=("$file")
|
||||
fi
|
||||
done < <(find /dev/input/by-path -type l -name 'event*')
|
||||
|
||||
# Step 2: Check processes with open keyboard files
|
||||
echo "Keyboard Information" > "$output_file"
|
||||
echo "=====================" >> "$output_file"
|
||||
|
||||
for keyboard_file in "${keyboard_files[@]}"; do
|
||||
echo "Keyboard device file: $keyboard_file" >> "$output_file"
|
||||
|
||||
event_file=$(readlink -f "$keyboard_file")
|
||||
echo "Event file: $event_file" >> "$output_file"
|
||||
|
||||
pids=$(fuser -v "$event_file" 2>/dev/null | awk -F'[: ]+' 'NR>1{print $2}')
|
||||
echo "PIDs with file open: $pids" >> "$output_file"
|
||||
|
||||
# Step 3: Check corresponding programs
|
||||
echo "Corresponding Programs" >> "$output_file"
|
||||
echo "---------------------" >> "$output_file"
|
||||
|
||||
for pid in $pids; do
|
||||
program=$(readlink -f "/proc/$pid/exe")
|
||||
echo "PID $pid corresponds to program: $program" >> "$output_file"
|
||||
done
|
||||
|
||||
echo >> "$output_file"
|
||||
done
|
||||
|
||||
echo "Keyboard information written to $output_file"
|
||||
|
||||
@ -1,251 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import os # for going directories
|
||||
import subprocess # for running commands, in particular fuser
|
||||
import sys # for exiting
|
||||
import signal # for killing processes
|
||||
import json # for handling our configurations
|
||||
|
||||
CONFIG_FILE = 'config.json'
|
||||
|
||||
|
||||
auto_kill_option = False
|
||||
verbose_option = False
|
||||
safe_option = False
|
||||
|
||||
# Check if the user is in sudo mode
|
||||
def check_sudo():
|
||||
if os.geteuid() != 0:
|
||||
print("[-] Please rerun as root")
|
||||
sys.exit(1)
|
||||
|
||||
# Check if the user has the required packages installed
|
||||
def check_packages():
|
||||
packages = ['fuser']
|
||||
missing_packages = []
|
||||
for package in packages:
|
||||
try:
|
||||
subprocess.check_call(['which', package])
|
||||
except subprocess.CalledProcessError:
|
||||
missing_packages.append(package)
|
||||
if len(missing_packages) > 0:
|
||||
print("[-] Please install the following packages:", str(missing_packages))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
|
||||
|
||||
# Follow symlinks to find real path
|
||||
def get_real_path(path):
|
||||
if os.path.islink(path):
|
||||
return os.path.realpath(path)
|
||||
else:
|
||||
return path
|
||||
|
||||
# get keyboard device files
|
||||
def get_keyboard_device_files(kbd_names):
|
||||
keyboard_device_files = []
|
||||
for root, dirs, files in os.walk('/dev/input/by-path'):
|
||||
for file in files:
|
||||
if any(kbd_name in file for kbd_name in kbd_names):
|
||||
keyboard_device_files.append(get_real_path(os.path.join(root, file)))
|
||||
return keyboard_device_files
|
||||
|
||||
# print a list to a file separated by newlines
|
||||
def print_list_to_file(list, file):
|
||||
with open(file, 'w') as f:
|
||||
for item in list:
|
||||
f.write("%s\n" % item)
|
||||
|
||||
# find pids using file using fuser
|
||||
def get_pids(file):
|
||||
try:
|
||||
pids = subprocess.check_output(['fuser', file]).decode('utf-8').split()
|
||||
except subprocess.CalledProcessError:
|
||||
if verbose_option:
|
||||
print("[-] Error: fuser failed to run on", file)
|
||||
return []
|
||||
#pids = [int(pid) for pid in pids]
|
||||
return pids
|
||||
|
||||
# clear a file
|
||||
def clear_file(file):
|
||||
open(file, 'w').close()
|
||||
|
||||
|
||||
# find programm name using pid
|
||||
def get_program_name(pid):
|
||||
status_file = '/proc/' + str(pid) + '/status'
|
||||
with open(status_file, 'r') as f:
|
||||
# See cat /proc/[pid]/status | grep Name
|
||||
for line in f:
|
||||
if line.startswith('Name:'):
|
||||
program_name = line.split(":")[1].strip()
|
||||
return program_name
|
||||
|
||||
# proces input arguments and set options
|
||||
def set_input_arguments():
|
||||
global auto_kill_option
|
||||
global verbose_option
|
||||
global safe_option
|
||||
if len(sys.argv) > 1:
|
||||
if '-a' in sys.argv:
|
||||
auto_kill_option = True
|
||||
if '-v' in sys.argv:
|
||||
verbose_option = True
|
||||
if '-s' in sys.argv:
|
||||
safe_option = True
|
||||
|
||||
|
||||
# ask user to confirm a list of programs to kill
|
||||
def confirm_kill_programs(programs, times=0):
|
||||
print("Confirm to kill the following programs:")
|
||||
for program in programs:
|
||||
print(program)
|
||||
print("y/n?")
