Admin

name	type	size	perms	modified	actions
[parent directory]
configs/	dir	-	0755	2026-08-06 17:55:45
includes/	dir	-	0775	2026-05-15 12:30:20
storage/	dir	-	0755	2026-05-15 12:29:56
tests/	dir	-	0755	2026-08-06 17:56:33
webuzo/	dir	-	0755	2026-08-06 17:56:17
assettemplate	file	17,021 B	0755	2026-08-07 21:04:17	edit
benchmark	file	121,591 B	0755	2026-08-01 23:51:03	edit
check_for_self_update	file	3,165 B	0775	2026-05-31 16:07:50	edit
cpapi	file	5,955 B	0755	2026-08-06 17:52:32	edit
firstbootkvm	file	5,648 B	0755	2026-05-15 08:46:00	edit
fixsemgetapache	file	422 B	0755	2026-05-15 08:31:37	edit
quicksecurityscan	file	54,901 B	0755	2026-05-30 15:15:10	edit
randompass	file	756 B	0755	2026-05-16 13:43:03	edit
res	file	7,250 B	0755	2026-05-15 08:30:52	edit
resolvconf	file	1,751 B	0755	2026-05-15 08:31:45	edit
sshkeyme	file	1,636 B	0755	2026-05-15 08:50:47	edit
systemstats	file	4,312 B	0755	2026-06-11 16:53:27	edit
updateda	file	1,122 B	0755	2026-05-15 08:29:58	edit
upgradedebs	file	2,613 B	0755	2026-05-15 08:58:51	edit
upscripts	file	6,960 B	0775	2026-08-13 16:32:45	edit

editing: quicksecurityscan

#!/usr/bin/env bash

# 05/02/2026
# Rootkit & Security Scanner - V68 (Production Master)
# Refactor: Downloaded sigs now used, global pkg file index, mktemp dir, append-only flag, ERE cron grep, process spoofing detection

# --- 1. UI & Formatting Helpers ---
RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
NORMAL='\033[0m'

msg()  { printf "${CYAN}[INFO]${NORMAL} %s\n" "$1"; }
warn() { printf "${RED}[WARNING]${NORMAL} %s\n" "$1"; }
ok()   { printf "${GREEN}[OK]${NORMAL} %s\n" "$1"; }

# --- 2. Setup & Global Variables ---
mytmp=$(mktemp -d /root/tmp_scan.XXXXXX 2>/dev/null || { mkdir -p -m 700 /root/tmp && echo /root/tmp; })
chmod 700 "${mytmp}" 2>/dev/null

BAD_PATHS=(
    "/usr/local/lib/libdev.so"
    "/usr/local/include/..."
    "/etc/cron.d/.system-update"
    "/usr/bin/w-"
    "/root/.local/bin/system-service"
    "/var/lib/.lunchbox_agent_cache/.initd_loader.sh"
    "/var/lib/systemd/.ilog"
    "/tmp/.systemd_helper/.systemd_script.sh"
    "/var/lib/.systemd_helper/.systemd_script.sh"
    "/root/.sysvsd" "/etc/.apache" "/root/sshd" "/root/.rsyslogd"
    "/etc/profile.d/./systemd-network.sh" "/root/.run.sh" "/etc/.nginx"
    "/usr/share/man/man3/.syslog-7aadf043" "/tmp/.systemd/systemd-resolved"
    "/usr/lib/systemd/systemd-kworkerd" "/etc/systemd/system/4thepool_watcher.service"
    "/etc/systemd/system/systemd-resolved.service" "/etc/systemd/system/systemd-helper.service"
    "/var/tmp/.npm" "/root/.systemd/systemd-resolved" "/HRZJ19a" "/Q6jQoE" "/bXz0YZ98g" "/identify"
    "/root/.cache/cloudd" "/usr/bin/VGAuthServse" "/etc/cron.d/rondo" "/usr/bin/.locatione" "/.system3d"
    "/.b4nd1d0" "/etc/systemd/./system/alive.service" "/etc/systemd/./system/networkerd.service"
    "/dev/x86" "/dev/fghgf" "/usr/bin/sshd" "/tmp/runnv/lived.sh" "/etc/systemd/system/systemd-utils.service"
    "/etc/systemd/system/lived.service" "/etc/systemd/system/system-sysinit.service" "/usr/sbin/wsystemd"
    "/etc/rondo/rondo" "/root/.systemd-utils" "/etc/init.d/rondo" "/etc/data/libsystem.so" "/etc/data/curl"
    "/etc/systemd/system/system-update-service.service" "/etc/cron.hourly/0"
    "/tmp/.X25-unix/.rsync" "/root/.config/cron/perfcc" "/etc/cron.d/perfclean" "/bin/perfcc"
    "/lib/libudev.so" "/bin/ygljglkjgfg0" "/bin/good" "/usr/bin/good" "/usr/bin/ygljglkjgfg0"
    "/bin/nqhoryuybnpsa" "/usr/bin/iqiqulthyu" "/etc/data/kinsing" "/tmp/kdevtmpfsi" "/tmp/sysupdater"
    "/sbin/pam_tms" "/dev/shm/.X18-unix" "/dev/shm/watchdogg" "/dev/shm/pid.lock" "/usr/.work/work32"
    "/tmp/xmr" "/tmp/kinsing" "/tmp/auth.sh" "/tmp/secure.sh" "/tmp/aeokzxwx.txt"
    "/etc/systemd/system/kmodaudit.service" "/usr/bin/.local/bin/crontab" "/lib/libgcwrap.so"
    "/usr/lib/libsystemd-shared-165.so" "/var/spool/.system" "/etc/.httpd" "/var/.httpd" "/etc/..."
    "/usr/bin/zzhcht" "/bin/zzhcht" "/root/.1" "/tmp/.X2ei-unix" "/root/.configrc5" "/tmp/lol"
    "/tmp/RUN" "/tmp/x86_64" "/usr/games/.ssh" "/usr/lib/popauth" "/etc/cron.daily/dnsquery"
    "/tmp/.motherfucker" "/tmp/fax" "/tmp/linux" "/.mod" "/usr/sbin/kw0rker" "/etc/kswpad"
    "/usr/bin/.sshd" "/usr/lib/libgdi.so.0.8.2" "/tmp/up.txt"
    # Fileless/miner drop paths
    "/tmp/.ICE-unix/.x" "/tmp/.font-unix/.x" "/tmp/.X11-unix/.x"
    "/dev/shm/kinsing" "/dev/shm/kdevtmpfsi" "/dev/shm/.x86" "/dev/shm/xmrig"
    "/var/tmp/kinsing" "/var/tmp/kdevtmpfsi" "/var/tmp/.x86_64" "/var/tmp/xmr"
    # Common dropper locations
    "/usr/local/bin/kswapd0" "/usr/local/bin/kworker"
    "/usr/local/bin/sysupdate" "/usr/local/bin/sysguard"
    "/usr/local/bin/networkservice" "/usr/local/bin/pastebin.sh"
    "/etc/sysconfig/.systemd" "/etc/update-motd.d/.update"
    # LD_PRELOAD rootkits
    "/usr/local/lib/libselinux.so" "/usr/local/lib/libc.so.1"
    "/usr/local/lib/libprocps.so" "/usr/local/lib/libkeyutils.so.1"
    "/lib/libselinux.so"
    # Known botnet/RAT paths
    "/tmp/.gdm-session" "/tmp/.dbus-session" "/tmp/.bash_history"
    "/var/tmp/.bash_history" "/var/tmp/.ssh"
    "/root/.configrc" "/root/.configrc4" "/root/.configrc6"
    "/root/.X11-unix" "/root/.dbus"
    # perfctl malware paths
    "/bin/.local/bin" "/bin/.local/bin/crontab" "/bin/.local"
    # Additional known malware binaries
    "/usr/bin/.atm" "/usr/bin/wizlmsh"
    # Crypto miner hiding in zoneinfo
    "/usr/share/zoneinfo/.dbus" "/usr/share/zoneinfo/.dbus/dbus-daemon-service" "/usr/share/zoneinfo/.dbus/.k"
    # Syslog-ng hiding malware
    "/usr/share/man/man3/.syslog-c92cbdb2" "/usr/share/man/man3/.syslog-e647ab7e"
    # Linux binary dropper artifacts
    "/root/linux_amd64" "/tmp/linux_amd64" "/var/tmp/linux_amd64"
    # Malicious profile persistence
    "/etc/profile.d/system_profiled_service.sh"
    # Hidden systemd helper scripts
    "/var/lib/.systemd_helper" "/tmp/.systemd_helper"
    # Reconnaissance and malware binaries in /usr/bin
    "/usr/bin/masscan" "/usr/bin/qq" "/usr/bin/ww"
    "/usr/bin/defunct" "/usr/bin/gs-dbus"
    # Malicious systemd units
    "/etc/systemd/system/multi-user.target.wants/defunct.service"
    "/etc/systemd/system/multi-user.target.wants/gs-dbus.service"
    # cPanel backdoor
    "/usr/local/cpanel/cgi-sys/cpanel.py"
    # Malicious init.d and tmp persistence scripts
    "/etc/init.d/system_update" "/tmp/system_update"
    # Hidden root-level binaries
    "/.mod" "/.x" "/.a" "/.b" "/.sh"
    # .local/bin malware persistence
    "/root/.local/bin/system-service" "/root/.local/bin/kswapd0" "/root/.local/bin/sysupdate"
    # Architecture-suffixed malware binaries in /usr/local/bin
    "/usr/local/bin/lava.x86_64" "/usr/local/bin/lava.arm" "/usr/local/bin/lava.aarch64"
    "/usr/local/bin/update.x86_64" "/usr/local/bin/sysupdate.x86_64"
    "/etc/cron.hourly/.update" "/var/spool/cron/.root"
    # Additional known malware paths
    "/var/tmp/system-service"
)

