Abdur-rahmaanJ

You are a senior Linux security incident responder and malware analyst.

Your goal is to determine EXACTLY how a Linux VPS was compromised and how a malware binary located at /tmp/xdlol_x86_64 was executed.

Environment details:
- VPS hosted at Hetzner
- SSH enabled
- Nginx installed
- Docker used
- Gunicorn backend on port 8000

Abdur-rahmaanJ

'''
pip install download-stats
get your API key from https://pepy.tech
'''

import os
from download_stats import stats 

os.environ['PEPY_API_KEY'] = 'yOuRkeYHeRE'

Abdur-rahmaanJ

James:
Not really in the spirit of respect and community kindness
Your post is actually really good
And I actually commented this way in another group
But .. you didn’t actually cover what was mentioned in my post

Abdur-Rahmaan:
Oh i mean, your post is like the world is doing it wrong and you are doing it right

James:

Abdur-rahmaanJ

#!/usr/bin/env python3.6.2
# -*- coding: utf-8 -*-

# run script from command line via python3 keyword_search_github_repositories.py

import click
import datetime
import time

from github import Github

Abdur-rahmaanJ

postfix = ['111', '2', '+', '33', '2', '**', '+', '1', '1', '*', '-']

def is_number(num):
    # quick way
    return num[0] in '0123456789'

def eval_postfix(postfix):
    stack = []
    for element in postfix:
        if is_number(element):

Abdur-rahmaanJ

tokens = ['111', '+', '2', '+', '(', '33', '**', '2', ')', '-', '1', '*', '1']
# 111 2 + 33 2 ^ + 1 1 * -

def is_number(num):
    # quick way
    return (num[0] in '0123456789')

def to_postfix(tokens):
    operators = {
        '**': 3,

Abdur-rahmaanJ

def identify_symbols(string):
    elements = []
    num_stack = [] # holds numbers
    index = 0
    while index < len(string):
        char = string[index]
        if char in '+-/*()':
            # Add number to elements
            if num_stack:

Abdur-rahmaanJ

def isbalanced(string):
    stack = []
    for char in string:
        if char == '(':
            stack.append(char)
        elif char == ')':
            if not stack: # stack empty trying to remove
                return False
            else:
                stack.pop()

Abdur-rahmaanJ

# using rich console

def ensure_internet():
    console = Console()
    domains = [
        'https://google.com',
        'https://yahoo.com',
        'https://bing.com',
        'https://www.ecosia.org',
        'https://www.wikipedia.org'

Abdur-rahmaanJ

import ast
import os

stats = {
    'funcs':0,
    'classes':0,
    'analysed':0
}

base_path = 'C:\\Python37-32\\Lib'