|
||||
answer = input()
|
||||
if answer == 'y':
|
||||
return True
|
||||
elif answer == 'n':
|
||||
return False
|
||||
else:
|
||||
if times > 5:
|
||||
print("[-] Too many tries. Exiting")
|
||||
sys.exit(1)
|
||||
print("[-] Please answer y or n")
|
||||
return confirm_kill_programs(programs, times+1)
|
||||
|
||||
# kill list of processes
|
||||
def kill_processes(pids):
|
||||
print(pids) ## DEBUG
|
||||
print("Killing processes with pids:", pids)
|
||||
for pid in pids:
|
||||
os.kill(pid, signal.SIGKILL)
|
||||
if verbose_option:
|
||||
print("[-] Killed process with pid", pid)
|
||||
|
||||
# the main program starts here
|
||||
def detect_keyloggers():
|
||||
###############################
|
||||
# Step 0: Check minimal requirements/ Set up
|
||||
###############################
|
||||
check_sudo()
|
||||
check_packages()
|
||||
config = load_config()
|
||||
# initialize white_listed_programs
|
||||
if 'white_listed_programs' in config:
|
||||
white_listed_programs = config['white_listed_programs']
|
||||
else:
|
||||
config['white_listed_programs'] = []
|
||||
white_listed_programs = []
|
||||
# initialize auto_kill_programs
|
||||
if 'auto_kill_programs' in config:
|
||||
auto_kill_programs = config['auto_kill_programs']
|
||||
else:
|
||||
config['auto_kill_programs'] = []
|
||||
auto_kill_programs = []
|
||||
# initialize kbd_names
|
||||
if 'kbd_names' in config:
|
||||
kbd_names = config['kbd_names']
|
||||
else:
|
||||
config['kbd_names'] = []
|
||||
kbd_names = []
|
||||
# Set options
|
||||
set_input_arguments()
|
||||
|
||||
###############################
|
||||
# Step 1: Get keyboard device files
|
||||
###############################
|
||||
keyboard_device_files = get_keyboard_device_files(kbd_names)
|
||||
###############################
|
||||
# Step 2: Get pids using keyboard device files
|
||||
###############################
|
||||
pids = []
|
||||
for file in keyboard_device_files:
|
||||
pids += get_pids(file)
|
||||
pids = sorted(list(set(pids)))
|
||||
###############################
|
||||
# Step 3: Get program names using pids
|
||||
###############################
|
||||
program_names = []
|
||||
program_pid_dict = {}
|
||||
# Get program names
|
||||
for pid in pids:
|
||||
program_name = get_program_name(pid)
|
||||
program_pid_dict[program_name] = program_pid_dict[program_name].append(int(pid))
|
||||
if auto_kill_option and program_name in auto_kill_programs:
|
||||
os.kill(pid, signal.SIGKILL)
|
||||
if verbose_option:
|
||||
print("[-] Auto-Killed process", program_name, "with pid", pid)
|
||||
else:
|
||||
program_names.append(program_name)
|
||||
program_names = sorted(list(set(program_names)))
|
||||
|
||||
# Identify suspicious programs
|
||||
suspicious_programs = []
|
||||
for program_name in program_names:
|
||||
if program_name not in white_listed_programs:
|
||||
suspicious_programs.append(program_name)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
if verbose_option:
|
||||
###############################=
|
||||
# Intermezzo: Print results
|
||||
###############################
|
||||
print("Keyboard device files:")
|
||||
for file in keyboard_device_files:
|
||||
print(file)
|
||||
print("")
|
||||
print("Pids:")
|
||||
for pid in pids:
|
||||
print(pid)
