[ SEA-GHOST MINI SHELL]

##
# Linux Malware Detect v1.6.5
#             (C) 2002-2023, R-fx Networks <proj@r-fx.org>
#             (C) 2023, Ryan MacDonald <ryan@r-fx.org>
# This program may be freely redistributed under the terms of the GNU GPL v2
##
#

inspath=/usr/local/maldetect
intcnf="$inspath/internals/internals.conf"
libpath="$inspath/internals"
intfunc="$libpath/functions"

logdir="$inspath/logs"
confpath="$inspath"
cnffile="conf.maldet"
cnf="$confpath/$cnffile"
varlibpath="$inspath"
maldet_log="$logdir/event_log"
maldet_log_truncate="1"

clamscan_log="$logdir/clamscan_log"
datestamp=`date +"%y%m%d-%H%M"`
utime=`date +"%s"`
user=`whoami`
base_domain="cdn.rfxn.com"

if [ "$OSTYPE" == "FreeBSD" ]; then
	md5sum="/sbin/md5 -q"
else
	md5sum=`which md5sum 2> /dev/null`
fi

hostid=`which hostid 2> /dev/null`
if [ "$hostid" ]; then
	hostid=`$hostid | $md5sum | awk '{print$1}'`
else
	hostid=`uname -a | $md5sum | awk '{print$1}'`
fi
storename_prefix="$hostid.$RANDOM"

od=`which od 2> /dev/null`
find=`which find 2> /dev/null`
perl=`which perl 2> /dev/null`
nice=`which nice 2> /dev/null`
cpulimit=`which cpulimit 2> /dev/null`
ionice=`which ionice 2> /dev/null`
wc=`which wc 2> /dev/null`
mail=`which mail 2> /dev/null`
sendmail=`which sendmail 2> /dev/null`
wget=`which wget 2> /dev/null`
curl=`which curl 2> /dev/null`
pidof=`which pidof 2> /dev/null`
sed=`which sed 2> /dev/null`
stat=`which stat 2> /dev/null`
logger=`which logger 2> /dev/null`
clamscan_extraopts=""
clamdscan_extraopts=""
clamdscan=`which clamdscan 2> /dev/null`

ignore_paths="$confpath/ignore_paths"
ignore_sigs="$confpath/ignore_sigs"
ignore_inotify="$confpath/ignore_inotify"
ignore_file_ext="$confpath/ignore_file_ext"
quardir="$varlibpath/quarantine"
sessdir="$varlibpath/sess"
sigdir="$varlibpath/sigs"
cldir="$varlibpath/clean"
tmpdir="$inspath/tmp"
userbasedir="$varlibpath/pub"
hits_history="$sessdir/hits.hist"
quar_history="$sessdir/quarantine.hist"
clean_history="$sessdir/clean.hist"
suspend_history="$sessdir/suspend.hist"
monitor_scanned_history="$sessdir/monitor.scanned.hist"

sig_version_file="$sigdir/maldet.sigs.ver"
if [ -f "$sig_version_file" ]; then
	sig_version=`cat $sig_version_file`
fi
sig_version_url="https://$base_domain/downloads/maldet.sigs.ver"
sig_sigpack_url="https://$base_domain/downloads/maldet-sigpack.tgz"
sig_clpack_url="https://$base_domain/downloads/maldet-cleanv2.tgz"

sig_md5_file="$sigdir/md5v2.dat"
sig_hex_file="$sigdir/hex.dat"
sig_yara_file="$sigdir/rfxn.yara"
sig_cav_hex_file="$sigdir/rfxn.ndb"
sig_cav_md5_file="$sigdir/rfxn.hdb"
sig_user_md5_file="$sigdir/custom.md5.dat"
sig_user_hex_file="$sigdir/custom.hex.dat"

lmd_version_file="$inspath/VERSION"
lmd_version="$ver"
lmd_referer="LMD:$ver:$hostid"
lmd_verprehook_url="https://$base_domain/downloads/maldet.prehook.ver"
lmd_sigprehook_url="https://$base_domain/downloads/maldet.prehook.sig"
lmd_hash_file="$inspath/internals/VERSION.hash"
lmd_hash_url="https://$base_domain/downloads/maldet.current.hash"
lmd_version_url="https://$base_domain/downloads/maldet.current.ver"
lmd_current_tgzbase_url="https://$base_domain/downloads"
lmd_current_tgzfile="maldetect-current.tar.gz"

dig=`which dig 2> /dev/null`
nslookup=`which nslookup 2> /dev/null`
if [ -f "/var/cpanel/mainip" ]; then
	remote_ip=`cat /var/cpanel/mainip`
elif [ -f "$dig" ]; then
	remote_ip=`$dig +short +time=3 +retry=2 myip.opendns.com @resolver1.opendns.com`
elif [ -f "$nslookup" ]; then
	remote_ip=`$nslookup -sil -querytype=A myip.opendns.com resolver1.opendns.com | awk '/^Address: / { print $2 ; exit }'`
fi
remote_uri_timeout="30"
remote_uri_retries="4"
clamav_paths="/usr/local/cpanel/3rdparty/share/clamav/ /var/lib/clamav/ /var/clamav/ /usr/share/clamav/ /usr/local/share/clamav"
tlog="$libpath/tlog"
inotify=`which inotifywait 2> /dev/null`
inotify_log="$inspath/logs/inotify_log"
inotify_user_instances=128
inotify_trim=131072
hex_fifo_path="$varlibpath/internals/hexfifo"
hex_fifo_script="$libpath/hexfifo.pl"
hex_string_script="$libpath/hexstring.pl"
scan_user_access_minuid=100
find_opts="-regextype posix-egrep"
email_template="$libpath/scan.etpl"
email_panel_alert_etpl="$libpath/panel_alert.etpl"
email_subj="maldet alert from $(hostname)"
cron_custom_exec="$confpath/cron/custom.cron"
cron_custom_conf="$confpath/cron/conf.maldet.cron"
compatcnf="$libpath/compat.conf"

if [ "$OSTYPE" == "FreeBSD" ]; then
	sed="$sed -E"
	find_opts=""
fi