#!/bin/bash
# READ-ONLY timeline recon for FOREIGN ACTOR on host B
# Goal: date the compromise. NO writes, NO modification.
echo "===== [T1] /tmp artifacts (the actor's playground) ====="
ls -la /tmp/ 2>/dev/null | head -40
echo "--- /tmp full recursive (depth 2, actor files) ---"
ls -laR /tmp/dirtyfrag /tmp/exp /tmp/*.sh /tmp/min* 2>/dev/null | head -40
echo "--- stat on key actor files (mtime=modify, ctime=change/birth) ---"
for f in /tmp/exp /tmp/min-yus.sh /tmp/dirtyfrag/exp /tmp/dirtyfrag/exp.c; do
  if [ -e "$f" ]; then
    echo "### $f"
    stat "$f" 2>/dev/null
  fi
done

echo ""
echo "===== [T2] /tmp hidden + recent files (last 90 days) ====="
find /tmp /var/tmp /dev/shm -type f -mtime -90 2>/dev/null | head -30
echo "--- stat each ---"
find /tmp /var/tmp /dev/shm -type f -mtime -90 2>/dev/null | head -15 | while read f; do
  echo "### $f"
  stat -c "%n | mtime:%y | ctime:%z | atime:%x" "$f" 2>/dev/null
done

echo ""
echo "===== [T3] bash_history mtime (last modification = last command run) ====="
stat -c "%n | mtime:%y | ctime:%z" /home/npontucontrl/.bash_history 2>/dev/null
echo "--- other users' bash_history mtime ---"
for u in mylar nosa kelvin kobeng jones john daniel david deployer prince; do
  stat -c "%n | mtime:%y" "/home/$u/.bash_history" 2>/dev/null
done

echo ""
echo "===== [T4] auth logs (SSH logins, su, sudo) ====="
echo "--- /var/log/secure (CentOS auth log) ---"
ls -la /var/log/secure* 2>/dev/null
echo "--- last 50 lines of secure (readable?) ---"
tail -50 /var/log/secure 2>/dev/null
echo "--- journalctl sshd (last 30) ---"
journalctl -u sshd --no-pager -n 30 2>/dev/null
echo "--- wtmp (last logins) ---"
last -30 2>/dev/null
echo "--- lastlog (all users last login) ---"
lastlog 2>/dev/null | head -30

echo ""
echo "===== [T5] running suspicious processes + etime ====="
ps -eo pid,user,etime,cmd 2>/dev/null | grep -iE "minerd|xmrig|kworker|kinsing|kdevtmpfsi|dirtyfrag|/tmp/exp|monero|c3pool|nanopool" | grep -v grep | head -20
echo "--- ALL non-system processes (etimes) ---"
ps -eo pid,user,etime,cmd --sort=-etime 2>/dev/null | grep -vE "^\s*PID|systemd|sshd|postgres|nginx|php-fpm|redis|node|/usr/sbin|/usr/bin/[a-z]+$|kthread|kworker|ksoftirqd" | head -30

echo ""
echo "===== [T6] network connections (C2 / mining pool) ====="
ss -tnp 2>/dev/null | grep -vE "127.0.0.1|::1|postgres|:5432|:22 |:2304" | head -30
echo "--- /proc/net raw if ss hides ---"
ss -tn state established 2>/dev/null | head -30

echo ""
echo "===== [T7] cron / systemd persistence (actor-installed) ====="
echo "--- all user crontabs ---"
for u in npontucontrl mylar nosa kelvin root; do
  echo "### $u"
  crontab -u "$u" -l 2>/dev/null
done
echo "--- systemd timers (non-standard) ---"
systemctl list-timers --all --no-pager 2>/dev/null | grep -vE "logrotate|man-db|mlocate|raid-check|dnf|fstrim|systemd-tmpfiles|unbound" | head -15
echo "--- systemd services modified recently ---"
find /etc/systemd/system /usr/lib/systemd/system -type f -mtime -120 2>/dev/null | head -15

echo ""
echo "===== [T8] yum/rpm history (actor-installed packages) ====="
rpm -qa --last 2>/dev/null | head -20
echo "--- yum history ---"
ls -la /var/log/dnf.log /var/log/yum.log 2>/dev/null
tail -30 /var/log/dnf.log 2>/dev/null

echo ""
echo "===== [T9] miner artifacts (known IOCs) ====="
ls -la /tmp/.X11-unix /tmp/.ICE-unix /etc/cron.d/tomcat /var/spool/cron/root 2>/dev/null
echo "--- known miner paths ---"
for p in /root/.systemd-service /opt/.minerd /tmp/kdevtmpfsi /tmp/kinsing /usr/local/bin/kinsing /etc/kinsing; do
  [ -e "$p" ] && stat -c "%n | mtime:%y" "$p" 2>/dev/null
done

echo ""
echo "===== [T10] .bash_history file birth time (first command after user creation) ====="
stat /home/npontucontrl/.bash_history 2>/dev/null

echo ""
echo "===== TIMELINE RECON COMPLETE ====="