|
||||
print("")
|
||||
print("Program names:")
|
||||
for program_name in program_names:
|
||||
print(program_name)
|
||||
print("")
|
||||
|
||||
if len(suspicious_programs) == 0:
|
||||
print("[+] No suspicious programs found")
|
||||
sys.exit(0)
|
||||
|
||||
###############################
|
||||
# Step 4: Ask user to kill any suspicious programs
|
||||
###############################
|
||||
print("Suspicious programs:")
|
||||
for program_name in suspicious_programs:
|
||||
print(program_name)
|
||||
user_input = input("Please enter those programs you want to kill. Use the whitespace(spacebar) to separate values.")
|
||||
if user_input == '':
|
||||
print("[-] No programs to kill")
|
||||
sys.exit(0)
|
||||
|
||||
programs_to_kill = user_input.split()
|
||||
programs_to_kill = [program_name for program_name in programs_to_kill if program_name in suspicious_programs] # Filter out programs that are not suspicious
|
||||
pids_to_kill = []
|
||||
for program_name in programs_to_kill:
|
||||
pids_to_kill.append(program_pid_dict[program_name])
|
||||
auto_kill_programs.append(program_name)
|
||||
|
||||
if safe_option:
|
||||
if confirm_kill_programs(programs_to_kill):
|
||||
kill_processes(pids_to_kill)
|
||||
else:
|
||||
kill_processes(pids_to_kill)
|
||||
|
||||
###############################
|
||||
# Step 5: Save config
|
||||
###############################
|
||||
config['auto_kill_programs'] = list(set(auto_kill_programs))
|
||||
config['white_listed_programs'] = list(set(white_listed_programs))
|
||||
config['kbd_names'] = list(set(kbd_names))
|
||||
save_config(config)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
detect_keyloggers()
|
||||
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
import os
|
||||
import subprocess
|
||||
|
||||
# ===============================
|
||||
# Step1: Find keyboard file paths
|
||||
# ===============================
|
||||
|
||||
# Output file path
|
||||
kbd_output_file = "kbd_file_paths.txt"
|
||||
|
||||
# Function to follow symbolic links recursively
|
||||
def follow_symlinks(filepath):
|
||||
if os.path.islink(filepath):
|
||||
resolved_path = os.path.realpath(filepath)
|
||||
with open(kbd_output_file, "a") as output_file:
|
||||
output_file.write(resolved_path + "\n")
|
||||
follow_symlinks(resolved_path)
|
||||
|
||||
# Traverse files in /dev/input/by-path
|
||||
with open(kbd_output_file, "w") as output_file:
|
||||
for root, dirs, files in os.walk("/dev/input/by-path"):
|
||||
for file in files:
|
||||
if "kbd" in file:
|
||||
filepath = os.path.join(root, file)
|
||||
output_file.write(filepath + "\n")
|
||||
follow_symlinks(filepath)
|
||||
|
||||
print("Keyboard file paths written to", kbd_output_file)
|
||||
|
||||
# ===============================
|
||||
# Step2: Find pids using keyboard event files
|
||||
# ===============================
|
||||
|
||||
# Use found kbd file paths to find corresponding pids
|
||||
pids_input_file = kbd_output_file
|
||||
pids_output_file = "pids.txt"
|
||||
|
||||
pids_array = []
|
||||
|
||||
# Get pids of processes using the keyboard and put in array
|
||||
with open(pids_input_file, "r") as input_file:
|
||||
for pathname in input_file:
|
||||
pathname = pathname.strip()
|
||||
