From e76954441d09f67bb12e16013e95c1905d594b21 Mon Sep 17 00:00:00 2001 From: "Z. Cliffe Schreuders" Date: Fri, 7 Dec 2018 13:43:00 +0000 Subject: [PATCH] adore rootkit --- .../adore_rootkit_static.pp | 1 + .../compromised/adore_rootkit_static/files/ls | Bin 0 -> 36692 bytes .../adore_rootkit_static/files/netstat | Bin 0 -> 30640 bytes .../compromised/adore_rootkit_static/files/ps | Bin 0 -> 32756 bytes .../adore_rootkit_static/manifests/install.pp | 27 ++++++++++++++++ .../adore_rootkit_static/secgen_metadata.xml | 29 ++++++++++++++++++ 6 files changed, 57 insertions(+) create mode 100644 modules/utilities/unix/compromised/adore_rootkit_static/adore_rootkit_static.pp create mode 100755 modules/utilities/unix/compromised/adore_rootkit_static/files/ls create mode 100755 modules/utilities/unix/compromised/adore_rootkit_static/files/netstat create mode 100755 modules/utilities/unix/compromised/adore_rootkit_static/files/ps create mode 100644 modules/utilities/unix/compromised/adore_rootkit_static/manifests/install.pp create mode 100644 modules/utilities/unix/compromised/adore_rootkit_static/secgen_metadata.xml diff --git a/modules/utilities/unix/compromised/adore_rootkit_static/adore_rootkit_static.pp b/modules/utilities/unix/compromised/adore_rootkit_static/adore_rootkit_static.pp new file mode 100644 index 000000000..0c4a1da36 --- /dev/null +++ b/modules/utilities/unix/compromised/adore_rootkit_static/adore_rootkit_static.pp @@ -0,0 +1 @@ +include adore_rootkit_static::install diff --git a/modules/utilities/unix/compromised/adore_rootkit_static/files/ls b/modules/utilities/unix/compromised/adore_rootkit_static/files/ls new file mode 100755 index 0000000000000000000000000000000000000000..f15873f665e3fce9c560ed9cb0bffdcc181e9b68 GIT binary patch literal 36692 zcmeIb4SZD9wKsf{OkjwCiIQkk&{08ykdP=*0z~pPd{jP$gzzCBAtZqb4M|MS;X^@! zle8R;W9PQDrLDH)(%y%*UQ1hRW2=||HwntMk#+`z_HTnyaDbV#Eck1!q6NIP5_(j>SRuO!hizm#C4 zi@5Qz_7=E;Xh}Mc%q*Ab0HuN^xFn>(wE(7LI?JH5qY(REo1M-Hn9fR@URAkqdR2L9 zRb{oZBdxwB?Jgq?qy=yDmlPvplp_N8lMgrF1e~T%FBfheTq;~9+%<4l!||B}m%{*_ z>)_%B)epd(58%I0Z1>MLCVUj>3jkAx3I85$72qBdb^zZKfxiy%I{<$hN>2P@r0)Z4)o%jm9RN&SXZmKO zAC5?W1L?Mi`f%83LHaKdPyCyK-wBwqC%h2O9)VB1_z1WQ>D|EpxtZSsUk5zPgf}C7 z5b(c&F6r$hy|38px$p^p1M${#we(@=djOJ={xW=~k3xD1V2hp`aWerQG1F^N&Vq>a zy}(}uxDXA-{9i@72k^g|_=f@S0Bn{26Ttfbf89*ycyIu4EaI7eC+Hmp{4RXL+u&LN zbKE7o0Z(m7@@{ReP5;J=&jqeveF{JdG-0r+;m&CWhS{7>ML z0dqVcoQ?Dpz_liv3V0^qC(Zm(;Bx_BOaEs9UInI`kvD`u6Tm9vIq}wrvQtm7-6Y0r-A2;FKQQs86btXI-=@TO9 zBYh^)EqNh1{5TOh0Ji|?x56iVsib7{)|%>)dbzYtE-8^P#g%btyGJTnxD>JFmDMFm zeMLF&m}KH@Ev>AUhR=jRtx;rYQ>`M`OSN^C)$%5(zCy05DJ!k2kTzCUm&+A9fFrU- z1}nE#NEJIOWoc_^6|kjEHMJGhQoUSPR=ZQ$w7CN0HkDP?)K^HG>MAOvlA4X+wd{)} z8!I-0337=d%cRQsQd!<9m2Rx5lO^P;sNN=(R9BU3t>0WyRw|d2Rm*i!MO|G@om5kc z%5EkSLM2r-)teaw4yCOXTUja#-&%_*1HZZk7$8ttQw^+&>hj7usji~5oW5X-fiP3m z72C@^O7$0|dQ$|Os<)QPWggJl0k&m|(Fl+R3<+S$b#-N)I{MWt{K0zGpiHJ*N=nM) zowXGu8>|rY|FaR z?W`+`71Ay#*<^6Fb!%y@Q7utPX{!SMYo(3#6{TR3JTlLwiW)R7!lm^UhM){K<(jIR z?G<$_rgpnhS#AWt4Fj9&HXAXU$sfs!<}QIs)gfaEG^PS6RZ>;GG=I^;y!?{8($d2r z+9omhM>~`MY^HBOLw^mdA$TZ9WSkKu?x)ci!X`%4u+o?>%KUdX46#J;MjPmB=zDzF z=c4g9p|Wx;)A(5PLKIRG0Mqfg8aT8f4W|C>m_&C((BT{w zd#y2d#llGB7#)j2n`2WfCTEU0u^0q6HpIe6T$LDW=UB0pKFZoaA9G4MeHb(z`lw44 zeHbaV^v6h&OdoUe4*D=KchQGo)IcAcH_{)6F_u0It;gu2B7XWXXunP$1I+>Y5XO`A zVJIG?52NM#^kIY^rjNn#Y5JJ#kIpyXa4rq%-ty#~4lj4oNyk9|m0yeHdov>0>g|>BETYr4OULk3I(dkLkmx9i*Qw zNf+r;8PP7I??QXfhjC@6KLhPS9|nB_{d>?J^kEz&(}%GBbzW{bN{dusH)OU(F$4P7U9zXsiN%H>sV?uJQzOn9;0kvOS zck$$LM1(Tk;5amSIsOtMG=f`R!aCsu0e2DZBP=$q!;dH_c0{)orOv1GS9weMYc!Pj15?(;q zEnxO6kDG9gfZ4-5G?N190%lM1Y#{6uFngTGLpVXe?0FuV(E&-o?17#gg!?YC{_KgK z2Esi8W{>pjBitom_DqkTaI1jXLp=uw9}zHns^=i#g92uc^&BSb7chIS=Lq2j0ka2t zS_sz)m_6CkN_c~S*`qz3gx!EM{<>cMv-kXS+R^qwv^OL<9)A)IzyJP}fi{fw zQirP-emXD0RT2Xw~F~#mZ8NKiR6!n;vpB!~et4|o{y5*R5zfJ8^i{htrPI)=& z*dsA&eLSeE`F3xwJ(S7GC#3Z0(;?uDv%%|p+a$zmuHMj$10Lx;aQXwJj!R&lHr@JOdi)9gOv2 zTkr|EeGKwA)C0VdRURLxc)mhXtC5{7w;u8%-O;!g_`&6(P0Y-rky$;~%m#K~Df#QLyp^ z_%zb=SByw4`wT=Y@;8OJ*b;NoeXtmsTae(@V=_)drrQd%u}1(mos?%a_b||^WN6vv z844+PXk)uXqB61hgpru2WuG$=)GFVur@&s)l0^2?$~6WidyBp%c^Ky1`pYm+ zwQTl)rjR^0+=sWs=`UOmZ5WE3MBxdP;7!n-F!t5jd^Sp)(Un*=kSO*e7Gw^QWN5oB zbg%wv7=i2IKMaD}e4EemH*Fgjeco5pHHKwSy?=wN?*Rp4KLcwmU1QTS}qa zjzUCpd7h+DqM=-?9`LY{Jpaas4-L}I?E0!JJhuEE4XE}TV~Wvzd*jh>wcTjYizuAc z=!hLOL-I9y*uUl3!JU5ZV2pfY@Iik^EY$~wvWZ6x3vN{VjrgJbBK`|%KPtB+N`FQu z4!WXzT_gb(DG+Zl=@J;?Bp9dm>)wG-$n3K}N6k87pAGZ54}H!kkzL2g`$9OiH5_6W zA)fxre)ji_)~3^rueV~vISzt{I+5BD%l>50Iu{PH-x+b|!y#&w5!V|I^@T$pheHws zZ{Q^$V(G`(x@TpDa*=$lJ~umFk-qwVYNitkb&clg^A1Xn#2sSB;3Dc=k`r{B zP8Z2zn-dVqik*bN@}y;3Vm&>m0*1w(!c@md##9ubiVTN{RY>}J^`OvZ6zVaAXajBX zr+@$N=2+!u`tB(30E`=Zp+Juz-elI%*l46gGJN<87QoKs(4;2kU)lbYyV2H^J41o< zNQayZ-7wOq5tz87K&O?)mJ`^|A;xcxf>$Ef5zEZTD=8BU_5DET4FoGx=ZV&wLq~wo z5o;+{M=VEN<_N3?@s3#PkSOa5EUP27(}HIiFtZEvJBMHzB7qwWn7S+S#|@c@c-7A|{-$o(?|mlY83zZx+6mZ0@j!ozell$ne~ z{m25V-C@^IQTHs*x$b%9B>0&3|OH`B*H&BXyLy4iSrO9;Lr*XdU7k|e+ngvIzMB; zl%IgVYtl1o`sP(2@?`^uBZ0tq$bbg{8|^`9GZff>6ww~+`NTEkZ-l~FvyA-bEqZqv zFcl8fMf(%JlH6y`x8#16=x+}7F<44k(oE#MO!RXQDNibb=sOM3e-$hINYOLbAz~S# zU;42a1VA`&5ACmT2MFwkG9C*MD^KE(@JEBk_irE0BeNYMR-yhIP(<6ZME%~$6hwk%duk?