## Ransomware
### Dockerfile
#### Creation Dir
This command creates a directory */var/run/sshd* within the Docker container. This directory is used for storing the OpenSSH server's runtime files, such as its PID file.
```Dockerfile
RUN mkdir /var/run/sshd
```
#### Create a New user
This command creates a new user named fsociety with the following options:
- '**-m**': Create a home directory for the user
- '**-s /bin/bash**': Set /bin/bash as the user's login shell

After creating the user, it sets the password for the fsociety user to Ihackedyou using chpasswd.
```Dockerfile
RUN useradd -m -s /bin/bash fsociety && echo "fsociety:Ihackedyou" | chpasswd
```
#### Set Login
This command modifies the SSH configuration file (*/etc/ssh/sshd_config*) to allow root login via SSH. By default, SSH servers often disable direct root login for security reasons (*PermitRootLogin prohibit-password*). This command replaces *#PermitRootLogin prohibit-password* with *PermitRootLogin yes*, effectively allowing root login.
```Dockerfile
# Set SSH to allow root login (optional)
RUN sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
```

### Setup File
#### Start SSH Deamon
The command:
```bash
/usr/sbin/sshd -D
```
is used to start the SSH daemon (sshd) and keep it running in the foreground. \
'*/usr/sbin/sshd*' is the path to the SSH daemon executable. *sshd* is the service that listens for and manages incoming SSH connections. When you start *sshd*, it enables the ability to connect to the container via SSH. \
The '*-D*' flag tells *sshd* to run in the foreground (not as a background daemon). This is important when running *sshd* inside a Docker container because Docker containers need to have a main process that keeps running. If the main process stops, the container will exit.

### Installer File 
This script starts by installing the required packages from the *requirements.txt* file and then check if crontab is installed or not, in case it is not it will install it. \
Then it moves the *update.py* script to the */usr/local/bin/update/* folder, so that it will be harder to find the script and if the victim deletes the downloaded folder, the script will still be in the computer. \
The next step is to add the script to the crontab of all users that are inside the computer. The users are obtainer with:
```py
def get_users():
    # Get a list of users with UID >= 1000 (normal users)
    users = []
    for user in pwd.getpwall():
        if user.pw_uid >= 1000 and user.pw_name != 'nobody':  # Exclude system users
            users.append(user.pw_name)
    return users
```
Adding the script inside crontab will run the script every tot time, in this case every minute (the interval is short due to test purposes).

### Update File
Inside the update file I set the destination where to send the files (the ip address of the attacker, not the smartest move but at least it works) and the details about the user used to log into the SSH user (same thought as before). I also specified the port, in this case *22*, that I use for the SSH Deamon. \
This script has some target directory that will be copied to the SSH attacker folder. \
In the attacker folder, the script will create a folder with the name of the user and then, inside it, it will insert new folders every time the scrip is run.