pids = subprocess.check_output(["fuser", pathname]).decode().split()
|
||||
pids_array.extend(pids)
|
||||
|
||||
# Sort and remove duplicates
|
||||
sorted_pids = sorted(set(pids_array))
|
||||
print()
|
||||
print("The following pids where found:" + str(sorted_pids) + "\n")
|
||||
|
||||
# Write unique and sorted pids to file, separated by newlines
|
||||
with open(pids_output_file, "w") as output_file:
|
||||
output_file.write("\n".join(sorted_pids) + "\n")
|
||||
print("Pids written to", pids_output_file)
|
||||
|
||||
# ===============================
|
||||
# Step3: Find processes/program names using pids
|
||||
# ===============================
|
||||
exe_input_file = pids_output_file
|
||||
exe_output_file = "suspicious_exes.txt"
|
||||
|
||||
# Clear output file
|
||||
with open(exe_output_file, "w") as output_file:
|
||||
output_file.write("")
|
||||
exe_pid_dict = {}
|
||||
|
||||
for pid in sorted_pids:
|
||||
#Get name of executable from PID using process status file
|
||||
status_file_path = "/proc/" + pid + "/status"
|
||||
with open(status_file_path, "r") as status_file:
|
||||
for line in status_file:
|
||||
# See cat /proc/{pid}/status | grep "Name:"
|
||||
if line.startswith("Name:"):
|
||||
exe_name = line.split(":")[1].strip()
|
||||
exe_pid_dict[exe_name] = pid
|
||||
print("The following executables where found:" + str(exe_pid_dict) + "\n")
|
||||
@ -1,112 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <dirent.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#define DEVICE_DIR "/dev/input"
|
||||
#define BY_PATH_DIR "/dev/input/by-path"
|
||||
#define PROC_DIR "/proc"
|
||||
|
||||
void get_program_name(long pid) {
|
||||
char exe_file_path[256];
|
||||
snprintf(exe_file_path, sizeof(exe_file_path), "/proc/%ld/exe", pid);
|
||||
|
||||
if (access(exe_file_path, F_OK) == 0) {
|
||||
char program_path[256];
|
||||
ssize_t path_len = readlink(exe_file_path, program_path, sizeof(program_path) - 1);
|
||||
if (path_len != -1) {
|
||||
program_path[path_len] = '\0';
|
||||
printf("Corresponding program: %s\n\n", program_path);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void find_keyboard_files() {
|
||||
DIR *by_path_dir = opendir(BY_PATH_DIR);
|
||||
if (by_path_dir == NULL) {
|
||||
perror("opendir");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
struct dirent *entry;
|
||||
while ((entry = readdir(by_path_dir)) != NULL) {
|
||||
if (strstr(entry->d_name, "kbd") != NULL || strstr(entry->d_name, "keyboard") != NULL) {
|
||||
char device_file_path[256];
|
||||
snprintf(device_file_path, sizeof(device_file_path), "%s/%s", BY_PATH_DIR, entry->d_name);
|
||||
|
||||
char link_dest[256];
|
||||
ssize_t link_size = readlink(device_file_path, link_dest, sizeof(link_dest) - 1);
|
||||
if (link_size == -1) {
|
||||
perror("readlink");
|
||||
continue;
|
||||
}
|
||||
|
||||
link_dest[link_size] = '\0';
|
||||
printf("Keyboard device file: %s\n", link_dest);
|
||||
|
||||
char event_file[256];
|
||||
snprintf(event_file, sizeof(event_file), "%s/%s", DEVICE_DIR, link_dest);
|
||||
|
||||
DIR *proc_dir = opendir(PROC_DIR);
|
||||
if (proc_dir == NULL) {
|
||||
perror("opendir");
|
||||
continue;
|
||||
}
|
||||
|
||||
struct dirent *pid_entry;
|
||||
while ((pid_entry = readdir(proc_dir)) != NULL) {