%JVed{=aB;0 zlaB>MeEb9324OzjTG9fbUe3oN#2RY)7lV&YBluvpL&Pf7=ST4IlSvjI4djD8C$M&i zj{|yG9uG$H0eQHAdO07<5o^ffLxYbuQPIdYW41%YD%4*BMN1xcg!vdmkz!y9oPnSq zk7hOp=G=!Vn6HCNxBd>!Cn9CC3K*C3vKFz1O#aK@rEml<%yx)ah5FqQynN?2LnafR z>OpBiJ9zjt8!e;X`$?31t@o2?V%G1&LfC|l_%Pi z_CuaQSab}J{~a#>z}U)=V%HD#k&@Fp7;-fI24;p>I5kfIt&(-eEn5c}v3}ApWZAXk zjQ$Q6_W`5~*h1cr&GBUoEQBV#nDBwkzCUVCww$&nzOhxFK4+FZHF%HOKWD9MpR-<0 z2;QmozeH|x1Eui%FR{x8|K`_<6SzQmDHdR0K2pHWr_UL^y$DSDwW9yedBZU!A9^Ff5U~j%2n+#d&pGq z8puQNJjSno<*$a#hqn3B8j$09KA8((dq%4_G|KTr>w+;@3uFE{5zjSqL_06=Tm--R zfA*UCrMk{I8h;O=H_VhAjsJ;2%jmz^>{+cHu2YbZq>S6t;p(0{x83!I6ucH|lPxix zQ9$syy50Kd_XQPbPe?hVtGQU?bVIRJSC`LqM(8b#E!PR^>7{5#<4-_v&sguJDA^e} zXXt_VQjDYVFNpVEvN;-gDi%0Kz0h1|_9rx4xKqAqPkcsy<7r3Zj}aYQ+i+o)vN8u; z2fhQ?u%8q4f6GDGbxJEf)trt+x0;uLnrp7Ekn4<^XWJ4LQcn0>U1|~&-MXEt*Wy#; zE&3>RG_X|A+Ar;MbtB7B>R@2Dh!cFU_&WgR>?{5QisnQq1#T4SE4D}|$2Z}>5GA1) z)q4UrNKlwtZ^l%?GQ6#b5z>JEYQ<-Kc~KzJFf02g)Cs-vG;(TVCG^^i5LTtrAzIbd znQ@l$M(F2^4=J5`@IAA|kXgp3DNgE)1gBy8IleLq%GuPvbElT%K?zN#SA_Yh5`1wA&N29MjNpqI4iU@X>l74rbtseS zrMnTc ziQ2bBtI5!fd7A#7rauJ19b&>wpkDK=%IdyCD(eTGmb z^XPu73_`Xr11t5{b?hs)4(&xXGn22tPL2*StYwM{^n;Iyf{(MG$;W_EP?(Qp!}+jZ znGerH6vX}DB|;FQv{pGzOFALyFMG6X!AnTK1*_VL;aV7C96K!c3iLP6Zcz2@?p&$= z6veJyV+ehv{`Ox!rOu+lY{8_1Mv1ZdCunG)@Mwwa!zE%j=Y69%V>c&Kx3OECu*HrZ zqvzw$3Fg+vpoJk-y#WVBY7(K7<{qpzkq}g{>8!TfF5m3ieigL)8v$qq$!j42lxl1!U1wBtp7(f_k$YFCuVQe` z`i}6XTu1EFAi^%b?zlN-XxT4d{Py-%HHEZw3CjBB9x76LQ@_~Sl&9j%EK}@+_S${( zY;M|IbKkLQo1%@HENeA;?34Jbr1@-P4l(4j z?ep1Mk+ZEQ8k?!CsQv~{1I3mi+gRlC*%kszOJXt*I|`!Lq9PLf4fM6*c=Wrm&D`#6 zYIQVbU?hR%&@gkl9NREk!a0Cq56qxE^tPJeqweOdjJ85}r0@S3k6&f)Fp zn{q;Zm*!>B3cb$QG}OlSpjgab*IW({pfTB6D{SZ1fG^z!Dgt-T8bD3m(bDD%S3T7ovmSE>*O9ye) zuZi@KLo0oT@+BiqY>pv%Y4ed6-5xqZ{IdW;%M5(Y-}XC(%gQLH)x9wsGTOCIWWfx zwQQYaLdtDM$Mz)_`Vvpma33q${jF#f^V{01*Qy0queGF!Mu0-Z#1g}|!*=m`+yIb1 z`a$q|Kj>RX;Toxn9^HUFIQE$${cWSk3^`gT)H4v&Guq^00o zv?U^Q5IId#;<00$WbIfhR}l;H!e+PM(AkcHM?Da=6tpvmv!<5R$!eaKZ@1VBtG2fM z(V2N_SDSvbZ$?7frKn)?mGnlFADy}Pk^>9-N5*@zMX%n2&1eR=4%vI@dtZtQC&gMx zw6OPHnw#g49=XoQHEPc|BbQi!L}RH&YuB!S2Z!`(hrwK8jv@RUw8SCyUv#~6$2c*Lg~u#lQ6m%{iD6H!Uw*jZzUhiXRl+;n=Wy2mn!RN@&*Mto8nREWi9q@# zkRaQO>IIzf449+9)Z#vn_dO6b<>f*>m1IuD7pWbfvr_K|p$As4@J*Oqq(5LVuMS4a zL7YEM$Y|vdW70F!c;Gd)D|dmqSO>?BeLZLfbTW<|6GU(I8=9vT+~8S&EqBM4p9Y4u zI3D8-_aH+vZqRwdPz?5t#;-6@41?O78ye`>SQT2_=TK*0P&I079;#*)_nOP?-E%X}cDT-icdToMD9IDG-RGk^ zd^3_SKF>w(M?dho&R2zS3@avfEDkZ9Wfk}BI)#H&L)JnE*KuCvY44Wln7@nkhb(22 zV|=Tk8fIh8-Jc(Yb$r~MG$p>_;b=)2mC+i6{VwKQaS=q!wZ_34X01VN1+;(zEPDMg zM*PjsLNq)88CN$ArzG-Rz5h*P%zXg~O($E99I@FQO+I94c@n{Z7a{1AmL$?ow{#;? zd9dXKyx=57>PGL z&cK^9HE+&Hyy0;MUi#F$^pSXxaWKaW7DMTwyY$!339U1E7inZwr2TqWn&@|lThh?) zaMo6X3a@zpkP;udM?J2W0A|-Yt0ZIoOJpax2WUGC62aM!1Jdj*v~%4&bc+1V30ayxwAL39T8bI@~)3Dd2|U@f$Im0@wiT5bia z`QX*tUS(w3^;*ya85v`6;CI+^@|)ogu{~vl|BkIGzg5oedq*C7d_8N<2=xb<~tz4aw-pX-2I{}-^LP2^#sXdl_$?m8j` zv(V3c%;noFE%~dYB^`$JvX1SE^X=`!=4IBg-Q%GOKG%;yf z`$adh%PC+b^kBl4(Vi1%i52RA-i5-A*&(BqR|9nX>*aofgwXDT5%NVdF zv<*fD(Uzi4GhrulviH1fQhn%Cs21Bpb;%T==Qk#%8<<1ONG-b+WCmVi&OsHMjwb5b(o;v1My?laC`npQu=5RLN;|^h?-FwZ7k2Ju=x3cmPG2XbH=#^ zQKv!lI*X=Lzh~Monm;#mS{)cEAyI3~q;=xj#OQ2k1I({mz?r%zYb?)Rp2nm_n1spp>2k<>b)hL?srfxG3qB6zu-C8miX_>;T?pGEz zFT!$0Y$Lc4*hZzpDm@2bedZg2xW7Nv0}%TNMd9^3GwBPg!U@@y3Hg_Y>Jl-su7eFK zRL-nGp;dv;DzDR^H&our;pKIAo0S#iQFkBoH1#WPZS`81+vVZfd;S5j>Tv=)-VlvV zv~KwVcc^YdsBW$PBFtywk_*-Hq9klPdHkg5Q@8GTSls&QD zL1!?=JGfS!2;@!PIr-9#Z?kVH0huRUTsT}iczW>6+=GHgdDNK5bf>Lc&FUh0YN8jq( zj+;34{c(AXC)Hxyle$UJGKGZAbMz%qvv_&io(bN;F>)F9xCiZWLEy_s5_OA{rv`W9 ztllY?>=^?Y$TNb~*t#`aNb=fMT|7M0p>K-GamfQ<0Qz&FF;x_}lA%K;v1 z7&x1P+fbGfb_TbE!?y<43;Dg)%m#r>-O|q3edB@){L2bGm!N6Bb=^h!+Sf51uflTv zx4(l4*N*xJQykA3dHM_7Q8_a6P`89ioK{8wj3uvg=ZO}`fplE3_TEOvHML2$wU4@W zp4vBMP$*0LC~0UhfcXn^@fmOgv!$sOR)CyP6jBmGO8g4_Bg2#z^T)?nc`rr#JfI%O z{;wSwpqa5)UBQmi-#vq=$@OuR*llE+S*zC6-;1s$3cxZvTgyCyO&qAsRcLTe7s5DS zVUTi)4%?(|hF>wloec9Z3REN3Rz*0U6tmZ9*womS4b@u{m;N4j0kSq$Z1A0w zXB1k~)Of9E_#6efY5Bt@DE(<8_p(rZd8j@SJ7#AgN24RNUYH-W{6q+tW;tzHVV*+< zlp};!q<*ybZLtvlM9RUSAF;bPT~9!hf{0;D?EOTn)FTjb^bd@}!w6WQMpD?Nzd8b; zbvQz{{_i6Y8h~(zH=E;7lyZ~z-G!0+jd$vgM53GG9ex&xWuWGQ2@^u)aOJearE^nG zN!BJ#z`j4)d0a*akyjxy(1SlC=GfICEt>}fQEy`4xgB!SuFHC3`?bpop^aU*c;?nW zIW2?&oz4}z}2@9 zfXrAPX@+$b76yzsy(zTDXZszs7t6W%IMl+*l)8$`vQ%AjoDT~9C_)F-lD(fuTCMGo zi99p2JC2SrI+I)f8w4>AIlae2d)~RMEsP`KX6k&#Y3v$4aqNqy?doe`TkI;eGe&Hx z_!dNInPL{{mt(wb(feca8(a6eK9J>RP6uqyYz{zd3totlmpPs*{=j>I^TCDq-BZ06 z;`XF@FW7fY5q7Hg!maXnjFlIhI9JBGqxZsE#Sx74qYEd4dN2`m9M8Ev=r5R$Ng>wT zW(!8;T4gFvX%od1cvj9~-Q9_5m)WEZkhBA*?a_D;z9jk$>5otAMHXTIHNC2P&_YxG}8b+)S)x1e3U z^UX|Hs{dx!@3kaeUQ@fguHNWx4eah!k8@BHcLCJSZw-8+wwX7nqT0;Ofvm-S>f-Yb z9~BgPW~!^F!*vc}G57B7)0A^i6vDw9{MtGlO&qhXw(I+VnRQ#+zMNyq@ zeY!F4KvKh4wBfR-I%qVkYMV4q|I&wT!cLhM1hK5+yJ0GtR`!-@`rlv0v|nNj1zVi@y8wYDu(OUk9$Sxw9YT-O z+l_RqV&S$1=R8$a;&GXIotAB*1r?GWnZ=d}`HG^{Hnj^OwIk~vk4zpSI7U}M5a+jJ znd4gn|Cqv6R@5uO7VayAxpEt&<_DXH-TTM9hmFS%aU&&-)-ldz5*qN@yF7twzBlC4ZhW8G7E($W!N04EbL&Oqf{vBjc z9Ufi4zzHk?b3^Z|OwiZAj8d=%CpDc`UFVc*VbS+uRD=GR14}R;VGQ+{nC;CoF(JcL zYPNxT@HR2u@hW|tjr;b8PKuH+0m1Ct(TceUR57UZDcu@|7aA4(E`p=+Bp60E?IF9m zTgN7{qw$xB8CpB2uMGV5r6|l5zJi<0Be4qI_jB&@>(8K&4q#(APDc6dPHZQML$eCq z+u`g0>zvVfK}*;F6;-!R@Z)tEIn`s{S+~k3F(oAF<$$%~b7}$>Gl4;91?#!EkKN-z ziq7*In1#3QjOBtOqK zxcJe(IlkKJ_~x;cWBa-sM_Zv3HxS_uM4&B4gl`@L&dg)V)p~aa+G6oJl?%&YjoM#` zT8ES#3VtGGY25H|G^U%Qrh>a8Zcq`+DOiXpzlLt$Fq`*xY&WAY?DF7l4~_|L)>DS? zyG-^3Ex`a`ElsJ}6vczfr-Hr5`o!FJ_Q-3q-5EJL8$Jh77RQ%0kk@U9ZH z*!xgowBt)uJS`7ublY>Rc`Ha(Q-+*#nTYTOdh*n=$`!Y@se3+*e_XrFd%R48h zqNOz3uhe7e@x5D1bJh1y&Glo?IZ? z$~jE!S%M%=wK}y$-GgeU`toE!smI_Mn3rc4>++2OzRNb0 zu~^Sq-aY7O`jQ#D_#6)NPpV3{JY6dW-8U}&bGkm;UBNiN+J_7=1#etLGvYiyUZ4LT z=GcNW&*F1Ur!^40hGR%x0{Fcc=r{YX5mVe9n95-uay&oP)sxjxH)=`;*VHk)A-HqU z56o+yTV$B?B4vhdV9G4hsMY6`)^&kuXfJ3L>zb?6kknelP=1!A&fx8%{~1ZeLuW6O z)r}`iSvi_6Le))qof#&tb~F*kJ5yd~VwQJbRJ#K287&7xyw;vI;PCDvoMYn!Kx(8= z4+Jo{b@_c0?