# --- 3. Functional Modules ---

fetch_remote_data() {
    msg "Downloading signatures..."
    local base="https://raw.githubusercontent.com/CpanelInc"
    local files=(
        "tech-CSI/master/suspicious_procs.txt"
        "tech-CSI/master/suspicious_files.txt"
        "tech-CSI/master/suspicious_cron_strings.txt"
        "tech-cp_license_troubleshooter/master/shenanigans.txt"
    )
    local names=(suspicious_procs suspicious_files suspicious_cron_strings shenanigans)

for i in "${!files[@]}"; do
        local url="${base}/${files[$i]}"
        local out="${mytmp}/${names[$i]}.txt"
        if command -v curl >/dev/null; then
            curl -o "$out" --connect-timeout 10 --silent "$url"
        elif command -v wget >/dev/null; then
            wget -4 -q --timeout=10 -O "$out" "$url" >/dev/null
        else
            warn "Neither curl nor wget found — skipping signature download"
            break
        fi
    done
    # Validate downloads — discard empty files or HTML error responses
    # Also strip non-ASCII characters that cause read: invalid identifier errors
    for sig_file in suspicious_procs suspicious_files suspicious_cron_strings shenanigans; do
        local f="${mytmp}/${sig_file}.txt"
        if [ ! -s "$f" ] || grep -qi "<html" "$f" 2>/dev/null; then
            warn "Signature file ${sig_file}.txt missing or invalid — removing"
            rm -f "$f"
        else
            # Strip non-ASCII, carriage returns, and blank lines in-place
            LC_ALL=C tr -cd '\11\12\15\40-\176' < "$f" | grep -v '^[[:space:]]*$' > "${f}.clean" && mv "${f}.clean" "$f"
        fi
    done
}

check_persistence_shims() {
    msg "Scanning shell profiles for wget/curl shims..."
    shopt -s nullglob

# Suspicious patterns in shell startup files
    local shell_payload_regex="(wget|curl).*(http|ftp)|/\.local/bin/|pgrep.*system-service|system-service|\.local/bin/[a-z]"
    local profile_files=(/etc/profile /etc/bashrc /root/.bashrc /root/.bash_profile /root/.profile /home/*/.bashrc /home/*/.bash_profile /etc/profile.d/*)

for p in "${profile_files[@]}"; do
        [ -f "$p" ] || continue
        # wget/curl fetchers
        grep -qE "(wget|curl).*(http|ftp)" "$p" && warn "Suspicious payload fetcher in $p"
        # Hidden binary execution — .local/bin or similar hidden paths (skip comment lines)
        if grep -vE '^\s*#' "$p" 2>/dev/null | grep -qE "(^|[[:space:]]|=)/[^ ]*(\.[^/[:space:]]+/)+[a-zA-Z]"; then
            local match
            match=$(grep -vE '^\s*#' "$p" 2>/dev/null | grep -Em1 "(^|[[:space:]]|=)/[^ ]*(\.[^/[:space:]]+/)+[a-zA-Z]")
            # Skip known legitimate patterns — shell glob patterns, known config dirs
            echo "$match" | grep -qE "(\.cpanel|\.gnupg|\.ssh|\.config/systemd|source \.|profile\.d/\*|/\*\.sh|for .* in|sh\.local)" && continue
            warn "Suspicious hidden path execution in $p"
            warn "  Line: $(echo "$match" | head -c 120 | tr -d '\n')"
        fi
        # Explicit known bad paths
        if grep -qE "(\.local/bin/system-service|/root/\.local/bin/[a-zA-Z])" "$p" 2>/dev/null; then
            local match
            match=$(grep -Em1 "(\.local/bin/system-service|/root/\.local/bin/[a-zA-Z])" "$p" 2>/dev/null)
            warn "Malware persistence in $p"
            warn "  Line: $(echo "$match" | head -c 120 | tr -d '\n')"
        fi
    done
    shopt -u nullglob

# perfctl malware injects /bin/.local/bin into PATH via /etc/profile
    if [ -f /etc/profile ]; then
        if grep -q "/bin/.local/bin" /etc/profile 2>/dev/null; then
            warn "PERFCTL INDICATOR: /bin/.local/bin found in /etc/profile PATH"
            warn "  Line: $(grep '/bin/.local/bin' /etc/profile)"
            warn "  Check also: /etc/ld.so.preload (may be hidden — use: lsattr /etc/ld.so.preload)"
            warn "  Check also: /tmp/.cache /root/.cache /tmp/kdevtmpfsi /tmp/kinsing"
        fi
    fi