|
||||
if (pid_entry->d_type != DT_DIR)
|
||||
continue;
|
||||
|
||||
// Check if the entry name is a numeric value (PID)
|
||||
char *endptr;
|
||||
long pid = strtol(pid_entry->d_name, &endptr, 10);
|
||||
if (*endptr != '\0')
|
||||
continue;
|
||||
|
||||
char fd_dir_path[256];
|
||||
snprintf(fd_dir_path, sizeof(fd_dir_path), "%s/%s/fd", PROC_DIR, pid_entry->d_name);
|
||||
|
||||
DIR *fd_dir = opendir(fd_dir_path);
|
||||
if (fd_dir == NULL)
|
||||
continue;
|
||||
|
||||
struct dirent *fd_entry;
|
||||
while ((fd_entry = readdir(fd_dir)) != NULL) {
|
||||
if (fd_entry->d_type != DT_LNK)
|
||||
continue;
|
||||
|
||||
char fd_file_path[256];
|
||||
snprintf(fd_file_path, sizeof(fd_file_path), "%s/%s", fd_dir_path, fd_entry->d_name);
|
||||
|
||||
char link_dest[256];
|
||||
ssize_t link_size = readlink(fd_file_path, link_dest, sizeof(link_dest) - 1);
|
||||
if (link_size == -1)
|
||||
continue;
|
||||
|
||||
link_dest[link_size] = '\0';
|
||||
|
||||
if (strcmp(link_dest, event_file) == 0) {
|
||||
printf("Process with PID %ld is using this file.\n", pid);
|
||||
get_program_name(pid);
|
||||
}
|
||||
}
|
||||
|
||||
closedir(fd_dir);
|
||||
}
|
||||
|
||||
closedir(proc_dir);
|
||||
}
|
||||
}
|
||||
|
||||
closedir(by_path_dir);
|
||||
}
|
||||
|
||||
int main() {
|
||||
printf("Finding keyboard files...\n\n");
|
||||
find_keyboard_files();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
import os
|
||||
import subprocess
|
||||
|
||||
# ===============================
|
||||
# Step1: Find keyboard file paths
|
||||
# ===============================
|
||||
|
||||
# Output file path
|
||||
kbd_output_file = "kbd_file_paths.txt"
|
||||
|
||||
# Function to follow symbolic links recursively
|
||||
def follow_symlinks(filepath):
|
||||
if os.path.islink(filepath):
|
||||
resolved_path = os.path.realpath(filepath)
|
||||
with open(kbd_output_file, "a") as output_file:
|
||||
output_file.write(resolved_path + "\n")
|
||||
follow_symlinks(resolved_path)
|
||||
|
||||
# Traverse files in /dev/input/by-path
|
||||
with open(kbd_output_file, "w") as output_file:
|
||||
for root, dirs, files in os.walk("/dev/input/by-path"):
|
||||
for file in files:
|
||||
if "kbd" in file:
|
||||
filepath = os.path.join(root, file)
|
||||
output_file.write(filepath + "\n")
|
||||
follow_symlinks(filepath)
|
||||
|
||||
print("Keyboard file paths written to", kbd_output_file)
|
||||
|
||||
# ===============================
|
||||
# Step2: Find pids using keyboard event files
|
||||
# ===============================
|
||||
|
||||
# Use found kbd file paths to find corresponding pids
|
||||
pids_input_file = kbd_output_file
|
||||
pids_output_file = "pids.txt"
|
||||
|
||||
pids_array = []
|
||||
|
||||
# Get pids of processes using the keyboard and put in array
|
||||
with open(pids_input_file, "r") as input_file:
|
||||
for pathname in input_file:
|
||||
pathname = pathname.strip()
|
||||
pids = subprocess.check_output(["fuser", pathname]).decode().split()
|
||||
pids_array.extend(pids)
|
||||
|
||||
# Sort and remove duplicates
|
||||
sorted_pids = sorted(set(pids_array))
|
||||
print()
|
||||
print("The following pids where found:" + str(sorted_pids) + "\n")
|
||||
|
||||
# Write unique and sorted pids to file, separated by newlines
|
