import java.io.IOException; import java.io.FileNotFoundException; import java.io.InputStream; import java.io.FileInputStream; import java.util.List; import java.util.Enumeration; import java.util.Properties; import java.io.Reader; import java.io.BufferedReader; import java.io.FileReader; import java.io.File; import java.util.ArrayList; // // Decompiled by Procyon v0.5.36 // public class DetectVulnurability { static final String basePath = ""; static final String jsonPath = "..\\logs\\SSID.props"; static String[] potentialFileList; static String classpathDir; public static void main(final String[] args) { Boolean compromised = Boolean.FALSE; try { System.out.println("Going to Check for IR232 in Desktop central service\n"); final Properties properties = readPropertiesFile("" + DetectVulnurability.classpathDir); final Enumeration enums = (Enumeration)properties.propertyNames(); final List list = new ArrayList(); while (enums.hasMoreElements()) { final String key = enums.nextElement(); final String value = properties.getProperty(key); list.add(value); } Boolean zipFound = Boolean.FALSE; for (int i = 0; i < list.size(); ++i) { final String[] jarList = getFileList("..\\" + list.get(i)); for (int j = 0; j < jarList.length; ++j) { if (jarList[j].endsWith(".zip")) { zipFound = Boolean.TRUE; compromised = Boolean.TRUE; } } } if (zipFound) { printAndWriteToLog("Check 1 : Fail : Zip deploy Confirmed\n\n"); } else { printAndWriteToLog("Check 1 : Safe : Zip Not present\n\n"); } final File file = new File("..\\logs\\SSID.props"); try { if (file.exists()) { final BufferedReader br = new BufferedReader(new FileReader(file)); String line; while ((line = br.readLine()) != null) { if (line.matches("RCEF=.*")) { if (line.contains("\"deletedCount\"\\:0") && zipFound) { printAndWriteToLog("Check 2 : Fail : Zip was created and deletion failed. Attack Active\n\n"); compromised = Boolean.TRUE; } else if (line.matches("\"deletedCount\"\\:[0-9]+")) { printAndWriteToLog("Check 2 : safe : Zip was created and Silent Fix deleted Zip\n\n"); } if (!line.contains("\"attackStatus\"\\:\"active\"")) { continue; } compromised = Boolean.TRUE; } } } else { compromised = Boolean.TRUE; printAndWriteToLog("Check 2 : Fail Silent Fix not executed\n\n"); } if (getMaliciousFileCount(DetectVulnurability.potentialFileList) > 0) { printAndWriteToLog("Check 3 : Fail Potential backdoor found\n\n"); compromised = Boolean.TRUE; } else { printAndWriteToLog("Check 3 : Safe No known backdoor found\n\n"); } } catch (Exception e) { e.printStackTrace(); } } catch (Exception e2) { e2.printStackTrace(); } if (compromised) { System.out.println("COMPROMISED. Contact Support"); } else { System.out.println("SAFE. Your setup is safe"); } } private static int getMaliciousFileCount(final String[] fileList) { int count = 0; for (int i = 0; i < fileList.length; ++i) { if (new File("" + fileList[i]).exists()) { ++count; } } return count; } private static String[] getFileList(final String path) { String[] files = new String[0]; final File file = new File(path); if (file.exists()) { files = file.list(); } return files; } private static void printAndWriteToLog(final String input) { System.out.print(input); } private static Properties readPropertiesFile(final String fileName) throws IOException { FileInputStream fis = null; Properties prop = null; try { fis = new FileInputStream(fileName); prop = new Properties(); prop.load(fis); } catch (FileNotFoundException fnfe) { fnfe.printStackTrace(); } catch (IOException ioe) { ioe.printStackTrace(); } finally { fis.close(); } return prop; } static { DetectVulnurability.potentialFileList = new String[] { "..\\webapps\\DesktopCentral\\html\\help_me.jsp", "..\\webapps\\DesktopCentral\\html\\help_me.html" }; DetectVulnurability.classpathDir = "..\\conf\\classpath.conf"; } }