# perfctl also injects into profile.d
    for p in /etc/profile.d/*; do
        if [ -f "$p" ] && grep -q "/bin/.local/bin" "$p" 2>/dev/null; then
            warn "PERFCTL INDICATOR: /bin/.local/bin found in $p"
            warn "  Check also: /etc/ld.so.preload (may be hidden — use: lsattr /etc/ld.so.preload)"
        fi
    done
}

check_network_anomalies() {
    msg "Checking for 'Ghost Ports' (Active ports with hidden processes)..."
    if command -v ss >/dev/null; then
        local whitelist="(cpanel|sshd|httpd|nginx|mysql|exim|dovecot|named|postgres|lsphp|litespeed|redis|memcached|spamd|pure-ftpd|java|cpsrvd|imunify-agent|systemd|cpdavd|cPhulkd|pdns_server|imunify360-webs|rpcbind|CalendarServer|mariadbd|mongod|postmaster|zabbix_agentd|nrpe|proftpd|imunify-residen|munin-node|xinetd|libvirtd|qemu-nbd|spice|vnc|unitd|directadmin|clamd)"
        local anomaly
        anomaly=$(ss -lptn | grep "users:((" | grep -vE "$whitelist")
        [ -n "$anomaly" ] && warn "Unrecognized process listening on port:" && printf '%s\n' "${anomaly}"
    fi
}

scan_files() {
    msg "Scanning malicious paths..."
    for path in "${BAD_PATHS[@]}"; do
        [ -e "$path" ] && warn "DETECTED: $path"
    done

msg "Scanning hidden system files..."
    local dot_paths=("/etc" "/var/lib" "/usr" "/usr/bin" "/usr/local/bin" "/usr/sbin" "/bin" "/lib" "/usr/lib" "/var")

for d in "${dot_paths[@]}"; do
        [ -d "$d" ] && find "$d" -maxdepth 2 -type f -name ".*" 2>/dev/null | grep -vE "$skip_regex" | while read -r hfile; do
            warn "Hidden file: $hfile"
        done
    done
}

check_downloaded_signatures() {
    msg "Checking downloaded CSI signatures..."

# suspicious_files.txt — check each path exists on disk
    if [ -s "${mytmp}/suspicious_files.txt" ]; then
        while IFS= read -r bad_file; do
            [ -z "$bad_file" ] && continue
            [[ "$bad_file" =~ ^# ]] && continue
            [ -e "$bad_file" ] && warn "CSI SIG FILE DETECTED: $bad_file"
        done < "${mytmp}/suspicious_files.txt"
    fi

# suspicious_procs.txt — pgrep -x per entry (already fast)
    if [ -s "${mytmp}/suspicious_procs.txt" ]; then
        # Processes that are legitimate on KVM/ZFS/virtualization hosts
        local is_kvm=0
        { [ -x /usr/bin/virsh ] || [ -x /usr/sbin/zfs ] || [ -d /vz/templates ] || [ -d /root/cpaneldirect ]; } && is_kvm=1
        local csi_proc_whitelist="^(dhcpd|dnsmasq)$"

while IFS= read -r bad_proc; do
            [ -z "$bad_proc" ] && continue
            [[ "$bad_proc" =~ ^# ]] && continue
            # Skip whitelisted procs on KVM/ZFS systems
            if [ "$is_kvm" -eq 1 ] && echo "$bad_proc" | grep -qE "$csi_proc_whitelist"; then
                continue
            fi
            pgrep -x "$bad_proc" &>/dev/null && warn "CSI SIG PROCESS DETECTED: $bad_proc"
        done < "${mytmp}/suspicious_procs.txt"
    fi

# suspicious_cron_strings.txt — single grep pass using -f flag
    if [ -s "${mytmp}/suspicious_cron_strings.txt" ]; then
        # Strings that appear as substrings in legitimate cPanel cron entries
        local csi_cron_fp="^(pcp)$"
        local cron_dirs=("/etc/cron.d" "/etc/cron.daily" "/etc/cron.hourly" "/etc/cron.weekly" "/etc/cron.monthly" "/var/spool/cron")
        for d in "${cron_dirs[@]}"; do
            [ -d "$d" ] || continue
            grep -rlF -f "${mytmp}/suspicious_cron_strings.txt" "$d" 2>/dev/null | while read -r cf; do
                grep -oFf "${mytmp}/suspicious_cron_strings.txt" "$cf" 2>/dev/null | sort -u | while read -r matched; do
                    # Skip known FP substrings — check if the line context is legitimate
                    if echo "$matched" | grep -qE "$csi_cron_fp"; then
                        # Only skip if it appears inside a known legitimate cPanel command
                        grep -F "$matched" "$cf" 2>/dev/null | grep -qE "(cpanel|upcp|cphulk|cpaddons)" && continue
                    fi
                    warn "CSI SIG CRON STRING '$matched' in: $cf"
                done
            done
        done
        [ -f /etc/crontab ] && grep -qFf "${mytmp}/suspicious_cron_strings.txt" /etc/crontab 2>/dev/null && \
            warn "CSI SIG CRON STRING match in: /etc/crontab"
    fi

# shenanigans.txt — each line is a file path, just check existence on disk
    if [ -s "${mytmp}/shenanigans.txt" ]; then
        while IFS= read -r shitem; do
            [ -z "$shitem" ] && continue
            [[ "$shitem" =~ ^# ]] && continue
            [ -e "$shitem" ] && warn "CSI SHENANIGAN DETECTED: $shitem"
        done < "${mytmp}/shenanigans.txt"
    fi
}

check_integrity_fast() {
    msg "Running targeted binary integrity check..."
    if command -v rpm >/dev/null; then
        rpm -V coreutils bash openssh-server util-linux 2>/dev/null | grep '^..5' | grep -E '/(bin|sbin|usr/bin|usr/sbin)' | while read -r line; do
            warn "Tampered Binary: $line"
        done
    fi

[ -x /usr/bin/sha256sum ] && {
        for f in /bin/passwd /usr/bin/passwd; do
            [ -f "$f" ] && [[ "$(sha256sum "$f" | awk '{print $1}')" == "e84636cf7f19dcded99c7fd173a6b4132dfe33ef761e27d457aa0bccb154240a" ]] && warn "$f hash matches known backdoor!"
        done
    }
}

scan_processes() {
    msg "Analyzing processes..."
    if [ -x /usr/bin/pstree ]; then
        pstree -p | grep -E "(ogkzcympjxwv|pnsnba|tsm|kdevtmpfsi|blitzbasic|kettenrad|\[bioset\]|wwizzrstcn|xnoyivgb|wknhuur|mrtgrunq|gs-dbus|gs-bd|rezemjkd|phugrcaxq|timeout|perfctl|watchdogg|shortcodes|mcm\.x86_64)" | grep -vE "wpt-panopticon|sw-engine" | while read -r line; do
            warn "Proc Regex Match: $line"
        done
    fi
}

check_cpanel_logic() {
    if [ -d /usr/local/cpanel ]; then
        msg "cPanel Logic..."
        if [ -f /var/cpanel/resellers ]; then
            grep ",all," /var/cpanel/resellers | cut -d: -f1 | while read -r reseller; do
                warn "Reseller $reseller has ALL ACCESS ACL (/var/cpanel/resellers)"
            done
        fi

# Check for kernel exploit mitigation configs — note if still active
        for conf in /etc/modprobe.d/dirtyfrag.conf /etc/modprobe.d/disable-algif.conf; do
            if [ -f "$conf" ]; then
                msg "NOTE: $conf exists — dirtyfrag/copyfail kernel exploit mitigation is active. May be safe to remove if kernel is fully patched."
            fi
        done

# Check if CSF is installed
        if [ ! -f /etc/csf/csf.conf ] && ! rpm -q cpanel-csf &>/dev/null; then
            warn "CSF firewall not installed on cPanel server — recommend: yum install cpanel-csf"
        fi
        if [ ! -f /var/cpanel/disable_whm_terminal_ui ]; then
            warn "WHM Terminal UI is ENABLED — provides browser-based root shell access"
            warn "  Disable with: touch /var/cpanel/disable_whm_terminal_ui"
        else
            ok "WHM Terminal UI is disabled"
        fi
        if command -v mysql >/dev/null; then
            local mysqlcheck
            mysqlcheck=$(echo "SELECT User FROM user WHERE Super_priv = 'Y' AND User NOT IN ('root', 'mysql.session', 'da_admin', 'mysql');" | mysql mysql 2>/dev/null | grep -v ^User$)
            [ -n "$mysqlcheck" ] && warn "MySQL Users with Super_priv: $mysqlcheck"
        fi