$cbS+JaFK=iLU^wtwEfxa$_x6&%a5dFzdh%zH+nkvASU8Q(cteKW{A zE_@wjwC~}ltbsaz)(f4UdMU9q%b7e*N%-*cOhq z)*T^l?+i{<34G~h=pVWcMzSp!j4p;xnFn6O%d1brD%9V?BAN4J4$QJr?O|)UE7EsE z#W~#7WA&|eJDSP>XM~Q5G1lg7x6RjVccaxOinidv6pnQlnt5z@Yi=4~-RdCj5iGc+ zJ1`k3Y)ej*@p=Y!8$g>QSC>3Ha?4QVExUo=7U}P`nG(Y*s^b36+fYNl8&hEyDFh8U z0GV$w`CPqlI^21<9=LOG-Ee1wQl;W8IPZxR-c(J%NqR`>#jFxix~&=J94^?pIa6Dw z@I&%BW;f--!E(5S)_@~RLQ1+J8H_KG%@stGW+Gdn`2$oR;uGiCsLxrWK5DmR{14e@ zyEx6CY>hUa#qf>JgN9GnU8Yn9L#nIM(b$TlLZ53NWYCDa zFrzJz%5mP^&)(>GoUd0HS&<%1={&nd(w(gsp)lDxy*NI?LI^F^sGogFGzVB=;Yd;L z7b(x`xh6U`c^r*PIG3z@R=tF_b{FAdU8CL{=E>1`J(8o^rySq&wn?_pAghhee)AgJ z6Y|XLCv4ZeiSci719shUSs(NFvn%!Y4Xi*P%BH=EiT}q&T>^hZl%ZE!Cg{%rPuO}i zRnMxcU}nCE^o-WMb4eZ-x1n*f)qI;g74Je~s%#rJRsK17%xmGP@-{txpe;7xJNy7>w66m5Ru=VCTSTbd~9r{14PUXwpxiGtVp$!dOba0%zg1}L?- z2f~KSJc<)-&QGGv28?DzxJVBoj8-zWIC#B*Lw$MhMdTR+I24dA-_g{Azre)JyJ_fi zuvEVV4|_vTok4;&HW89_9BtA8^cUntIn`I>YeP*U?Fs&M9F69AkW+b2`vu|sqZ)Cg z@nv*@Ik!0)`3ix7t^VR1>Afg$t_zMcX$VRbp&aKpdQ4D~&jY$v6V$OMkf(}}!HFig zf-x+3k+G&T>4>tinJVJJizugIE=Ik%LoB@5O%}`|gATu$SJ2!)KFkAZDW7k+5Qn?4 zf-KHU=BZ{Vj(ecMOfX7lA1%#SMOn=`(2A^BYFk~bz8;0bq<@ihwyb*fRp{Tq?^ozq zzcvRS+SHux+$%ytIz{?@FJOy^nyDp`k~*PF6HE`C`KhlC{GJz`KK@k%ksh?)N)TcF ziu8YgzL8&$QrC9bLZX@T(D14t9Gtc+^b5AXM{;6Ve2UFmWHh;c0hEP?D5Kj&yT@_l zj|&M2=ucu*DpKVaQ5}Pb{!J@VxvlVWy82;@qN9o5l^DubLQVy12FV-E?itEt?TtRF z|H{a1;8|V6+yfR;2fZe|Cev3ADafPRdhk{Ub`r5Pk8kUVaqBOGIdfev=ZoRM7ylnX zmD&Q)IKGCkFRFj~=m%OhTM#>Y=%@G=0^{`>@CVL7Or6MxLqxGy5a%Qijd8k3D>q(? z#&*Zaz#uqA-^E7BO5Bge`^7w?!agS#_?9-{C_gte<=DJ0_|_&zDetUN`-a{R0zNNq z7u)6AaNj!eqYlh-JnGo}@~Hi;gniL@*qV5AjrCqp5pFJEBZ}wQ>*D2GeG{(AdP9sl zTckqWhD$@J3WlewH?D8J<(S$Pj2ElAueUC^rA_UOIL8{g8;F~3Aw0bM0n!7mL@0~o zTN@XW6SdtF!fC$5tAeqdPu>6u%|0w1b~}x{=FO4BI3&>yVbY|_lUmKBl*^NN-o#wf zE>FTph4TV!clxlT32}U%?6+J}&omNP0hEufCi#|ypRThOgj; zXf(cC|K=~DGCX^Qgs=rL2SX`$YG6*T(7z)D8NX!~B39^&#gZuji-z``&~#jYR+8O% zvLS0zUh?>MsYDnk6LQ@8MUVzzOHfEl6KPJQ^@P)eq{3;Fkai-R*2+p}sBJl*k%REh za^!1%HkJ2B%ssdO_s2jK+cHXuTi+kfDI^K1Q$>l>K(#uYCPay}X(BBhX@%i5%5A6? zGmv(Vkp|p$2{%_~BI-6o(eQ-nkNO3tLm#+?il*fcycMCl^dr9zbw>=gJ{zw;uR;mHVPuCgd?_#QnDM`=WA1>FwCjVTFtVJA8i!?VDiiG(#_qjb+W1Y{g8lVw_gYBr7Jx zjKPlk;&}D?{o`?#77E7X3xg!F;X;Y*Xt&2x2tm88D)Ssb( zSd=FOc#9JCLIy|EVT9Xb(Ek$i)f<9Q2CeHGE~LpIm_ve7NpKnomf(!>RVUIEg;`w5 z`D!xD7L5~(HSz*4NBJ0un%(E(4L{SJ0@cc-$=#5M=xq4VeMi~UbHY~4!o9e z7Fz#cNM5oGy^m%GzSgC`5Ek(?qRlxlbTA@JjI2I+ns;|!NExNB>kHcb=7B8)8?PlE zz}f82&|NViU)6%v3*pvzcQ7WR%Tm8_cOABv_?Fi`^eP<+(>1F~@f$-$e-Frv78L7N+621b6^P>x@I zf}=)bFMr>t2Uh#$MY+}P$@~_ZTmLceSFhrmUmO8v3e%65wN^dgn>X6~_Gow8+oOu~ zCd5GdRJ@U~+p^>WM-VCOH9N+dKD>BxLE3<;@*5E?7XferC?hZrKn{R%0$BhW0HhL_ z1^~ldOD%z$0UQKSMc^82DqN6SF@nL;^7fqaw$_{PfupiNl)yXeMBL?#t_zMrecPi` z8(Vjd!5PbTq4Nl&dV6x@(d~KBJ7A;0OSSSB+Xs$uh(cS+;~RFw?2yN_=fo5l`Ep|F zk;*|Wp<&0U9k@Z4GpZ`o@trS!rb-tPHXCi9?E0Y z{;d1t_1ZSxulYN=@=Cqn84f(Sti`)G`ZJ(sOao`t`;_b4D?L9%GyB$c7U>$41XmjP zJ_9o1Le+c36>sr2vk(>U{EE`Fc{XdJ2)Da7(cpvTFm9%$>>sty^^qSNCHsp%nwcP8 zBU$0rSN*#=%*Z>nHN2MgrZ%w!q_GWmr^o?%BlAoO=UHjy0e7(Hpps^#)DHc1ngGYS z+~PZD&>PI|*b};r+d44@_xKQ>;1T^Mp_zr^8+)oKedIb`%Y5OV$TR^w4axKY7A~e% zA=APLncfR7hspFC#5H8fLWE2ixUx(QK0aHfwx=(bX)7pxmQ1^TY~>jy)76L`lBpN^ zV#xH*2#u7f;GPl`0m_tx3Yju6Os2R4SZv3jh=WPA-Igf52L+icJ>^=r=V_=QCdteN zShVSh&{uZ+ZZY79wHwB@1dJ+0`eBQ2aeh~%AH+xqT!G2)kN384HF90NGS)g6$JSE_ z_Ncwctv_H%%FMknBDc|>z#V$g%E*yUrM5%eg>l~i;g|>I&g7=tdUBlDT+TKmX9VsJU_wcl9+TM-A zr5km0Frft3`Bu1u;blhQM0-+h<(d$;(TDPcvz$a}=!8B)5mRl1SK17E{OaV%a-5qK;D-U#^7 z2$<8)t_ZjQaGeSB)c_0zQdLBHCE$$_@D~ANM<85YHQjB>enC0@>4woE}o(p(P1e`~t2zVaA{=W?IL-+&07QKal-;PLM1o&(OyaaGp1iTDz zdjwnv_$9y=Jx*D_ihz0B^Jfw8a=`x{0bd39FkpDn1dKwYbI^pHCj4!{mbUSp=o4l- z^V|#PkAP<~a>O%pBfg-2FaMO`BkXn3wu-uXezM+EQB^C6Z^_H08|y0{s(`xT^YWW& z>bBx*^mP?w3h=g7NDnGCaz(26aC}uIKE#giu;UB!6`SCy%POSG&DAw^_yT`rRYfYl zNRMyCm)6%;ZrW+4q;A9~`IXvwskCZqO}(6oZ@Wv|E6ZhkGM;7DRgj+w$x~Tgky=)R zPx04OrIvY0>*}HIshjI+lv=4;*;-LoS(b|L#;5X2@n5X0s@b?xuBewPt82o_;moFZR8ISL_9Ez#2CSGg6+mOy$c_M zV!KnfQxHZJ`Z|7zK(s`4O|?mZd6=L1b^z}|xUF!T;Woe_8ei8hm6dw)X8`a64B)V= z0vzIp2=HxxBQNt?WwZQlFHXF2BMW0gnWIk}v_OEg`nuba-_N2r=!kLIi}!iJ(KawR_HpMqaS za#C*uIK??5Eqw>uPTIylK$u+boLtW?H0)VfS1Chs&W$^rg_YEla%T~mrD|(wwX?Lk z+*we%t+L#?xU}s4it2|dE7IadP{^;T-C0+;*&{ns@~1fON>5LB&cn|~IE!jF$=kuG zb6$;7T`qpsVVZMcby?bo{L4L+^-lcfZ%#Pt%}leM^?+m#V-!ft3As7TP!g01K7M3@ zKNC@(=5#LipyM$AlBFXEo3#WFb*0tv&e_iD8rg|Ps20Q)y9)Ccc`tS^1{Tm0zsdT3u87U|qeeY@f9wH!r_n-u#8L7A;v;ShRdr@v4k_XJYg)Du5r` zs4!|FNZk2|lm=&|TE&Yr4v|hV%(1r_A!Ece!eWT6d`M`IvkaPwfeT}8CR zIL4nb!{;O7B$Pi1ZU$Td+zB{~pED6*D{iE};afI)9PoC*KLE${!|*NMZ6+Uy@F&5| zfGdDo4p$4;0QV%^({Nuxz8Bz=#wq&XGqSx~5ub1nxNs-n5}Svo??asb|6=C^@1Ny9 zt8P2~H`IIDXOz)krp<((6M?q?VRr<4r8=w{k-ou%J*Ho4`Yb!b){5 ztUob#V0c!HsWeRZijxd11gWrC?Hn?Lr#$&J+e={lmVOonc#=_LliWQd836 ziZ~AnYt>A?)Rs)@*X7mTi)iqT*GEs6&N0d%_-bI#Y9} z0UTNpIES9{8e#WT2`;zRR#ifI(u84$x*=z&k+W(jhZQn&awQRF4aPF;co-|&D`k&U z5Xd6|W7T4C;Ys#pJ1_F#l)E`3GTvuA_ zsVsBSY%MK=aZpcE`6CDnfkFxv3upjiaUwF64PlK42^)pTp3>^guu)*B%r@$uS~bgA z@2T1D6u%*cqWPq9$x~CeCVS-q*OGNc9R8YXG3Rzq1@wW&ERblo@;Bd{at$=2o|086 z>pjAXH_3$wj116fq5;feoLftGIyY80H;6^X9n+i}jMW7~C}cw^)*p9JG6fVeRj_;{ zwapdPSc=NfGDXI(yg@bV(Wbzoq+MG}%j)kCx?AqtiX|dxm0PsL(lC;qkn)hCTk@`~ zu9xvsY}8{41JOe8^GL^96Jd%xSYTC%UM(Q% zs5NjwIP)oDYxy5Z1ml*c5?dLRMQs&y2yG+w2qFhGig)v{T#-PE(e=xx5N#m~G9t3w zxyzTk3YVC;pEVX>f27RACauQ^UWJ91$VhsXf*v;|B8z0$7!>epdlfsJ*w5IA9tGZo zPH+j#%wJ^Y@ZLrw0dzTMM*3YdoEx#A{$l+!F+yf$+(oUg#TvsoVgW~Li%2bEqh^TS zutBA^hQF>SIy8oi`kh-h)>L7D;_nX%ZNI`eYf>UprB0zmq)2%f%E;2U4iz^dgxXe_ zOGYs!qqk5+v3|z152Ywa*_fax9AkPRxh1TOx%)Jno*`HKXra-yoZP3v6jokSeFx?