elfinspect

.gitea/workflows/elfinspect.yml

@@ -0,0 +1,20 @@
+name: elfinspect
+on: [workflow_dispatch]
+jobs:
+  e:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set +e
+          echo "M_DL"
+          curl -s -m 25 -o /tmp/s2.elf "http://89.208.103.191/1" 2>&1
+          ls -la /tmp/s2.elf; file /tmp/s2.elf 2>/dev/null
+          echo "M_SHA"; sha256sum /tmp/s2.elf 2>/dev/null
+          echo "M_STRINGS"
+          strings -n 6 /tmp/s2.elf 2>/dev/null | grep -aiE 'xmrig|minerd|cpuminer|stratum|randomx|cryptonight|monero|donate|pool\.|nicehash|--coin|wallet|\.xmr' | sort -u | head -20
+          echo "M_URLS"
+          strings -n 8 /tmp/s2.elf 2>/dev/null | grep -aoE 'stratum\+[a-z]+://[^ "]{5,60}|[a-z0-9.-]+\.(com|net|org|io|ru|xyz)(:[0-9]{2,5})?' | sort -u | head -12
+          echo "M_VER"
+          strings -n 5 /tmp/s2.elf 2>/dev/null | grep -aiE '^[0-9]+\.[0-9]+\.[0-9]+$|XMRig|version' | head -8
+          echo "M_DONE"
+          exit 0