# --- cPanel Version Currency Check ---
        local version_file="/usr/local/cpanel/version"
        if [ -f "$version_file" ]; then
            msg "Checking cPanel version currency..."
            local installed_ver
            installed_ver=$(cat "$version_file" | tr -d '[:space:]')
            msg "Installed cPanel version: $installed_ver"

# Extract major.minor tier e.g. 11.110.0.50 -> 11.110
            local tier
            tier=$(echo "$installed_ver" | grep -oE '^[0-9]+\.[0-9]+')

# Validate tier format before using in grep regex
            if [[ ! "$tier" =~ ^[0-9]+\.[0-9]+$ ]]; then
                warn "Unexpected version tier format: $tier — skipping version check"
            else
                # Fetch tiers file over HTTPS to prevent MitM spoofing
                local tiers_url="https://httpupdate.cpanel.net/cpanelsync/TIERS"
                local tiers_data
                if [ -x /usr/bin/curl ]; then
                    tiers_data=$(curl -s --connect-timeout 10 "$tiers_url" 2>/dev/null)
                elif [ -x /usr/bin/wget ]; then
                    tiers_data=$(wget -q --timeout=10 -O- "$tiers_url" 2>/dev/null)
                fi

if [ -z "$tiers_data" ] || grep -qi "<html" <<< "$tiers_data"; then
                    warn "Could not fetch cPanel TIERS file — skipping version check"
                else
                    # Match exact tier e.g. "11.110:" not "11.110.0:"
                    local latest_ver
                    latest_ver=$(echo "$tiers_data" | grep -E "^${tier}:" | head -1 | cut -d: -f2 | tr -d '[:space:]')

if [ -z "$latest_ver" ]; then
                        warn "Could not find tier '$tier' in TIERS file"
                    else
                        msg "Latest available for tier $tier: $latest_ver"
                        # sort -V for correct semantic version comparison
                        if [ "$installed_ver" = "$latest_ver" ]; then
                            ok "cPanel is current ($installed_ver)"
                        elif [ "$(printf '%s\n' "$latest_ver" "$installed_ver" | sort -V | head -n1)" != "$latest_ver" ]; then
                            warn "cPanel OUT OF DATE: installed=$installed_ver latest=$latest_ver"
                        else
                            ok "cPanel version $installed_ver is ahead of or equal to tier latest ($latest_ver)"
                        fi
                    fi
                fi
            fi
        fi
        # Check cPanel user files for suspicious contact emails
        if [ -d /var/cpanel/users ]; then
            grep -rl "CONTACTEMAIL=" /var/cpanel/users/ 2>/dev/null | while read -r uf; do
                local email
                email=$(grep -m1 "^CONTACTEMAIL=" "$uf" | cut -d= -f2)
                local user
                user=$(basename "$uf")
                # Flag known malicious/placeholder domains and suspicious patterns
                if echo "$email" | grep -qiE "(exploit\.local|hack\.|malware\.|\.invalid|@localhost|0\.0\.0\.0|127\.0\.0\.1|test@test\.|@example\.com)"; then
                    warn "Suspicious cPanel user contact email: $user -> $email ($uf)"
                fi
            done
        fi
    fi
}

check_ld_preload() {
    msg "Checking LD_PRELOAD hijacks..."
    if [ -s /etc/ld.so.preload ]; then
        warn "Non-empty /etc/ld.so.preload: $(cat /etc/ld.so.preload)"
        warn "  NOTE: perfctl rootkit uses ld.so.preload — check with: lsattr /etc/ld.so.preload"
    fi
    # perfctl hides ld.so.preload using chattr +i — check even if file appears empty
    if [ -f /etc/ld.so.preload ]; then
        local lsattr_out
        lsattr_out=$(lsattr /etc/ld.so.preload 2>/dev/null | awk '{print $1}')
        if echo "$lsattr_out" | grep -q 'i'; then
            warn "PERFCTL INDICATOR: /etc/ld.so.preload has immutable flag set (chattr +i)"
        fi
    else
        # File doesn't exist — check if it's hidden by rootkit via lsattr trick
        lsattr /etc/ld.so.preload 2>/dev/null | grep -q '\-' && \
            warn "PERFCTL INDICATOR: /etc/ld.so.preload may be hidden by rootkit — run: lsattr /etc/ld.so.preload"
    fi
    local ld_whitelist="(memcached|twistd|caldav|cpanel-ccs|imunify|^SCREEN$|/bin/bash|/usr/bin/bash|/bin/sh)"
    local self_pid=$$
    grep -rl "LD_PRELOAD" /proc/*/environ 2>/dev/null | while read -r f; do
        local pid
        pid=$(echo "$f" | cut -d/ -f3)
        # Skip self and child PIDs of this script
        [ "$pid" = "$self_pid" ] && continue
        [ "$pid" = "self" ] && continue
        [ "$pid" = "thread-self" ] && continue
        # Skip if PID vanished between glob and read (race condition)
        [ -f "/proc/$pid/cmdline" ] || continue
        local cmdline
        cmdline=$(tr '\0' ' ' < "/proc/$pid/cmdline" 2>/dev/null)
        # Skip empty cmdlines (kernel threads)
        [ -z "${cmdline// }" ] && continue
        # Skip if cmdline matches this script path
        echo "$cmdline" | grep -qF "$0" && continue
        echo "$cmdline" | grep -qiE "$ld_whitelist" && continue
        warn "LD_PRELOAD in PID $pid: $(printf '%s' "$cmdline")"
    done
}

check_deleted_exes() {
    msg "Checking for processes running deleted executables..."
    # Known binaries that may show as deleted during package updates — skip these
    local deleted_whitelist="(dbus-daemon|dbus-launch|systemd|NetworkManager|avahi-daemon|rsyslogd|journald|udevd|polkitd|accounts-daemon)"
    ls -la /proc/*/exe 2>/dev/null | grep -i "deleted" | while read -r line; do
        echo "$line" | grep -qiE "$deleted_whitelist" && continue
        warn "Running from deleted binary: $line"
    done
}

check_proc_bind_mounts() {
    msg "Checking for bind mounts over /proc entries (process hiding)..."
    local found=0
    while read -r line; do
        warn "Bind mount over /proc entry: $line"
        found=1
    done < <(findmnt 2>/dev/null | grep '/proc/[0-9]' | tail -n 5)
    [ "$found" -eq 0 ] && ok "No bind mounts over /proc entries found"
}

check_proc_count_mismatch() {
    msg "Checking for hidden processes (ps vs /proc count)..."
    local ps_count proc_count
    ps_count=$(ps -e --no-headers 2>/dev/null | wc -l)
    proc_count=$(find /proc -maxdepth 1 -name '[0-9]*' -type d 2>/dev/null | wc -l)
    local diff=$(( proc_count - ps_count ))
    [ "$diff" -gt 5 ] && warn "Process count mismatch: ps=$ps_count /proc=$proc_count (diff=$diff)"
}