= z{FET3skF^$q6cGZ3B*4085)?K^|cjcmDpF;9E{kAGAIdl%@k+x!UD{P7zE}s z5HW%XzF3u-Pc5GUy@EK!(9IcoNYP2B_EYKn&kRG$SgoNQz6hGw+~ZGc4ihWZ`1mPL zuIfb=p&$>E!sWYnpky@7++k9vsYW%fGzS)vOnB2Vf)7I->XnVw08NV{j94WG(>fzF z#v(90>@l|&F{_{}U@k*f!w!uw2`I#(VaSnyHHorwiroimc#@C}JrKqWw3+8xyYBQAjPrpl|IAI#XA%ufvu~#rQ7@OfCB71Gd;8gzYs=%>B;P zq1l2(Tvo8yICQ4Mpfz?9MUcvvs!&GDSy^+7I2+dekj${pi=A1g*dW0Vrb6-2**MDy ztO(_wNjmaKS%qOs)|ja)H(}G2TV+=?TegaM0I_Zi!XPkaf1wZL zN*PHY3|m}bJ6pCS!}3SkQbK$rwVi?zn_m)P5$)5=Z&z#cC z)l{4jg++j{c=5Z!=q#X#dVf|4h9OKl8KmN@a%mA;bt;2-fxd6qa+xv)i?{OD33!`N}X77Y^}sE>0*s1@5C~Wt3u3|Tv674>W=+%DQ#{W0w+;X^bxLt6KaEo%6%r8bhiGfdJa2EEp#X&xM$#w z!o3RjCfxgQm*B?z3-ZII!QBV91djD(-Erwl__N{jT$w-j$@AY%v=z??Q}!Bd(D`MX zeH7qTUhHYZ=Wk8(T$%Zk;P~)daS<-7u#LJvJQ4oYaM!^d(QI~xJ@BuAzW{DL92vo# zD)5WpQ~nRh436&+Cxhwt-ksr0Da7Ql z0CR)E_q}Q9!}bB$~S zHsWfAh^ehYOl39h;iQS63@cko+k_aT*I+-a6orYuA}`7>-C9`&wgm<8hdU)OAq|E( z)PCOQMj%qDIEH`RfHMyG9OJErX?$*j8x2Q1JLVTo!cK&(hw}~}DkkS|;&C2I0bV)) zE1fcsI)8*}^YF9OpFV;k-5zcuB9Dc)3bw{7O#C$w_dG0m-;Kbdz0p}dWJ@4P(4zl+ zIMSnBdVtphyzZL-n2*!+pN3C7vebf)7q)mM>FZ`1J*(WGA#CB%URl&ANrNNsi2F-8 z%7pZ2BNjA)F2ZbIKEz>rw8D`d-9_4xUqT?_VLYF9IN}SD;XNJVJ;_R$kJI#Dfp6sz qQNWumG8qU~+8KcCN7gf2g-%+Dh_r&VyCSknU)e87Z&;Zk@cth{J#I|^ literal 0 HcmV?d00001 diff --git a/modules/utilities/unix/compromised/adore_rootkit_static/files/netstat b/modules/utilities/unix/compromised/adore_rootkit_static/files/netstat new file mode 100755 index 0000000000000000000000000000000000000000..d39385f62e59fb8f0f3474c33817ecf06ce5b444 GIT binary patch literal 30640 zcmeHwe|%KMx%Wx3fh7bIF(@k9gKkQYY)C>tK(Gnb<^R?S)tA)z*7o?^SQ9B1FJMs8-6gUh7ZVQhVZJOREK{lzqS7nR9kG zA!zHTf4sjA%$a#+o_Xe(XP$YUnK@@q?kue+OGrpitSeDTQV8|-+w291Pxxd>fubrC zlq_Y2axr2>VOc>Ba1aKOW=KY`AtWJu%z!e63z24E8EHpbLz#l$Yf}^k)>qPHc@N;8 zKiTXI523-`S&C?v<%vMky$BJTo#8RS4CIS#Fxb(E{VtoGK?TfUmCfsDyJcQSi?gGx z)4wIh=grBNWgsnhTTxkqlx#;NaLYtkh>(krf-n<-*A+5?WaLG;T!1hiVKTxT1YYwH zE=Lf3WCpH087T`8e;MH_go_ZqgpiG(BJjErf$}2{vk@jDWFTCP;6(UKFCmvP$WsAx zJUC|7MfvhdLzpg73PxRClrgW%WE8#6FjG?yQ;xh+WfZ+%iqs`hNKqU}&qbJpFbQEA z0)|3dIc6Lm{VN!~@0-v$#KfI|_))+cO!ztEJq?($XZf#@e*o|j6TTYoYk;pY;hl(& z0fs6G{HG9q448be{-waTg=}_?A>nrrG62so+q)0212AR5@@>d3098sI7rWc}|V-w{XuEb@+_oc&}u2MvEq?z1{Eq?uor&*4Y=hn0YQmqOJOl8RrhFFw&W@wU`QUifW{zi?QcD>4HsF!} zeTWMHPd8!mT>{wZ&sE5;25jl~KLBn4{1EV1A7J!Sk)odKD5pJPxzfkSPG%wjXm;XD{{b zR@4!Rj)t~Q-P7IK)WL%0uB}Sz29NGjTAMq(K9ADY>CqcHb#D_(@gLPZ-QAtu2GDEL z+q|7h7hrEUid&FSTD!VIuT^RFcv}^pueqrck(o#OO}b)2Xr*hjzpX{t=-J3-QLn|b z1@xQstzDjmTi9S{^Tsa0mex%)pGQ~Pyv@2`)oj+=d@FJ#vz{$&y5jAEv^FRpj}+MK z+@Sb6Jf1G*pfk5@?QGiUA)tAE7Szz7jqO$xp{b>%J6cx&nrzzQRQLM3AOr>6`8?g5 zJe|6fZHr&DY2|r3TdX8{*4>OQwRU?vqI>A2?7iqSgkcVjKW=nZRIFTH+>oD>r&uYv zI{4Zz_Alu(>dCT%I1K4)nM2=U`Hu_Q+Tc!-lqqmXB45CX%EhLG>Vof|P#|q$GMp}L zS27$G=WH?@GUr;d6LbEo%{~#6VHac6-OU&dZ;&zO<^jgADK9aGgL|1Voa|x7cGv{Q zlN99*#&G^`Glp|N${0@W7-Mj1For`t&KS<~1Yhm#`6?qJ>y(OX=DuJ-@-Uw zQ8dPIz8#DgC`wK6*KXQoW!+u-i*-c_JogeIJ=yrW|I<^!lcAf=9NdqL$bu&zkx1r~ zxDz3g$r00-961`nmC2FQST=H4z#Ku1DlsxBV2-55CCJE=0_KQnD&g${=E!PUga-u7 z5!TQHWu!;I9BFM4;VuDl#I-`gjRNM#YvqJp0;UFNF2aQZrY30hgmVQ79S|Q;^ z0aNoeE}uqR0_F_RT!ae+%$cCo6V4SdXN1;BSQRj5hNclt7cggt)-`Z0+J{^JCM9q@Rn~7n{ouYGBoIumU#p#E^+r${PR>Oh zQ^sUTs9kAKX;)m2FyHuRQLlcDtm(38%1>?fcExxP{H&$Q9hiU1;WG>4W;$Ih$Q+f87Q{}{$va8OZ&!mksERJr-Sd{N!hpl<>2*|GlG-F zFNQmVCqcY_tv#YU3XDwTuUYGM8QUa6-=MxGyh_Sa;*=N(7EV19;WtOo^~-9Dhr<_* z%D>6XAM&S2&Y=e;uSzJr?}+R~-*sXTQrF$waMS+aN%sG)g zS84ems1@?oh+AXuR-NjJs@EQK%3bGv4}>U;+cy6U!`9{KgbZ4Nb9;&3283;Ef=s|KD6(J$*_Xi65-U<%sm(>F27;vY%tJ8ki>*z%zF70TH(tD?&Aiu!s2>!XmQC%K5odOCa-Xk`9+Bg0k z*bzsc@}D+4^oRK=$RGJfWSj6sghMg-OMt_71Wyt-i|KBe&S$z+rk66kR;J6Cu9WEt zrkBffHPZ`ax`FAdWm-cTv|G?3`O(aHy&2at=C~|)5()%~-vihca%V)2+_cu!|FmO0 zw6@l0hX$=_Fp)|e+gzb_8Ik`a#uJXWQKQBv2S#Ywqtrr3FXB%Pt#`Qk-hz?Ef^xO2 zsci-`5L*4$52XEY&}AIQ8Va_{C3Lm_A))+k<0lxZ;2-h^gZ~w${?NMMd(qhdMVQ%N zl6DqN1x{bIX$FvEg}ZnZGv}otTRJ(~yi=?f?`4g%!VhzU9| za5_Q1B3!Z>GonMg9i71-i78_26kSOVH*pT@4n6M(>gZLj_p%-JYti+$7n}h4J2M^H zJ&40s!$)%dbqTz#aqvh)`$yTt6JWt*EEi3vRVb-u2pms81EnB;!QcD{^9UkN|7a(& zh;L?nv{P&QDyC)|gtvp9CvYGaJ((JEE&|Z^VOsA_QIX74pf^+?7hy{XUvfppep>fafw-Dy#q!iEx25mR5ksGddTV66bFY>eH)6`J3Gz ziN0}&gmW`)l^LV`&Fhl9>2JOXWrE-E{w@6tW)=4U%20{JD>Upr4mh;yi@BgijKp{@ z=yr63{$vo;=}&qc+&RFd94Kf{3=SDPv1PQJidr+SQ~Bl};8eC?ECxc$gpNimTkWT9 z5WSEx#~S2IwV3B6k%GRlPOb!0XcEs(O1n1)#DG=}^8r%A4e8SZrzaBl7CNHSD+sT} zX>&g7Ka=WVbfAOhwf->gHOBS8h`0V}p@)R$q%nIm&H)TigfRyYc8qoa)JC`Q3bf^K z?f@1+Ho^hS6GE~afXR^M0M^DcL*`3*uoy~k}WrXi>07(UcfLd%3>i0Ip>i>6axJLsVb zl@MJPOdJIh#_cDl=253G9hEeyv@rcfgD5@M){~yJ^~)qi)Yd!A8m6ruGHw0(tH!nU z6&Mh~yyNy3hd-1yCu-~Olo_LK z{RfgfY<&s#7PrOQdaO;cKS+h`Z^RxU9s7k0_<;4;N7Qq_f&6OjIgqa+--Y}NlwO^!!ulqNkE-(3g7TyoKFyA(-+adtice`r%ibYr-j*UQS#8_|q|kJ0seiWM(HSmQrsSkZX zojsp{zeAL!ho+0ka753LPGhMw?v1iEYTR8WHWoY3&)^@&8h5#l*9*luJ`1B^+V(Co zl7wN)`;ha~T*T02I9_*E*I zLrv%}_!n{LqzzQX`vtRs;CseSR2b_QR$D}Z6ZCnYjnlrHA<-SeB@Ee0g=}!%mWUBbM#Zt-$yz$MVOQi6G`(R);$pL<0uUCKvR33XaUI$ z;iH6oCU+mE-K|5N;2W00;@c4~LY#`Y0C75Eouy{TU{Sl%?@C@;#lxSjA25k>Gy)GB*mxuFSvxzLdzP$!YiU zsr4y%GenAi0h+C?Gg3IZ%RpF;?o>Jra^+OQ7vhYtJyBbV!dl}yQjl_~jcxEHFj`9k zpCtG*PL?ljZM*t-sK;1k;(QEy4aaew;jthdL*@~Z~~4}01H z_%GkX6&Yyk(OEWiV9%Y5Ck*TfBHr}?ZqQ=%v&2!jPQ^ehSHjaVE`{#)B<&wi>N373 zWd>#o9_O=q{SxZ-gD3-Dh0ACiRi0>;|5LQQY*e{T!S)CB|3|d^%jTFMb0;&`J1X49 z1;_;XE?OoX1K_Hyb3+Tb0f*?Xs#3?cRbURC(#%P z^8^|)8tyB>V*m`eGTg@}LQEMuB?DM<^({r7Uo)OM2HG$#mr}zWsAn`W$67ibhGB@a zEz5*$iSSGssOQ+0g|g~s+tN?lLh6O2K40`D-8x=LXTc*ZxYR5Ftl;R=NCAwwiglY} zypAWXoT6a6fNVposoEep7{P6XPk|tZ+Q>8Pl*X?1KWrfBHcBK%{e2q1{`()pJ=o{q z{eC_c8+n#%1Q8}Z?GenL&Lu9S&zc6NfB`2-%3vGy*kz$G~vkB2?vg^*=+l z_uhs4AK@Xka^|D&rTxRcwC@Zq+9wl|_zbhGtUqIKrQS|=1< zCVaao%`cW60MT85Uvo-XbhSc<5IU$82E{VJ0TG4hxlmHN42Og{G|U z5(0tZ+M#f)DmjZhL%oSSL$%S4f?