||||
with open(pids_output_file, "w") as output_file:
|
||||
output_file.write("\n".join(sorted_pids) + "\n")
|
||||
print("Pids written to", pids_output_file)
|
||||
|
||||
# ===============================
|
||||
# Step3: Find processes/program names using pids
|
||||
# ===============================
|
||||
exe_input_file = pids_output_file
|
||||
exe_output_file = "suspicious_exes.txt"
|
||||
|
||||
# Clear output file
|
||||
with open(exe_output_file, "w") as output_file:
|
||||
output_file.write("")
|
||||
exe_pid_dict = {}
|
||||
|
||||
for pid in sorted_pids:
|
||||
#Get name of executable from PID using process status file
|
||||
status_file_path = "/proc/" + pid + "/status"
|
||||
with open(status_file_path, "r") as status_file:
|
||||
for line in status_file:
|
||||
# See cat /proc/{pid}/status | grep "Name:"
|
||||
if line.startswith("Name:"):
|
||||
exe_name = line.split(":")[1].strip()
|
||||
exe_pid_dict[exe_name] = pid
|
||||
print("The following executables where found:" + str(exe_pid_dict) + "\n")
|
||||
@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# ===============================
|
||||
# Step1: Find keyboard file paths
|
||||
# ===============================
|
||||
|
||||
# Output file path
|
||||
kbd_output_file="kbd_file_paths.txt"
|
||||
|
||||
# Function to follow symbolic links recursively
|
||||
follow_symlinks() {
|
||||
local filepath=$1
|
||||
|
||||
if [[ -L $filepath ]]; then
|
||||
local resolved_path=$(readlink -f "$filepath")
|
||||
echo "$resolved_path" >> "$kbd_output_file"
|
||||
follow_symlinks "$resolved_path"
|
||||
fi
|
||||
}
|
||||
|
||||
# Traverse files in /dev/input/by-path
|
||||
echo -n > "$kbd_output_file"
|
||||
find /dev/input/by-path -type l -name '*kbd*' -print0 | while IFS= read -r -d '' filepath; do
|
||||
#echo "$filepath" >> "$kbd_output_file"
|
||||
follow_symlinks "$filepath"
|
||||
done
|
||||
|
||||
echo "Keyboard file paths written to $kbd_output_file"
|
||||
|
||||
# ===============================
|
||||
# Step2: Find pids using keyboard event files
|
||||
# ===============================
|
||||
|
||||
# Use found kbd file paths to find corresponding pids
|
||||
pids_input_file="$kbd_output_file"
|
||||
pids_output_file="pids.txt"
|
||||
|
||||
echo -n > "$pids_output_file"
|
||||
|
||||
declare -a pids_array
|
||||
|
||||
# Get pids of processes using the keyboard and put in array
|
||||
while IFS= read -r pathname; do
|
||||
pids=$(fuser "$pathname")
|
||||
# add pids to array
|
||||
for pid in $pids; do
|
||||
pids_array+=("$pid")
|
||||
done
|
||||
done < "$pids_input_file"
|
||||
|
||||
# sort and remove duplicates
|
||||
sorted_pids=$(printf '%s\n' "${pids_array[@]}" | sort -nu)
|
||||
|
||||
# write unique and sorted pids to file, separated by newlines
|
||||
printf '%s\n' "${sorted_pids[@]}" > "$pids_output_file"
|
||||
|
||||
echo "Pids written to $pids_output_file"
|
||||
|
||||
# ===============================
|
||||
# Step3: Find processes/program names using pids
|
||||
# ===============================
|
||||
exe_input_file="$pids_output_file"
|
||||
exe_output_file="suspicous_exes.txt"
|
||||
|
||||
# Clear output file
|
||||
echo -n > "$exe_output_file"
|
||||
|
||||
Reference in New Issue
Block a user