check_proc_spoofing() {
    msg "Checking for process name spoofing..."
    # Compare /proc/*/comm (display name) against actual binary name from /proc/*/exe
    # Malware uses prctl(PR_SET_NAME) to masquerade as kworker, sshd, etc.
    for pid_dir in /proc/[0-9]*/; do
        local pid comm exe_name
        pid=$(basename "$pid_dir")
        [ -r "${pid_dir}comm" ] || continue
        [ -r "${pid_dir}exe" ] || continue
        comm=$(cat "${pid_dir}comm" 2>/dev/null)
        exe_name=$(readlink "${pid_dir}exe" 2>/dev/null | sed 's/ (deleted)$//' | xargs basename 2>/dev/null)
        [ -z "$comm" ] || [ -z "$exe_name" ] && continue
        # Skip kernel threads — no exe target
        [ "$exe_name" = "exe" ] && continue
        # Flag if comm looks like a kernel thread but exe is a real binary in /tmp or /var/tmp
        local exe_path
        exe_path=$(readlink "${pid_dir}exe" 2>/dev/null)
        if echo "$comm" | grep -qE '^\[k(worker|thread|softirq)|^\[.*\]$'; then
            if echo "$exe_path" | grep -qE '^(/tmp|/var/tmp|/dev/shm|/home)'; then
                warn "Process spoofing: PID $pid comm='$comm' but exe=$exe_path"
            fi
        fi
        # Flag if comm claims to be sshd/systemd/init but exe is outside expected paths
        if echo "$comm" | grep -qE '^(sshd|systemd|init|kthreadd|rcu_)'; then
            if echo "$exe_path" | grep -qE '^(/tmp|/var/tmp|/dev/shm|/home|/root)'; then
                warn "Process spoofing: PID $pid comm='$comm' but exe=$exe_path"
            fi
        fi
    done
}

check_unpackaged_suid() {
    msg "Checking for unpackaged SUID binaries..."
    local pkg_file="${mytmp}/all_packaged_files.txt"
    # Known legitimate SUID binaries that may not appear in package index
    local suid_whitelist="(cagefs_enter|cagefs_enter\.proxied|mount\.nfs|mount\.nfs4|fusermount|newgrp|chage|chfn|chsh|write|wall|ssh-keysign|Xorg|pkexec)"
    find /bin /sbin /usr/bin /usr/sbin /usr/local/bin -perm -4000 -type f 2>/dev/null | while read -r f; do
        local fname
        fname=$(basename "$f")
        echo "$fname" | grep -qiE "$suid_whitelist" && continue
        if [ -s "$pkg_file" ]; then
            grep -qxF "$f" "$pkg_file" || warn "Unpackaged SUID binary: $f"
        else
            warn "Unpackaged SUID binary (no pkg index): $f"
        fi
    done
}

check_pam_backdoors() {
    msg "Checking PAM configuration for backdoors..."

# Check for pam_exec.so with expose_authtok — credential harvester
    local pam_files=()
    shopt -s nullglob
    pam_files=(/etc/pam.d/*)
    shopt -u nullglob

for pf in "${pam_files[@]}"; do
        [ -f "$pf" ] || continue
        # expose_authtok passes plaintext password to external script — always suspicious
        if grep -qE "pam_exec\.so.*expose_authtok" "$pf" 2>/dev/null; then
            local exec_line
            exec_line=$(grep -E "pam_exec\.so.*expose_authtok" "$pf")
            warn "PAM BACKDOOR: credential harvester in $pf"
            warn "  Line: $exec_line"
            # Extract the script path (last argument on the line) and check it
            local script_path
            script_path=$(echo "$exec_line" | awk '{print $NF}')
            if [ -n "$script_path" ] && [ -f "$script_path" ]; then
                warn "  Harvester script exists: $script_path"
                warn "  Modified: $(stat -c '%y' "$script_path" 2>/dev/null)"
                # Only show contents if it's a text file, not a binary
                if file "$script_path" 2>/dev/null | grep -q "text"; then
                    warn "  Contents: $(head -5 "$script_path" 2>/dev/null)"
                else
                    warn "  File type: $(file "$script_path" 2>/dev/null | cut -d: -f2-)"
                fi
            fi
        fi
        # Also flag any pam_exec.so calling a script outside of known safe paths
        if grep -qE "pam_exec\.so" "$pf" 2>/dev/null; then
            grep -E "pam_exec\.so" "$pf" | grep -v "expose_authtok" | while read -r pamline; do
                local script
                script=$(echo "$pamline" | awk '{print $NF}')
                # Flag scripts in suspicious locations
                if echo "$script" | grep -qE "^(/tmp|/var/tmp|/dev/shm|/usr/local/bin|/usr/local/sbin)"; then
                    warn "PAM suspicious pam_exec script in $pf: $script"
                    if [ -f "$script" ]; then
                        if file "$script" 2>/dev/null | grep -q "text"; then
                            warn "  Contents: $(head -3 "$script" 2>/dev/null)"
                        else
                            warn "  File type: $(file "$script" 2>/dev/null | cut -d: -f2-)"
                        fi
                    fi
                fi
            done
        fi
        local first_line
        first_line=$(head -1 "$pf" 2>/dev/null)
        if [ -n "$first_line" ] && ! echo "$first_line" | grep -qE "^(#|$)"; then
            warn "PAM suspicious: non-comment entry before header in $pf"
            warn "  Line: $first_line"
        fi
    done

# Check for unowned PAM modules — use global package index file
    # Standard pam_* modules from the pam package are whitelisted by name
    local pam_std_whitelist="(pam_access|pam_cap|pam_chroot|pam_console|pam_cracklib|pam_debug|pam_deny|pam_echo|pam_env|pam_exec|pam_faildelay|pam_faillock|pam_filter|pam_ftp|pam_group|pam_issue|pam_keyinit|pam_lastlog|pam_limits|pam_listfile|pam_localuser|pam_loginuid|pam_mail|pam_mkhomedir|pam_motd|pam_namespace|pam_nologin|pam_permit|pam_postgresok|pam_pwhistory|pam_pwquality|pam_rhosts|pam_rootok|pam_securetty|pam_selinux|pam_selinux_permit|pam_sepermit|pam_shells|pam_stress|pam_succeed_if|pam_systemd|pam_tally2|pam_time|pam_timestamp|pam_tty_audit|pam_umask|pam_unix|pam_unix_acct|pam_unix_auth|pam_unix_passwd|pam_unix_session|pam_userdb|pam_warn|pam_wheel|pam_xauth|pam_cpses|pam_lve|pam_sulve|pam_imunify|pam_hulk|pam_shield|pam_abl|pam_sss|pam_sss_gss|pam_usertype|pam_setquota|pam_user_map|pam_fprintd|pam_canonicalize_user|pam_ssh_add|pam_cockpit_cert)"
    local pkg_file="${mytmp}/all_packaged_files.txt"
    for d in /lib64/security /lib/security /usr/lib64/security /usr/lib/security; do
        [ -d "$d" ] || continue
        while read -r mod; do
            local modname
            modname=$(basename "$mod" .so)
            # Skip all standard/known legitimate PAM modules
            echo "$modname" | grep -qiE "$pam_std_whitelist" && continue
            # For anything not in the standard list, check the package index
            if [ -s "$pkg_file" ]; then
                grep -qxF "$mod" "$pkg_file" || warn "Unowned PAM module: $mod"
            fi
        done < <(find "$d" -name "*.so" 2>/dev/null)
    done