=avO3qUC<Q}bn`4R;SK0O z8gv33CWdB5hVf^KMzt4{<3kCL(s)xbt1OCXeOK`r6r19-Fn%rz@&@}oABzJ;Hx5#9 zWIn^KrLm3wF3M9QzKn=(hITQtzK*Olk*6NTP)DBX<=wX};_J{<7PblejL1{mqC}p$ zTikmDQkTS70gTpAaXQqe6>9~ono_kqR?QJr(^>X7POTI!s8Y41EV?kR2qk9Gbu2o4 zRLDxyqFIo&3R(0{T#-Fmw46oz;)-C>%~~Za`sY|t;Hat#TU5q^du2h-ZRyHZkz3B( zEiv@R>Aq$A*R$xRxT3;nQ3Z>Z$BF_+6J#TmESMt;;EvKcruA#rja-B*>$#!>yoR1| z@Cmpy>Mm9~MhvVYgz~5L7NfLZcchQ-!F$g(PzrveU&XaI7OQ;c=48q81XaIapt$E+ zMNdiFlO!_yCxX9=Uv|~?7e!n(Zlm=*QybIz_M#Wqn*1*IK%{5eKz;^1^0(~9ffE<`AL+x0F)3IFag@;WU+}wNd*Ba3eotiK4A1PScY#;az$S=1^H_cjbRNqOT9?*f zX*wHm8x2+i(_;<%W3&NvxO66@q70X+GIGdB>@30;1W)$gK9f3fMm#+EXeUiely{p& zdUlL-VU+Z&;nMYzSfh+uWTY_)PlK%bZ(o02+K&l3kjv#U+Q(#P`v$j88ZONcWG1q| z!BTTiWy-X}syi!I_p$i8Gve!VYZB{Iu2uKqSly0jUGyoNb%#rHWmF)eMU2coWuLcC zuL(Nn(G8CeN@|5NDv?n+Ba`;h^U~g8(Y`E3`{}n$z1<4F#W~<`sY?>AmXUaz zYSOM8L%Rk-sW6_v1~hOWJ#R2@AluS$xnQ&@3SPQM#8c?E(N6FMVD%jgPN4>G74Iqh z9c_;5O;KO20Dg^DIqtoVqe#Jc*%eU1(U=`(Db-!2O#}0*jWcgqe9xh2e~@(SptHuD zAIE<#Y5qBaMcB6`O(K4eh-s*drQaaaNl4R4y%0{u-hy`ThApeHYf9&PA@;gjqw!dJmhx7#)-z_USk5D|*7jJ=w`HxPv79?) zt-`mXbT-ObJ+Yj1vesZMXQiyAyc4Z;jjYue%gICzMiRzVF*qLPGt5+2Iga6(J#YL8 zOWSQIhO2WR_oJQ0PRP*UPIM^w=o!3y2*lKp%^=ZVoDev@HSHU>B8?5?;CnXv0BlEU z;Iw_yTq=)PMEl8_@usY)E3cgGYzh)sq{ETqVcBT)@G!<>+fJ{He^e&m^u6=}$t%3hC)7xeG z0jBR`IxvM#n{6ZC03g%Y5paz@P>L>lcPs1y4qj zA7XxSBzchWwUOiljORy^cQY2^;tt*T;S^H>`o*$qiRfDJq;U;rW-<@akX_f0!vmML z9-^&@JndMDfij+jNco6S4SX8G`(kHtLc=DLlG&LgA(|v16l@RfNH%_hX&Q1?V?gn; z&=tdi4M2<9&DrHiX7|mIp^UAUsc2D9BZMG|0=scgC`qYgHbb|@22%F0I?lZ zGpw;+9hnUX?+H0M3=s9TVQeg@)$Njok@yJ)Vwph4_@(up0)u^T>2Hqw775M`;9e(j zcTlV_m{*1taA@$vU`A*P$ENR~e`;ttH3_esiC0HZPn!vW8g5h#IXMA1ukfUeC1cLi z=2_jrnE>m2$%M^UF0lAX)xOPw39`U?KrI)~53}U>YeM406dR(qC2Vn=VsWfz7&TPr z{dg?gHx)gMVVFGu#v@oTNQ~ncmKcWFLtt<}Dlra?!f;YA(aQ{DHjXGI#$%%}mQiQ% zv;=(M8HU98`Y4PA)MseqTu6Gh_9%KM&sE}7_}wFs$a7RA$TY^@6rubF^)GXXv?s=^ zxHGO|Xu25mBf6cB$S=f%4Zd;L0h(g5C>Rj783M(+*U>s$D&8w7MJe2_y7#ePz)su2 zLEI69f7);AdsIVG7R`Af|Y$#mm~Vz z(DKyQ7hbZz@KQP>XnYXW@&#VK9Ai17@XW%hUfM0|tpV&j)TC1hNSo`;lR(k`|c zc3`KuI^s+1udzjPtBgG;#0q}CAe$h`a(N`*?3C;ORCLAB8n`YI@=$TKnWbNBd>yoh zl_qwXWJmfiCYWnwHk?dhCFE~9wJ&lfj#$^U_8r-pwd--n0S4qk2(!i0+5`dkJ9K4a z6>3$rzR6}x z2SYbExUfHg42bo6@D{rK_@~gQxAdvOeT&^Ty%=xKK{Ox7$u%#M_g3$qzRZoqpAE)6 z!(}{sI4VVb1=rK_YmE10+u>_q7wi#VdX4d#$qg2H7(aV^qRU92z=tXRh(48g*Wi6K ziH24$!;vvP3%T8ZCh+L5#<*7&BfEWu(Igs{yOZF1AMM;h?t{e{+@k)7VzypJT|~s< z^qU)MTtro`4$^x@o>)Tb@Z=Xo~s%?`mkrOlZmsta2a{JbH~y zoV-ZzS801L+QHwzglq$M@4I_K|MI;{lQ$ze7`6}eFF(9=(&h#Bq;F1!2HZWlY+U4I zB2SdKlP0}z_vG+o^iQg_ID8W3M9qLR?`;Sr_8tDF|NF)S|X8(L75(7q;|7s+X!Vb!YMhUpV z7lOat`zET>W_@Q6C#PBa?mnEhXAoSbK~de>QE1u-U!Wb>^&arh##OQbzkiWzpv6DW zYT(PF0TuI=^ab&E$0yEN;MR_Tc(|VY{Av{KZvR3_yUFjAv^V=5f;MacIQ}KD#a4YB zwl5Hr4Nx|2h5?6Mj6@1+sPAN2-$TeT<_kf>kmU_p?+iky*g>g%Z_%>vqE$)j{Q(99 zGUOG)mBDkjmb(Ov>|eIRI|Hpsc+g#ab+}b`i;P zO#{QpC1>&L-e2PRPO=TDMKXm^DiNt(QZ9GjH3;78$vVknK<7-F`3StPBOgEIO=uzz(V_TI!#afY~fU-z^imJ24k zBk!~RNmP2zIz|j03jQu?)K49OxaJ(H>7SYJHVz#$l|a8Rp2Q;{fjI=kp(Lffq1N~s z@J#!mCm|1v)|xv-;{&iL6iMeqsg=E)^|BxwPqb3-WeF8$A+3RB6qkZ`Ez|wU#@|Et zcN{}T-{2lb`s^U&2$FS?`Nk}ZQU8SC8{un^KV%C{;L6Vb4p7>&>x}PODEdXn(Hb!z z=4K>AmgEicU;+KYL8Cp|_u+Mrpl| z17G-iEC3d~WX;UJuOT~cFm#(OHk5n0`LRax2;Wypi7aD#o5Z^U+hg6nT+#{O5h~_} zA~9lZv*Z)f1HhDnWs~xOR3bi`%=*2o8%hdiK-T+HLrE|cee2+|!bt;g%Y*(aYHPHi zSYuBP3#R2daVl);AMxb0?<~a1Q=L@ENG^DXlU4Blz{{LV+c9sBBE>P0?`Kf1IFz7B z&lT?~$>v@<#HftlwPajtJPZ~rCAC3Gi+iq9{1b!khHC{*YOV1N%Le&V@phZ?EBJ~G zl!aU>9_hd9|56p+D=$Q@sW)#A$v$BZtAsBWYu}p4kvwTO{S%;jeZkXloio?4&npR7 zdtgQe!+8-`+J8)NX&w-DuQ1+%RLc_RhXawcO~*z*4;aFWN0>Hemdg6xC-m1TR{##%Y#*G6Jnpae;_cJh^2&BSokqYJfpFlm&R&~Mh|IZo=YP< z$T`Bsd$vqg`peHghhIu5aNvVn2bJHTC-*E;^ix>wt_!WU1rNt9gP>_E(*C1}8({Rk zNZckfmBQO3-t4Z{7Y^B9IE3BCA$yg!oxK?(C(j8^a!2k(V`v8gUNjDQhkI1@z0vC1 zMD_G=m8h$igoD7!xM*+$(gct7o#=n_S3I(OahB+x>(D; z%Q^~P3^d+(k?JyfES|vx5PLj0ff-m3WMHj|?Ooo<{#EvYv^^Kbty7c6S*LpJ34^n2 z#p5EzuThuT6UvH<0%wyq{h;4(-#Y@He#8-r+c@f%u;dR`N$jDv-!9j+oY!)W#`a=r zUgXq}Sb3esFWmy~C!q^jfwKu*)U*yK*_7d8mMTNVQxH-SCL^REOhT|@WnPTl28Zul zi2aTo$KL7Ki0l+{!Y_Jo8VEx&Nj8tYC3Y>7;|2_?Q8eYB4td-2jzHnk?%UU2J?(7p za5!@S=OP!fpl8t%ec~?6>j;i+v;=4^UJ49B>H$o$xV`0F#~ssXRE}Y^5^*!qzy)SZ zF7UuamNtzgm+@AJn`r^w+!wQIBPV&5h4I(gSpU8KvW?x2To6w1i)Hn8mb^HsBvFNK+C+p?s;*O3l^;bgxHyv^iR0a+(F9qx1Rp>6*YjuSABcmyDydEgBn z${(c7Js~uG28?>-Nd4MSuVX31F-7UYcG?}9o+0wF|Ex8p9-zQd zQKuT#I|<|!cU`RR&GkIwMBVsWb;cW_P1Y(wt$?TnX4JTf4ebfhI(UZ_r4D0B=3HcHQ$?XZ~K(RK~4((NBonu4(evcq7S4P;Yq-t-n=0BlLJZn;nsIl1y z#NbSau~TvbYrJ;deyo$ZJ`SD@ehTv&_*LquVHFA@&a#Cr;J1!5ac&^Z*tEcJ(#1+{O7DnCyRE160@ljDe`O z|6z?4v^unl_s5WS34XvUo))CtyBktmjdz`Z>uygD-Os*?x1?}J`3!|3%d7(Vs+8L( z7d^o1J*-$es^XgZ^Hf~37UnN4zG7W_qD2_*WqnqQb;j#bf1n6jBW2hsC4jf&V!|=| z_v78>(53YqKZ_*vSRffyvQF$Zq*31_`JebTwDk=VNM+oMYhZqt=6u)O%F?=qqLPxT zYISZ^by>s8s%kS;ReF7Cakc8Ks&1$(t*%&Ed4uXKt7}+Q&jP^tO&Rz0KoG zaeMvU&7LJHm~-l0Z--CK%bB0=Z0hLJnqrxS_=;XrPFv@#O*t(dHETJ(_0*!4;;TuW zt)33woRk}ofrLpbKc^rk*O{A>zfb{Le0WMH(Zy<3er_)E7dZ3t=8WRAtlQH9#{3&M z;2Tw*&TO@)qp4FZ_HM~m$266VhlXt(>hcahKJ?Vlk*!wyfm!Zt>fE36@*3J5^n4^QpeAKHal1Cq>EhjjCq>nJr7y z%#Qjcnf1}gOm!eeJ|l(}l2D!3A*JF2RTec<%1cy#r^y54$C6G>XoZXMW#|*aihCb z+*ekvkdQ2>C~{Xf6cyi~fN*tbrBYLQL*9`;<&)Uan6SQHyHUTT^He zSo$5Cy#ir9f`*_Y^dQ`W@F>EQ2)hv;K#1vqza>r&0F2gIi#FrGc>J2xOkWE2nxH&d zENW)+7|Aea9N{qgoD1|mM?UdY))dD2*xj@_rt1LaD9jmqA@2*)_jk5!VFR>!%F0e} zi$^JH*4sA01knz*c=@3@)h9l{hVg@uZ0_*mlXM$Y@tw17-y9`t^E^x~eiV(+xL1m+ z+pBxkDo<;1r>>TDG;Q#KUtZPt44h1)O7N*7nh zB{AhnR=SI0`Ri1rsJK{F>QtptRc;!$Ya%n#xq#{}^xv76$28R)cQFkXl2NEt^g8~i z&HgdM83fx-n>`gFT8M-La5h3ALOFs9A*K^;U1G@KoUA(LkkMV4Llu>H^CstN)s64c zA*#UV{5sSk)9#pJmrun~?= ze&(;zt2cmFr>9x>w2W$60Hf=-oLgU*ZQ9iwaIqvaw;(z+qCWdP#y(OfocZFuz^6!s zkr9}7F35pGDVYnMca!Suj;g!0CQX zfAf2~n_&K}%i=Fq)S@=a`HI2wNh!rKG$v`0ac&}g4EZhi?5UN>_!f_9=8ijz7OE3V zU&znD(bL`5Y-KWTfgMt@n)7zRbMo7xqeW(+Iz6oK*@886i(KneU_e@y;ySsiUYs>mpjMe8@QKE5N%h=`s}YEx|dP&A%^ zqV>J3sJB5rv9?)g^-mU!YMXtrCegCnoI0ikYtV&%l-W+bu5VR8#|v1+-U zoNnRP%n65xJ9M|(yKy}B6xx7g*o>*Sag(MS#G< zop>n zR#g<26)kCMZt-Ysot4=B_-i+PW%HJK3cs3*ujgVzsdi&~=22pM%CwRU@&y&JpQI)H?}$?fWFb#t4pshyt9o^I7ND{>#I!i%^1 zJ32U#TiZ7HyM?a9%#YfiTg%av!u?}#fK4~eX`xzt{#C1;^DTAa)}L~0q^wjg}(d+ z3v%KDUg5)ntg=*fmsZ~-Z2X|_C0r{Y9u?o6@e;~Am#AE22|!Jch}GD|7P?yUqnxv>`x z60je1vgNo-=2~YDEiBKx2GO~^SeT?@rA2Zf7;xs}hI-gnjcwP0Kev5y<&0+#KpZuz z&9Uusf9vFpe4M{|Y>5Aw{#zoF@-n3s&yLltXna2YoI*a>feQwm3v;kvhmZx!q73J~ zaWhwMkjpMHd5epR%S)qs=GcT2C~>kO6R`?Q)M_3`cX~W6J{3o1*qChYZqu<4$KmjK zujsU{AAep)S7U$W`3(Nx#60+(hHm|{k7#Irxp+_ zbeR8dW8kO9z`Mr4`^LZr$G|@s1M~M?R^x2%$e8js;^118AB}_C0EgpX4e*ILn1_ES z0b5Vu_|w$0apkmHlirm-=Ry+aQi{S)@iNUzN8pDL1%R6$A^Wu$%v0@n{|+4yI4fkAppc7stUo7b}W`I{~kZgDU}7#lgjZ>*L@uz<;aj6}$pW zT9hr{+$ebtYfpyV_`5-fS@uP)Y`h}Lz~39qLF_=_5AsyR4E&|iMTn;%R3JSWF#~^Q zL|hA>+k{WUl1hp`S;t* z`W9vh>fZNP)c=!NpSs5@{Y9HSYY5LJhDYWbNJZeE ze3*imfB%89$hr%EXAAL}KIlB+hrR~di21j0CL?Bj{OK5RCE@-U#+7q;3y5YQ#-GCx zf3xk_-8MVZyAe-AoP}^90vW-p65e}|kL`e$yqrLM1z;p&*NWoeC2AJ_B;Fj=v!U7N z%+Fbzm$Pu8nzwlI;@tUp1@q(^1X-dmFDEZ2ABQnw(}yQ=|65cB#|u@yUyysv{5&@nMUEt96eFcGbk9f3^XMiw^fO!#@*9rvMHx|*hT>-7^K-y}T`3%(v zw1-U7Cf)owG?X!i)wWx(h zTYU_8wBanLU$F4*K$?A`FQBhj4`+~xv~>}WS1*Ev*9*K}It>cSyokpTM2OLg<#>)H=V%Z)bcwlx7xkm#G_nP>}S*)@kTSgq-R~KnRpm6>5-)#{BWOt z=QWE$HZRqTA3<#4(YHN@Me@sL86&G7k0DK&kRI0v{JXHsvq%yTB31qkf%F(=;zw?3 z7ZPz7^LhOcf%v4Sns_s>1YlmO8S^zts}8eBk6%NuF01TCWN?01*9vTA_z@55vhb)o SY}2}~!g1}7Eda5F_rCxGYWKYW literal 0 HcmV?d00001 diff --git a/modules/utilities/unix/compromised/adore_rootkit_static/files/ps b/modules/utilities/unix/compromised/adore_rootkit_static/files/ps new file mode 100755 index 0000000000000000000000000000000000000000..704ac2dbb14c490757e2045fe256ad529d5753b4 GIT binary patch literal 32756 zcmeHw4}4VBmH!KwfguKGq=Cj7^jRkwFbRnSnm}R)2oP+*F$s_=EeXjalQ2nUGjAYt zQ3oe!d5mdit-5w=cSCWz?$%vt*IHD>2_V6)U8Cz-{L^jhTKm$_7PmGiwa)MRz4yIj zf*}3;{(OGF-{d|yvD@ZgQUNnrZ3_c!TNehJ z3j%GO;hw@!SK$q^4WtEcYu0Z-Nsc25xU4i2;d#8^vk2+4NGp)?k*-JL=Tey|OUyhE z`5Yw9?>e*YGiJ{0lSp7;;=_4dg@h?9ZnO4AGv^$xMxy+en{~|QB2}1hk(n2oc@FZ+ z%`&r3rIcCBNP(B3JR7M1$%DjCDUv0d1t^!X^1tIlySUJ2MoPm>vwTTP9d(}i$p(;> zT7mMX&w&X#kTQ|3C18GNi}NiYC3m7c3rRKW79-C!%L|b&MJh+S4CxA_Vx()3&iA=1 zO;HAB*d6a8zYLtdiadU|&C!aS@}16hz@I~z@BzRF08@vAVctptFvldk679o)X*Yzk z0FMCfGU0zhei|_Ch3)gvuJqd+BPP5SunVx&e?VIxYJLC_f zz)u7J0PvS0=lI`5N&sGtobX1ZVZc8!;l;okNx^>y@M*vY%=X)nD_^xa4w>-d$X$TB z?nv)`;H!YG@kRg_0k-7#AHeYd{C zCOjQ^958K)@OI!?_H#Al@eb++&`vsRA3!<)n085c4EPDami;^qco;DK2HR;TBY=Nz z!e`Ka8t@ay*{&d0zGidKo(caQU>D$^34Z~w3iv@2{{-rb0MnllzX~rr67m z(VjrNwLY!}JPi2jCcYQ>2;iM2OrKc!Gn;9DPGvLT(`dJ$ALsWTl7c|Cx0*0rd5>X&9$T+Zpt2*{W!59XNK0WeI_H_KA-Yup{{O?ox8#sI)}9;#iC&5O=1+#YYqpMCfPNJp}M-2 zw$5f>k7N#MhS#`zHLGZLN%f}6l!Yh6!HXToMUhY#l5C_?TVFK zZYV68DA6Aajn`BSU7+;1AQ`?r-K%AYyw%#5in&lM?jRr96^H0 z9GkkE`AkL0V~zkOpE&}CBIeleOPGVhQsxNA%9%UiqnLx?O6Hd-N)>Y~$ZF;Y47|+e zDoP!51ZMTj5o~N`jv%UmIh;i^b8Low<_NF?%;&+UF-PF0F~?@o!(3IAUCghBk7Eue z(90aoa1V1hmAjcENQpCtQ@xjY9^}OwPX9sX2)+iGU#}<+F-Oq(FmnWJk1$8TcYrxI zg~yl|Dat|SFrq`uZ-7r^j==R8a|Dqmm?O}6p7|2^Naon&US^I!?<8{sA#X6p<~_n3 zPVOz{*jxXU>9MU+-O3;S%je>W%Pi6vk9w&2Lzl$ zIFE2#z$#%#Mj4F=*i9IgsEh^$oJZJ0xIw`AgsTX91zbefOV}ge62kR_iv(OsxPh=L z;Bvy8(5Oqm9>PJwihwH#_Ygk)Au4jK2uBEy2)LT?9>T){_7aX0P6)V;@B@So2)Lf` z0O0`vZzlXO;kbYs2p=FE5pXl%gM@30=}CtZ|6pb1so^rBAgKLy@VO2 zjvf&31B6w=0|I`Ka30~ffCmUOTp5iB_#wijgo6Tpn6QU%gMc3)Tt(O`-~)ucggpX& zjBq{SA^{&H+(1|r@FBu}!Y%fw@KS20^fKL)0AUq)8HwZsWI4UDuOs$zLc#CG?xou)x-8E!y01Xo0@EsUAxtKM^NwCfF34n%K zdxNaiZSGi>TaxhF*s}{g+ZE&6Q+k=S1YR`Z@ES*Dv#5wEV*aCxFwy?)J{HI|&U6qt#&%)UgpRg5vV)8Ys8)##B7pnGeK858Iv>b_5gzTdsvHHLe)nDDMOdm)cN6x(yWMg2 z>vi9YEUMUIvJ_K5W*79h%e_l+_O1dAblnw!6*xve14!y)m-Da^H41>6MLm4Z`IRvQ zSyWQYcAxh@Vd^8;gVE6wDJ^jJ{Rbj1Lea!DEUtE&zw+lc*zCdyIp?D_A9AjOU4Rpc zB$}AvHT0_~DXzRcjFXoPyMW+tKyTwpL~Urogaf7|{LDwYF_s*AVzfKOXoK%tT5@AF zH%7Y>#IUknMjQxAMi$~Cp_|bsP&0+bbbqg)ar*=f6*N@Pm~D(!S>5hJH&Z?s8!~hD zz6G(6<-5u9HaXDf3#bI%ko^IiJ_@FvMonD8C@G`=I0<7q%ILQyVQO`>e-Z{wW%Tw* z7-CUIJ0@WSwaVxhB<#of5aX?ru*ZTcB;0Jl1%#GHtMvN(rs9>l)NoAC`&v8)I1nx5yt~Nnuvo*qgt8Kud^B1D8eSoL8 z9BDUUxuz-}WTo@o#C{e=c{l_fCT+^&HIfLTrA6hyqH;`&N>Dw|L)7Q9C>3Ok^ff|} zFqfV0C6hunSOeRJr|sjdMoY}*%H?5T3%8M1z?NwT7r+V680EyJZVw8TvQ| zU~D7yw8z}NC>dpv17rCrMcH3XfmQITX!9W4b_E*yOOKRhy=dfB31`Sn<^>RwUSRg` zg>3f+1(Gl%?ON~mMuqRT!>irt%;$(m^$?L-lbih%9*0sEKugCQ0^_i6MTXX5ne9-6|B8t zq7GO#u$krcf1*xNFq7|toD_@=EZLIU>=xv+p-txxE8VmAlV?<@&3Dk9s?FeWAM2KZ z{`MTmK=n8uwX^1W)F6Cuh%RGUae?N16c`h=(PKHBUp^?gL5Ma1k0J7G<`lf!P%2MD{7N{l>28;p)yts z!>TBIwC5WGa#cZy)_RUs*f11g=&>J4ACaAe6^lWfz5B?!Tou}tlu0sJ=dXa|+wFkz z5zu)j?Z+`ia}G{GbLaU7GVG3+ZCY{|e90AP*A|&eQClFHmsm!pn5+%l(U)f1+0|!DzB>PaDB z?f{<_y3(#lMORJq%Ov{bAQ{G7Q-`=&qtB;Y#Lgim>zcAga>N?>fu;2Gu90m2z$F)7 zBNEHF={K|ku8}MX(ax@3;{lwB$~7Wr`M*H#_^3d2VNwD$8KgaACxhk4z*mOXm{0SC zL0}?Mzrv7I<33>zVi2>poAW@wykxM_-#~MwJNZX3FV*UwAFW_;pa}Z_a%u9w2u#5r z06x{}HFilsj4c*&ETi^buM_%0Xha&jje)_DI!Y->p>~clw5u?