# Check for the specific credential log path used by this exploit
    for ilog in /var/lib/systemd/.ilog /tmp/.ilog /var/tmp/.ilog /dev/shm/.ilog; do
        if [ -f "$ilog" ]; then
            local lines
            lines=$(wc -l < "$ilog" 2>/dev/null)
            warn "Credential harvest log found: $ilog ($lines entries)"
            warn "  Last entry: $(tail -1 "$ilog" 2>/dev/null)"
        fi
    done

# Check for the malicious logger script at common drop paths
    for lpath in /usr/local/bin/logger /usr/bin/logger.bak /tmp/logger /var/tmp/logger; do
        if [ -f "$lpath" ]; then
            # /usr/bin/logger is a legitimate system binary — only flag non-standard paths
            # or if it's not owned by a package
            if [ "$lpath" = "/usr/local/bin/logger" ] || [ "$lpath" = "/tmp/logger" ] || [ "$lpath" = "/var/tmp/logger" ]; then
                warn "Suspicious logger script: $lpath"
                warn "  Modified: $(stat -c '%y' "$lpath" 2>/dev/null)"
                if file "$lpath" 2>/dev/null | grep -q "text"; then
                    warn "  Contents: $(head -3 "$lpath" 2>/dev/null)"
                else
                    warn "  File type: $(file "$lpath" 2>/dev/null | cut -d: -f2-)"
                fi
            fi
        fi
    done
}

check_recently_modified_bins() {
    msg "Checking for recently modified system binaries (7 days)..."
    local pkg_file="${mytmp}/all_packaged_files.txt"
    find /bin /sbin /usr/bin /usr/sbin -type f -mtime -7 2>/dev/null | while read -r f; do
        if [ -s "$pkg_file" ]; then
            grep -qxF "$f" "$pkg_file" && continue
        fi
        warn "Recently modified unpackaged binary: $f"
    done
}

check_miner_procs() {
    msg "Checking for crypto miner process signatures..."
    local miner_regex="(stratum\+tcp|stratum\+ssl|xmrig|minerd|cryptonight|--donate-level|nicehash|ethermine|pool\.minexmr|hashvault|c3pool|xmr\.pool)"
    for cmd in /proc/*/cmdline; do
        [ -e "$cmd" ] || continue
        local cmdline
        cmdline=$(tr '\0' ' ' < "$cmd" 2>/dev/null)
        if echo "$cmdline" | grep -qiE "$miner_regex"; then
            local pid
            pid=$(echo "$cmd" | cut -d/ -f3)
            warn "Miner signature in PID $pid: $(printf '%s' "$cmdline")"
        fi
    done
}

check_cron_jobs() {
    msg "Auditing cron jobs for suspicious payloads..."
    # Exclude legitimate cPanel/system tools that appear in cron legitimately
    local cron_payload_regex="(wget|curl|bash -c|python -c|perl -e|(^|[[:space:]])nc |ncat|base64|/tmp/[^[:space:]]+\.(sh|py|pl|exe)|/dev/shm/|/var/tmp/[^[:space:]]+\.(sh|py|pl|exe)|\.systemd_helper|grep00\.sh|linux_amd64|system_profiled_service|gajiku-media|s3\.amazonaws\.com.*grep|(^|[[:space:]])/\.[a-zA-Z][^/[:space:]]{0,8}([[:space:]]|$)|[^/[:space:]]\.(x86_64|aarch64|arm64|armv[0-9]|mips)([ &]|$))"
    # Known legitimate cron files — skip by filename
    local cron_file_whitelist="(imunify|comet_license|cpanel|cphulk|clam|csf|lfd|logrotate|sysstat|aide|certbot|fail2ban|xray|set-qc|csget)"
    local cron_dirs=("/etc/cron.d" "/etc/cron.daily" "/etc/cron.hourly" "/etc/cron.weekly" "/etc/cron.monthly")

# System cron directories — skip comment/blank lines before matching
    for d in "${cron_dirs[@]}"; do
        [ -d "$d" ] || continue
        find "$d" -maxdepth 1 -type f 2>/dev/null | while read -r cf; do
            local cf_name
            cf_name=$(basename "$cf")
            echo "$cf_name" | grep -qiE "$cron_file_whitelist" && continue
            grep -vE '^\s*#|^\s*$' "$cf" 2>/dev/null | grep -qE "$cron_payload_regex" && warn "Suspicious cron payload in $cf"
        done
    done

# /etc/crontab — skip comment/blank lines
    if [ -f /etc/crontab ]; then
        grep -vE '^\s*#|^\s*$' /etc/crontab 2>/dev/null | grep -qE "$cron_payload_regex" && warn "Suspicious cron payload in /etc/crontab"
    fi

# User crontabs in /var/spool/cron — scan all, flag base64 and hidden paths
    if [ -d /var/spool/cron ]; then
        find /var/spool/cron -maxdepth 2 -type f 2>/dev/null | while read -r cf; do
            local user
            user=$(basename "$cf")
            local match
            match=$(grep -vE '^\s*#|^\s*$' "$cf" 2>/dev/null | grep -Em1 "$cron_payload_regex")
            if [ -n "$match" ]; then
                warn "Suspicious cron payload in /var/spool/cron/$user"
                warn "  Matched: $(echo "$match" | head -c 120 | tr -d '\n')"
            fi
        done
    fi
}

check_world_writable() {
    msg "Checking for world-writable files in sensitive directories..."
    for d in /etc /usr/bin /usr/sbin /bin /sbin; do
        [ -d "$d" ] || continue
        find "$d" -maxdepth 2 -type f -perm -o+w 2>/dev/null | while read -r f; do
            warn "World-writable file: $f"
        done
    done
}

check_tmp_executables() {
    msg "Checking for executable files in /tmp, /var/tmp, /dev/shm..."
    local tmp_exec_whitelist="(\.imrt2)"
    for d in /tmp /var/tmp /dev/shm; do
        [ -d "$d" ] || continue
        find "$d" -maxdepth 3 -type f -perm -u+x 2>/dev/null | grep -vE "$tmp_exec_whitelist" | while read -r f; do
            warn "Executable in temp dir: $f"
        done
    done
}

check_passwd_perms() {
    msg "Checking /etc/passwd and /etc/shadow permissions..."

# /etc/passwd should be 644 root:root
    if [ -f /etc/passwd ]; then
        local p_perms p_owner
        p_perms=$(stat -c '%a' /etc/passwd 2>/dev/null)
        p_owner=$(stat -c '%U' /etc/passwd 2>/dev/null)
        if [ "$p_owner" != "root" ] || [ "$p_perms" != "644" ]; then
            warn "/etc/passwd permissions unexpected: owner=$p_owner perms=$p_perms (expected root:644)"
        else
            ok "/etc/passwd: owner=$p_owner perms=$p_perms"
        fi
    fi

# /etc/shadow should be 000 or 640 root:shadow
    if [ -f /etc/shadow ]; then
        local s_perms s_owner
        s_perms=$(stat -c '%a' /etc/shadow 2>/dev/null)
        s_owner=$(stat -c '%U' /etc/shadow 2>/dev/null)
        if [ "$s_owner" != "root" ] || [[ ! "$s_perms" =~ ^(0|000|640|600)$ ]]; then
            warn "/etc/shadow permissions unexpected: owner=$s_owner perms=$s_perms (expected root:0/000/640/600)"
        else
            ok "/etc/shadow: owner=$s_owner perms=$s_perms"
        fi
    fi
}

check_uid0_accounts() {
    msg "Checking for suspicious accounts..."
    local found=0

while IFS=: read -r uname _ uid _ _ homedir shell; do
        # UID 0 accounts that aren't root
        if [ "$uid" = "0" ] && [ "$uname" != "root" ]; then
            warn "Non-root account with UID 0: $uname"
            found=1
        fi