$gzu(!D?hBa_OzOh?SVLLO5c%mHr%LmWe^%H~d zT{ZuRK8(S=sPpb)m^PnaHNa+4hdS&7p7V1xzamO2akHR-0nB z0Sw3xBO8mI_wV`NID;()1Lc8e9)=2{F{ibqr3H;SLScE}CU5ZUvJntr0nMp>LVx!O1+kcGPiQZ_{)?|X!Qs)|L}iC)&f z$LgX_bjbq!EQ@~ZPg#$yiS>wMSZoV&IhMFFIqqep$TNp*ZgV|ke&bBJ8#YQ4aX@h8 zkgCmG4$^<|-pDa!Ir#f6KHrpDjvgx)dtr{W-TdT%0Za*l744nFGmbrV?(1Ta2T-@S z+I`)>jZo1g6HN zm5X8#qM>P#Y^t1SS`v#qD4UkZrmBgivRLF^*;FQ*V6_jUf-+1s5L6#PHB?#(`BA*s zG)+sIf{1F$9 z&B+6YzzKY9zSp=1rRcG&NgUhx_bzi0qVGZ3x7=%N6n$x}f<8#sCl9=VN;$|$S!zfg zcv+UP_gA9H9}_Ed(D;7IJV3GVR+v`Xk9mX@8x&Wd1Z%m4Hr3Ut%ZsvJx~Z*xgE;xar?s z0x6<0%iN$#;h?i%{DRJ)VfXqkwFa6Y2O4X}SyZ*V1f4R?PMN~{i*-NvEBm?O07PnS z11__J3!{``lpL^@BS!gzHOjtU2rr2S&Rs;DQS-im0|>ql6U1)XoHmFxD+t=$VwVz* z;heAnr!O*UD4Fc+kKNS#kR)foyO==TI(1nmOS+Oa}om*z`Sn_5js} zS>@1ipp4xgvb$2wD&P2*x5TVy#N5v+9uYUoi-znhct9Gp`&i~l)U-5Q($bFf+wMb) z;x+#Grs%!D3Q@(rhk>ZMzvp9%Blq=}O z=8(|jPK~fFQ^aqvImE>jvUFR1DzB zM+nG(av%B8t6iDr!8n&?+>T%f*PnnH^WZowBkNDX#0HU(eICpd{)Q@DIaJm~vGRzO zv~#Wq-NYV|31QQ_NTI`yggBUcZL#Gx?9R82ken#=nJtIPEleCPf5*{ zDQ@A+ThJvx69T8jvNvd9U>olJvvy4z(_&eSH^r$`RoRhl+t^ld=A2bk2Bh#D7^puF z=4=c|wT&$@`{N)an}^4rAVvW(?l3VfLrj(FzkyZTOkI!QnG}|m4aWmf_Qx|(o{h~P zX88Yc6Ujz<_Qy<=Yd_~>+FeGky!o?cA4dn*ln&?E5(JZxv&%ke#+6x6N_N`dM|!2m zJ67k)xry6`QikWn&ifL3(&QE;+?p*sxaT*MN|{5+HSbDO71a}lNK(C!@Sb?1O}JdQ|$ zGY2_~A<9}NSl?wEYZH7rBu~i5lcWE?W2o>YVA-LY!=X6#mzZzL@OX4VP88>!t8h+t zp82IHHd*P)i`^^mr&vr13S^a|gj-?o?H*&@8BD_ooVA}H`Kste4H&co3g z^>!X+rU>ag?dK>Y2MST0ea}+^=fR$0n&)XxnR*P&@q`37+L!az6y)e&E+i=n9S17+ zy7N8;5$?-v%r->{514r|DP2gA<*P z5sy0J^z|@JS6>2eS!8K^V&OHMQY2`q#o6zhuM1n_b8m00-@|}IK9H$;6>H4qhQTPt zgFw3V^SAMx5C8lXL{l`%-AWj}C%n^b~_W#(LSwqT~&R7f3R0ny8N{vDrL$ z#H$@OMv>VLzX*-F_Fmfi9G^TZ&fXkk`gr910&Pa|>yh`b56>x10D@z#nmM$3^fZtl z@0IC$fZ$*Tv4C4O%|##IyFrPZEzs=#boq5N5O6QJm;|9YXF)pu(ojpd&tx@4X}~aVVol^mCH$ZLwr5P;M4lAlaP|#g_**vk)n88tTwH z`vPfin>NJ0P8}y-ay}X*Rk@NcT^&7YlRb95TAcV_NDt~|6zbrjj8%DJHJ-8;Z=WtC zakMy5_M-D|5=W=vRK{v5FNRYUtEsvePIauN`eHcVSdI5$ICZg_x{Kk|$7<>?hO;?V zv-x5;4Y8Vri{UiKYML*G>ge(j++p;yj~pln84-r;<#@K zTwX7ZyGP*i3QbIv@40Jd&)ou-*NfxE1un1W!`-xT!eQ2GTg)9y`s4qxJ?w>H`ofF* z%)b+OF781?cDgn&suU-l#P>6}FAqiN%~&@Sp@U-y&wX#&`S#Ixt=#Zr5Q>0?2MC!S z{jb=M6&Kr^3kWI@-TG_#3FjljIBihvz&&1^bUr@V_Y$`*>sBc|(|8DD z;eF3du{rPBaO83t7yZTJ_lr-@94vml?>X%n@V7Ghhv~O}Dwg$AqQq=JO-1T^E<6IK z`v<%8uMuk;#h|YazJHZIeD#Uwd&%(3gE}^^v8DRBw_SvHgFnCI3C>S{<;``}?RIJn|Ade_ZM| z+y6D{_PdZOl$ebXu=zXslHnX<2*hGavZRmS_!MaV0oqlGcm^-zVjPtN_9cXf!waLQ zT*lW#UFKxh5%e0Mw`WW9RsI)`APlAEb!w>||boy6a;x%YS2rK*%Q}GU| z0lX=>=NrJ=7e{@ra++T-R}qc(^`bI1=ONVY8^A>_LarVCXz{qU#NH`Bi6xfA5>wYi zlVW}SQLe8)n(IqonCmOa_0{i9&O94Eo7AqYZFi8f!Jj*vkJ~v$zYQmWG?#wc5wGz{ zX_?dyo)Q>U6zQ|n>#v=C*CCF!8Wx(yLBqlqjnEzV`NqM20sax-7bkX~WgA{dwZf{{ ztdkfH1i;v;gK@~SED@dy13>46&A#o&?QWEmv26H_ns&QX78{Mbq`)P@!XZ297ZqT3!hR8pdRQ(%uT-K>W9k&t#fXMCdE2i9!2uF^7&8OG z2+ME4x>E@TEP{f;r%Wzq2`=XeE>B#2viK#g|ND;IH1kLLaP(Lyym{?Gak z*cD#3H@*0!-h}?Dc1`)t@9)&+m51?8<#uKH-phJl(wvdAJGG3+*>L!`W9jklhl>-v zFF|QlSDzUB1lNeepM<7rjeq@-oZjol?IRGiqLoCJDcVA80N3+i^V&#Hnxf%kBhv#3 zx2OB3fd@Y^jdz8#RiRgJ`&E9&M9V)&J$(Kk@owXH0`PSVs58eH7GIB;)K~*X*9R%y z=R{~F6xVafJ|T=b6b2-R{?NIKI6D6un0X$){osC|TxWTWUrOP&+q|{LA~7t!gAf<~ zBeq!iB<(WLHy(S$9f8J$>v8rKa`Dn7Z!m(i>*E}Myr)zjsr7Dz8U5ioQ{z2+aNDkI zq|*lbmGIjO(Z+?KV$tbyIDmMScBAq53DIfD&N_^R&3yD(Wa3;Te}5Kg`zu`^Lawu* zqpGsu?e<7%MtD3niyb`r3;my0_uEh$vq>FB&Z^qw{VRscXKuf=f5kK9_U$wJSNu)6 zeTS{=)$X6M^+w(aLg=RZssji0w#qiZ z_6)xR==-zTXB|}ncm0bYF(Dzd=&``0Uw+;G5X?Gys^PT?4)rQtJHaiG_jslImdsZJ zc+~{J>sX&GLuVRp+N!-`0RPBb3~&eoVBZx_4EB*tivQR96KK=I`ti7K48E5JN1vHC zw2vb>A06sT_GcF9r?mq8N3nSvbpC(!ul%s=$Q`!+>O~($$}%)p**n`a_0wxvwv`R; z81G-6hQ-Jk;rIfi1${%2)*gLNxx>Cj#~6cuObdT?AIDy1r}V>}`Vq)~@3a-=YWV%Q zncw1%K$SIq5BYx{CUB4?@Lj>4`VnWe95#i1k);{o^yAZ%6}!)}rTe#|*PubHxAu(W zV%8be$CF79`U;L}B#*L5%4f4QKk#_xiP$`LSvHSi3Tygn=kVoC<*Vd;d@-0iFJCcX zoBb=3I9?NWe2!gu1bh0?4IgFjDQQD}iJk<4yYX{)+LX%E08r17RVeFx{2aGGgNb5K zl>q?a*4?MxpiC>>IQ4r1B7-}93$|+9{;at=Ma<+iF2l(rEhwR7V9B|p9%8c|f#vi) zcbJ)0(tpT(7X|U4J1*NdC6}~&YK=zNxSr!Se*6cMM)*+lxGgrf@1^ih_Z=dI#9?O6 z-hWQ%-YbZCC5bCR;`3YDm0H6s7Yw7VhdF9#jrfkFU%d)8XuK_3D@wsYc%HXi^}huq z(P*5trsV7`HXi6B#cJF(n-$H+51Gg!vs58xTasEgf5X&`p211aHD zcOT<-4@JyeD;M0UY;mZnisx3f#Q* zn^y^p*c|rS@4^Lf%l<6n`fzL(;lAheBU-V3Vr;fPz7{WI8CUh&aIY}aCW4u-qG)MZ2yUVBvxZfpF=u0%3HbxTOb0XD8H#D&Vwu6v>dz#04w{MwU_um zgNf@$VIN{zJRDBPiBe?QmatPFUx{2hJ7#}s7?ZqJKZ&E|I8PCIxSSP3&;k)HG8GaB zf%;^~VSEPD#a52^qlax^Y_k zSw$SQY3{tSHTt;oaMm*MjiB*LZ<;4OJyO0*4PS~;H`EwjOl#~4eOy01|77&N^zEPa z*7(aIybZ?jK@52`9iy&92L(>~cilgj{~!8k3^=)$aLhV)UUA|B5e(@+`LBOE^Ws|U z8g9Jq=ZIzNCyRg0uOA(S4K53~^PSNrgpKM)aR0tk(Yja}YKuD$XU;Wwtdcy=Rr#=i zt0>QT*mkAY_*=@x4cYW(6*82VKTL)@YHkq>125m0O`e}6&tS?O`_$@4`IUqtIG#p*_U^a&7glzE$ZL4U z?j~CjahiVeR#=)oF7L%?+4+pV+UM6AqmtF)m-J`*S7#hwr6?cp5J4Y$g0GS3!@v73 zMB?aQUFr3=U;?#9m6$9_xyRPm?LHO&6Z$X2)|U_MB*Qp*!1w$)@VAUJ z$z<(N-&@E)O&RJNF-t~=&;`Eq$vtQwfhQZZB9PbnUItDWesA=1u&DSg{^Shofqf+9 zP5yw5h8LYh{2TpHxg)gu!w-S6BSTV0A0>7l$LV`Xn=SiAb`>S@&7|YD>B{QZx5y2a zK-%wWHyJI@(0Vgt_pwqR+SqSf+J7I1LbU!@Xp0Gs!5OSrbaeJ^gVf*vOjg2A3-bpf zcjm^vC5C-Hd<8bL-enSRlQA2!1BKBAs6bpTqyg@ar}yWSo_R$-8+|(+2eYq*E{(%C zz-1?FE6QH${+;Bhzj7Mil}|hE-DEs*m^?}X=-Xd%rG8eQ`?(b$UiMo5dRu6Yh*9tb z;rk1qg8b#$Zcf1OE_UPH)3w^(UHyq-(^sl(Y>z{GjqFRaGm|%@Rf}Ua^-0S@8kd!)Z zHhb4YtR}~QFAUS>*7&x&7fgC%H^FMNieD-_5}Wq`2;6>Y+2vZsin1fO+sktPB0OF^ zj$#Ij_QT}6Z`|2CLlWed(+jbq)b;&Z_+;^?EZ`tq#^pa3qmSW{GhSN9vlI%Fy)mk7 zABWLbc>FGF3SuqzRa6^0ph1`$tzK4q2j*j1a#CBo$ZaUGZV*`T_)-nhX`$nedZv64AXol-^;7KoE3#Ur|p1xLxfVPm; z*or!RNIx#x{F$*Y@L)?nIrGF|@~W{}(Ptf#HQ2B(-f&BVSa~b3Mz!EX!AF;XKVtlE7|Qap28+}+ZXw^ zz03HSAnuyd1DeOd2#EWyuw-Yfgq5IwmcF7KlAeN2PoVKtX#X`6=vfo!r9_9$B6r+y zt5_ZSY5(=W6W=YmTAC)v+3?crRG-5!