# root variants — root1, root2, r00t, toor etc
        if echo "$uname" | grep -qiE "^root[0-9]|^r00t|^toor$|^rooot"; then
            warn "Suspicious root-variant account: $uname (UID=$uid)"
            found=1
        fi

# Known backdoor/RAT account names
        if echo "$uname" | grep -qiE "^(sptadm|sftp-internal|git-internal|support0|supp0rt|adm1n|sys0|sys1|operator0|deploy0|devops0|update0|sysadmin1|pakchoi|tscejvjd|wbsnlilm|vjxgcqna|backdoor420|admd784a3|res[0-9a-f]{7,})$"; then
            warn "Known malicious account name: $uname (UID=$uid home=$homedir)"
            found=1
        fi

# Accounts with UID >= 1000 but with home in suspicious locations
        # Skip known legitimate system accounts with high UIDs (nfsnobody=65534 etc)
        local system_highuid="^(nfsnobody|nobody|overflow|libvirt-qemu|libvirt-dnsmasq|qemu)$"
        if [ "$uid" -ge 1000 ] 2>/dev/null; then
            if ! echo "$uname" | grep -qiE "$system_highuid"; then
                if echo "$homedir" | grep -qE "^(/root|/var/lib|/var/run|/tmp|/dev/shm)"; then
                    warn "User $uname (UID=$uid) has suspicious home: $homedir"
                    found=1
                fi
            fi
        fi

done < /etc/passwd

[ "$found" -eq 0 ] && ok "No suspicious accounts found"
}

check_immutable_malware() {
    msg "Checking for immutable flags on common malware paths..."
    if command -v lsattr >/dev/null; then
        for f in /etc/passwd /etc/shadow /etc/crontab /root/.ssh/authorized_keys; do
            [ -f "$f" ] || continue
            lsattr "$f" 2>/dev/null | grep -qE '\-(i|a)' && warn "Immutable/append-only flag set on $f — may prevent cleanup"
        done
        # Check if malware drop dirs are immutable (prevents cleanup)
        for d in /tmp /var/tmp /dev/shm; do
            [ -d "$d" ] || continue
            # lsattr on a directory checks the dir inode itself
            # Verify by attempting a test rather than trusting lsattr output format
            local lsattr_out
            lsattr_out=$(lsattr -d "$d" 2>/dev/null | awk '{print $1}')
            if echo "$lsattr_out" | grep -q 'i'; then
                # Double-check: if we can create a file, it's not really immutable
                if ! touch "$d/.immutable_test_$$" 2>/dev/null; then
                    warn "Immutable flag set on directory $d — cannot create files"
                else
                    rm -f "$d/.immutable_test_$$" 2>/dev/null
                fi
            fi
        done
    fi
}

check_mount_hardening() {
    msg "Checking for missing 'noexec' flags on temp partitions..."
    for m in /tmp /var/tmp /dev/shm; do
        local mount_entry
        mount_entry=$(mount | grep " on $m ")
        if [ -z "$mount_entry" ]; then
            # Not a separate mount — inherits parent, flag as worth noting
            warn "Mount hardening: $m is not a separate partition — 'noexec' cannot be enforced independently"
        elif echo "$mount_entry" | grep -q "noexec"; then
            ok "Mount hardening: $m has 'noexec'"
        else
            warn "Mount hardening: $m is mounted WITHOUT 'noexec' — high risk for dropper execution (fix: mount -o remount,noexec $m)"
        fi
    done
}

check_systemd_units() {
    msg "Checking systemd service and timer units for suspicious content..."
    local suspicious='(curl|wget|bash -c|/tmp|/dev/shm|/var/tmp|base64|nc |ncat|python -c|perl -e|xmrig|kinsing|kdevtmpfsi|raw\.githubusercontent|pastebin\.com/raw|pool\.[a-z]+\.[a-z]+:[0-9]+|supportxmr|xmrpool|moneroocean|\.onion|chmod \+x|mount --bind /proc)'

# Use global package file index built at startup
    local pkg_file="${mytmp}/all_packaged_files.txt"
    local owned_files=""
    if [ -s "$pkg_file" ]; then
        owned_files="$pkg_file"  # path to file, not contents
    fi

shopt -s nullglob
    local search_dirs=(/etc/systemd/system /usr/lib/systemd/system /lib/systemd/system /root/.config/systemd/user /home/*/.config/systemd/user)
    shopt -u nullglob

for d in "${search_dirs[@]}"; do
        [ -d "$d" ] || continue
        while read -r f; do
            # Resolve symlinks (e.g. .wants/ .requires/ contain symlinks to real units)
            local real_f="$f"
            if [ -L "$f" ]; then
                real_f=$(readlink -f "$f" 2>/dev/null)
                [ -z "$real_f" ] || [ ! -f "$real_f" ] && continue
            fi

local unit_name
            unit_name=$(basename "$f")

# Content check — skip whitelisted unit names
            if ! echo "$unit_name" | grep -qiE "$content_whitelist"; then
                local match
                match=$(grep -iEm1 "$suspicious" "$real_f" 2>/dev/null)
                if [ -n "$match" ]; then
                    warn "Suspicious systemd unit content: $f"
                    warn "  Matched: $(echo "$match" | head -c 120 | tr -d '\n')"
                fi
            fi

# Unpackaged check — only for system dirs
            if [[ "$d" == /etc/systemd/system* ]] || [[ "$d" == /usr/lib/systemd/system* ]] || [[ "$d" == /lib/systemd/system* ]]; then
                # Skip if in unit name whitelist first
                if echo "$unit_name" | grep -qiE "$unit_whitelist"; then
                    continue
                fi
                local is_packaged=0
                # Resolve canonical path — on EL9 /lib/systemd is a symlink to /usr/lib/systemd
                # so rpm -ql returns /usr/lib/... but find returns /lib/... — need both
                local canonical_f
                canonical_f=$(readlink -f "$f" 2>/dev/null)
                if [ -n "$owned_files" ]; then
                    grep -qxF "$f" "$owned_files" 2>/dev/null && is_packaged=1
                    [ "$is_packaged" -eq 0 ] && [ -n "$canonical_f" ] && grep -qxF "$canonical_f" "$owned_files" 2>/dev/null && is_packaged=1
                    [ "$is_packaged" -eq 0 ] && grep -qxF "$real_f" "$owned_files" 2>/dev/null && is_packaged=1
                fi
                [ "$is_packaged" -eq 0 ] && warn "Unpackaged systemd unit: $f"
            fi
        done < <(find "$d" $ -type f -o -type l $ $ -name "*.service" -o -name "*.timer" $ 2>/dev/null)
    done
}

check_promisc() {
    msg "Checking for promiscuous network interfaces..."
    ip link 2>/dev/null | grep -i promisc | while read -r line; do
        warn "Promiscuous interface: $line"
    done
}

check_sshd() {
    msg "Checking sshd configuration and authorized_keys..."
    local sshd_config="/etc/ssh/sshd_config"

if [ -f "$sshd_config" ]; then
        # PermitRootLogin check — flag if set to yes (commented-out default is also 'yes' on old systems)
        local permit_root
        permit_root=$(grep -iE '^\s*PermitRootLogin\s+' "$sshd_config" | awk '{print tolower($2)}' | tail -1)

if [ -z "$permit_root" ]; then
            # Unset — default depends on OpenSSH version, flag it as worth reviewing
            warn "sshd: PermitRootLogin not explicitly set — default may allow root login; recommend setting to 'no', 'prohibit-password', or 'without-password'"
        elif [ "$permit_root" = "yes" ]; then
            warn "sshd: PermitRootLogin is set to 'yes' — recommend 'no', 'prohibit-password', or 'without-password'"
        else
            ok "sshd: PermitRootLogin=$permit_root"
        fi