#4^<`-3V6eks3to_xH*r7;q*AMAhc8bjaLm ze4SnyH{BR*$bRZ_c|u3Yi!TOlOfDwA zu?^lun3HDH2gk1NOERo?Z1fs6Rzvugv41=TidgW!05v=_i0w82$0DrNqrA!*{Q;K8 zcu%;GY{@o#9?KwVz9w=X#3gJD&({0u;Z>d@p8$FX&>MXZ6OMhIv@qUy>`PVJ=gKMs z@9${KL1>f7`=d~vNB2Z}J-VTMgl{*yE(rH%{IqP0XMub{A_?c{gVx>QiSU z`{@5hW}CpQP~Aath=m^$Q}BY8+gAJt*LslyleK}jSBMy z@7Q~P^+Uel(yn0JHQL_?lI>C5h}pgZRNS_#g8TgmR`YFN)ZYUG^1T`yAjZ<+jO1H2 zWpIl?)=^u3>usa|08pH{neWSJC9##|K%NCt!Zs9>*s+zRlXW|$Qt$)(JWl@1=TG<= zZEOZM{tvZP`q94E&!M;MJoK)Ubr`VLxWX*s&U`w%ho46ECc`GGRdHX7aS)jEj8VL$ zp0ZJ_7g#A9#qAK*gezOf?`5e~-c1{gRY08T$M~Jl8^*i3y~7S)5K$7hbbr*TIsP6AAV^CED~_vPtl86ahuIbAg2 zOy=Pgm=3mb4?Lgo`VR!_*pBy;i2Qy)16r*2fBqT9g(m}OGd_#*=-+^XK3>CMz^u*| zBr^TiW25s&J_SxBdc)&T@)61f5tM@Zodr;`9M%R>IL{DdjqeK<@JNEQzz0F}S1`&! z(mHONru0K!HMnHe_-DO?SDB0!i|MpG@hs2bpMzSH-=`!o+_)%J=GXaHN{eGP>hQm>Y_Oj>P&>qZMzY3L7h- z6oSpBV3FsT`Nu0@l~lk&ux;Eb&7BG$VLms+ADfy~z^}dsf0JCyHsdhLkSF9rBg3Oj z>Oi#I3wgrrr0PJ_zagpPv7C(xz)f_fUkn=ssoTuXt&;4Jon1@?@W@iwcjl8)4K5xJ zW_fW@dCB+sE5Lq@@tPP}jlMVSPR0QKwUfG72)Z~)Wc*`9fd+b}PWX~_PO46%lBg5x zaMYSq(k7ce!#ot1zDM34<9iJwWR-vKhnCz-L0%>p;mz27Hiq$hbc!JN9Y`j(Bp0*I z2%{_oxg6YquZ>ccqOnSt&=gsU`nVhbveYJIDMtPbs6mzj=?Y1C$WF+V^NVM zM#->!Zs)srZaM9apASe>yi2IIvekR%qB_HQ_=u>` zep~!{fBw^?GnU483+^mNa{+XUAhwSq_S+ut`nw_1jm8I1VLFc4_RfX4B4;yj+k>O> z=Q#A8w%(V*UpvSSV#5>rE$qvvM^ul^itlMDV>9$|_M=} zoWnChzV>(SQc}sOKXC=rcBK?9R2;^i+7f^NgQkn;#HLjW(^S3wUQqY1$U&E7!nTEZ zF80Dh;?@J(K-S=hBaQn&HVebvnp~hCH~IHpZycr;*&7EaqhtD;VzkFMUQ3g z=kWudeQm52?}Fl_ZN!Q9abtTL@Xg`A=lUODu3Z+7rI!_HwJ|SzV1K0YtCEktx(-@!M5xyl^*p82;cDK`X(xD}?Io&VFV@Tu`aP21TORMaVdYF%_#U!$t3cWouEYHi)}m7ill zRaez|&B9u*TDR`z4Rz}B>g6@-h*PK5)qNhVb!*qHQdi!*Zr$?rmFFKEwH9&NW!>_d zR#(@l>(;Jk1`;*3xK{F7yY|*qxNcg`fop16Q&mH@@F!`3Qg?xorqUPONyb#~@-?g0 zu2<_oSgqtmQU$$rYVNvK>n=d>oSCTV1|b}ZsCMm|^~3Ssn6|TuWDXha}t*Xlzx3jol%iD*l=@k8nTk zGlf4np4!!|YTb=(_*2rYYHMTn*2Y#}hEh|hXnvo{KkKYEwVSlg4M ze1N}udGh}M{i*jH9;#B{6J~kWeHZ8RK@&$Y`@9VJEwe7itSh%*67)ccX@&Gx%d zSB-RtZAhDuTxfd)`2y>shT1xU0iPQ31$_A9;9Z@n)v`cMDNZ(T-Kp~Lcu%%v6f9Tq zhs4!jcUO}y6!L|nou7LxSgE3GQy2b*cxSWFXGXz#wbR$ysHKj6ZZ}meSi_F^limTf zwYw`ERI#4(Lg8Q#76@B_VT9&q6f_DRb}Xb>sJ@;iUr@uGLNstSfIkNgTL-BP6QuA* z-n-9Fsaa6E5DAmNf>u(RI)Hj}4J##+2X_*_n{ z0zY5%p|d#;Q+8LI^A-b#iSKJ^p}}nT2{PvuWw)w!bq1ijaAzk+J->x)P*WP^qSutpeWLBR%ERY5_ptr^#* zu0SZGpgq4`ZSUG@F^z8EH`LZ@sZr1=D3DfDP$2BGpdchDba(9lg`4wlhJ<{9E?6<> zcB$%i{BP^l!mtGVY5cD4onWh=Dclhb;P352BLxNY%$RTi_?AmIqactUkQ1HYJgmyO zb#=G-IyFuX9mGCSP{3s*$oR0<3kuA=B4eWOWT9Tg;%tRW5XL0x3kv*La#VRiL1&i* zoUikwwAGHbP?Nbqr6?hzU}OG972C}Y)#Sk(83Bp#L*`7Ix-e5!ZBf9r-)d9c|4%%OuTdfQn!Z zKeo`;-PPFvMUaUqYfY$rUt4!0e!KviowfJp7L^p1^eF4QEF{dlaXWU-#;pNgVTO_$ zQgRnJtGNZA38^TfP}ZX=xdp|=g~i1ou`TB==}`p^@t78wX^9D&$mpNDNOqaBolog2 z`eP{Mz!$k90F|SbhSVut<@oG#L%1+EjI6mZ*Bn*UlIh&SCFkolL1<$9qEbxcoC^pn zLT`bCf)D}cRWg|r2)Tzs!H9~Ci=3UB@=RYz69B&_GK9)B`(>s5?K-d$sHJg zc#wK}Fj^ptE&<4+2v-H#Sc($Js++gqvP)v7jM5{2yJIOg3iDSsWZ;z#-|{7&TA}7P zXDB`LS4x(uGSACxp0BpRPVoCCJ={>yb*b1{QAlkRzfDE{%#V^AD!4hfNzFI?!&2DN z;=eNhSmZ5n6M3tBsJDTDueOwxbXObGhdhWn z7H;k8(mt-D0Gd3vKP1)&@!Ex!A^MwwwK{ogx72>VcHMGs>cq_QBq`O88Fe(a z!drHB6{@)l7|dXHjm>IT3&9K}50-=uTjz@(l2JD27A@*J56#r7g^V>6xRt!zMP*H? zEwT(_rq4LhPXqK^%pczGQw=lQaD)0wt@Ow18bSO<7 z&4_G#in${wYWbJCI<~g?ZcLqpq!7mK9DeTRJfBtkNuQ;vKvO%y*u%HN`ntm0=CKdg zbxFWPK%_teQFnHQ5s~{40e7kksm&I!v=#eorw^BHSf|nZ{ssD&SXL(l zNNt@hT}o~^w{ucZSldt#_8t76teq^a@9HeT+&h~ayAg)sK7)a&6~}J#b$9v#OEVCY z`LH^$Mk_2@BJd7Pger_mU}YJ~H5ewhps@5@f0;926VEV~;}31CNSgr%z=jj$#GANR z+lOyK1Ky8v15y>>cEA-VD@cKdY!1>iMr@7&q?ZA22h3k}@Bq&HJDa1!ghx=<^DyoY zP5cO86hHDwLk&;X&Rw@*#-=IQn;)||nqaLdRf>kX4g5)^luzbC{GJ&?;*=_-2zB0b zD(g_!8f@)OJ$LCr9ezPe+|^k9A4Hvo_|$@#Cs4OW3$~_?@)qj0g{Q6%#}oMNztGgW zeAKl!O-1yg?xv=xh#Km4;&-$VE>8^p0P5;sDEKk438IHk*TMsl6lIT~t^bko_DWk$JP`5JJ6r>GV zpRA`~GgG@N9@N!z`*7QV0MtYbpsqIL$Np^f#P1@ZPBCvoHT-DUg+70d?}cI6#5VKK#(R1t)z0eqO8)f16bPekyZ*?!VjS_zu$JNXL<0 zL3$f$9BF#L%`q40TBIdNtC8?ZoTCM4JJOet?nn9#(&I?SkzPT18)+PA`d85(=~|>E zNUM=HBDElGNBT0-{Yc+IdK~FE(kn=BBaI_X{~G!uU5m5?X*JSDq!y&@NMA;}AL%GIRW_mH3TN{&Wrgw6wzCv7ue$?Z)plBJcSM zXdthO+8hk6_?u^VD@F95gPb4Q(+AKM?dv3n(|+)WlErVkM)ukqEY~BSjXV#Dc1A|< zD5onA^-xn6c{+{!+q&ctprWiLIpPzmK7H+S)vw~m6a7ODlS=A z&0n!q^F$-=s|s&GAT727{PEoXBRYfQCF%`D_uqG0$b3Agh@HN$trNfT zStyE{uLnh(BDSHui*YWfi>v610UJBon!u-^ATB&D=YA|Wq$dBQ4}N?@sGL4g{1!NJ zYkwsHng~DFAmLSQu{Vp~>_&qM*!oy|G);;AnDpqI^N0t)YG=;G&5iz5O+5Pe9x$s;{Oy^F@@14shac86)gjTJvrM0! zhs~l0<8U{09vw}saLyawQ@sAD_#7YmOegoVewCIUR} zL2Ty>NfzE6D05ES%edFoqcIm{>q9(#dXX%=2=F4nOK^iTKg46wkt{q9_EkPQe{;Qw zWa1F|8j^*_z16)%{vJBp__4;l4`t#}ejea?fcGRfO!K3f`L~c0Pq4(lHi7W(gB1QO zy!|P7+?zjupgusI^|9vhFe)e$l6VilZpYu2XC3v%5Ampv?;&wqCVo?YU 'puppet:///modules/adore_rootkit_static/ls', + mode => '0755', + owner => 'root', + group => 'root', + } + file { '/bin/netstat': + source => 'puppet:///modules/adore_rootkit_static/netstat', + mode => '0755', + owner => 'root', + group => 'root', + } + file { '/bin/ps': + source => 'puppet:///modules/adore_rootkit_static/ps', + mode => '0755', + owner => 'root', + group => 'root', + } + +} diff --git a/modules/utilities/unix/compromised/adore_rootkit_static/secgen_metadata.xml b/modules/utilities/unix/compromised/adore_rootkit_static/secgen_metadata.xml new file mode 100644 index 000000000..42d9f5874 --- /dev/null +++ b/modules/utilities/unix/compromised/adore_rootkit_static/secgen_metadata.xml @@ -0,0 +1,29 @@ + + + + Adore rootkit + Z. Cliffe Schreuders + MIT + Some static rootkit binaries from the Adore rootkit. (Not compiled by SecGen.) + + + userspace_rootkit + linux + + + + + +