# PasswordAuthentication check
        local passwd_auth
        passwd_auth=$(grep -iE '^\s*PasswordAuthentication\s+' "$sshd_config" | awk '{print tolower($2)}' | tail -1)
        if [ "$passwd_auth" = "yes" ] || [ -z "$passwd_auth" ]; then
            warn "sshd: PasswordAuthentication is '${passwd_auth:-unset/default yes}' — recommend 'no' if using keys only"
        else
            ok "sshd: PasswordAuthentication=$passwd_auth"
        fi

# Port check — still on 22?
        local ssh_port
        ssh_port=$(grep -iE '^\s*Port\s+' "$sshd_config" | awk '{print $2}' | tail -1 | tr -cd '0-9')
        [ -z "$ssh_port" ] && ssh_port="22"
        [ "$ssh_port" = "22" ] && warn "sshd: Running on default port 22 — consider changing to reduce automated scanning noise"
        [ "$ssh_port" = "0" ] && warn "sshd: Port set to 0 — OS will assign a random port, this is unusual and may indicate tampering"

else
        warn "sshd_config not found at $sshd_config"
    fi

# Count active (non-comment, non-empty) keys in /root/.ssh/authorized_keys*
    local total_keys=0
    local key_files=()
    shopt -s nullglob
    key_files=(/root/.ssh/authorized_keys*)
    shopt -u nullglob

if [ "${#key_files[@]}" -eq 0 ]; then
        ok "sshd: No authorized_keys files found for root"
    else
        for kf in "${key_files[@]}"; do
            local count
            count=$(grep -cE '^(ssh-|ecdsa-|sk-|no-)' "$kf" 2>/dev/null)
            count=$(echo "$count" | tr -cd '0-9')
            [ -z "$count" ] && count=0
            total_keys=$(( total_keys + count ))
            msg "sshd: $kf — $count key(s)"
        done
        [ "$total_keys" -gt 5 ] && warn "sshd: $total_keys total root authorized_keys entries — review for unexpected keys"
        [ "$total_keys" -le 5 ] && ok "sshd: $total_keys total root authorized_keys entries"
    fi

# Check all authorized_keys files system-wide for known malicious keys
    # Identified by unique partial key string
    local bad_keys=(
        "AAAAB3NzaC1yc2EAAAADAQABAAABAQDRUxNAeMqZberO97ZpY9gr"
        "AAAAC3NzaC1lZDI1NTE5AAAAICYYWzoiyZ5XTR7FBBnwEN0QR2ep"
        "kGyvOyNjUPt98GfooyEA"
    )
    find /root/.ssh /home/*/.ssh /etc/ssh 2>/dev/null -name "authorized_keys*" -type f | while read -r akf; do
        for badkey in "${bad_keys[@]}"; do
            grep -qF "$badkey" "$akf" 2>/dev/null && warn "KNOWN MALICIOUS SSH KEY in $akf (matched: ${badkey:0:30}...)"
        done
    done
}

# --- 4. Main Execution ---

echo "===================================================="
echo "   SYSTEM SECURITY SCANNER - MASTER V106             "
echo "===================================================="

fetch_remote_data
# Build global packaged file list ONCE to temp file
msg "Building package file index..."
if command -v rpm >/dev/null && [ "$(rpm -qa 2>/dev/null | wc -l)" -gt 0 ]; then
    rpm -ql --all 2>/dev/null | grep -v '^(contains no files)' | sort -u > "${mytmp}/all_packaged_files.txt"
fi
if [ ! -s "${mytmp}/all_packaged_files.txt" ] && [ -d /var/lib/dpkg/info ] && ls /var/lib/dpkg/info/*.list &>/dev/null; then
    grep -rhE '^/' /var/lib/dpkg/info/*.list 2>/dev/null | sort -u > "${mytmp}/all_packaged_files.txt"
fi
if [ -s "${mytmp}/all_packaged_files.txt" ]; then
    local_count=$(wc -l < "${mytmp}/all_packaged_files.txt")
    ok "Package index built: $local_count files indexed"
else
    warn "Package index empty — unpackaged checks will be skipped"
fi
scan_files
check_downloaded_signatures
scan_processes
check_integrity_fast
check_persistence_shims
check_systemd_units
check_network_anomalies
check_cpanel_logic
check_pam_backdoors
check_ld_preload
check_deleted_exes
check_proc_count_mismatch
check_proc_bind_mounts
check_proc_spoofing
check_unpackaged_suid
check_recently_modified_bins
check_miner_procs
check_promisc
check_sshd
check_cron_jobs
check_world_writable
check_tmp_executables
check_passwd_perms
check_uid0_accounts
check_immutable_malware
check_mount_hardening

check_recent_logins() {
    printf '\n--- Recent SSH Logins (last 10, no reboots) ---\n'
    last -i | grep -vE "(system boot|reboot)" | head -n 10

if [ -d /usr/local/cpanel ]; then
        printf '\n--- WHM Root Logins (last 7 days, successful, excluding known IPs) ---\n'
        if [ -f /usr/local/cpanel/logs/access_log ]; then
            local current_year
            current_year=$(date "+%Y")
            printf "Scanning access_log for year %s...\n" "$current_year"

# Match csi.pl logic exactly:
            # field $1=ip $3=user $4=date $7=path(post_login) $9=status
            # awk fields are 1-indexed: $1 $3 $4 $7 $9
            local login_data
            login_data=$(awk -v year="$current_year" -v user="root" '
                $3 == user &&
                $9 == "200" &&
                $7 ~ /post_login/ &&
                $4 ~ year {
                    print $1
                }
            ' /usr/local/cpanel/logs/access_log \
            | grep -Ev "(208\.74\.123\.|184\.94\.197\.|66\.45\.228\.251|106\.51\.49\.165|66\.45\.233\.83|66\.45\.235\.105|88\.198\.109\.76|66\.45\.235\.226|66\.45\.235\.94|173\.225\.104\.170)" \
            | sort | uniq -c | sort -rn)

if [ -z "$login_data" ]; then
                printf 'No successful root WHM logins found for %s\n' "$current_year"
            else
                local total
                total=$(echo "$login_data" | wc -l)
                printf "Unique IPs that logged in as root via WHM (%s total):\n\n" "$total"
                # Format: count IP — show top 20 by frequency
                echo "$login_data" | head -n 20 | while read -r count ip; do
                    printf "  %-5s logins  %s\n" "$count" "$ip"
                done
                [ "$total" -gt 20 ] && printf '...and %s more IPs. Review: /usr/local/cpanel/logs/access_log\n' "$(( total - 20 ))"
            fi
        else
            printf 'cPanel access log not found at /usr/local/cpanel/logs/access_log\n'
        fi
    fi

# DirectAdmin
    if [ -f /usr/local/directadmin/data/admin/admin.list ]; then
        printf '\n--- DirectAdmin Detected: Current Admin Users ---\n'
        cat /usr/local/directadmin/data/admin/admin.list
    fi
}

if [ ! -f /etc/master.passwd ]; then
    check_recent_logins
fi

[ -n "$mytmp" ] && [ "$mytmp" != "/" ] && [[ "$mytmp" == /root/tmp_scan.* ]] && rm -rf "${mytmp}"
ok "Scan complete."

cancel