#!/bin/bash

# Candle Blower - Bday Cake Malware Removal Script
# Usage: ./candle_blower.sh <user> <host> <password>
# Example: ./candle_blower.sh icanhasaccess ns0 "never 0p the wicked!"

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

log() {
    echo -e "${GREEN}[$(date '+%H:%M:%S')] $1${NC}"
}

error() {
    echo -e "${RED}[ERROR] $1${NC}"
    exit 1
}

warn() {
    echo -e "${YELLOW}[WARNING] $1${NC}"
}

info() {
    echo -e "${BLUE}[INFO] $1${NC}"
}

# Check arguments
if [ $# -ne 3 ]; then
    error "Usage: $0 <user> <host> <password>"
fi

SSH_USER="$1"
SSH_HOST="$2"
SSH_PASS="$3"

# Check if expect is available
if ! command -v expect >/dev/null 2>&1; then
    error "expect is required but not installed. Install with: sudo apt install expect"
fi

log "🕯️  Starting Candle Blower - Bday Cake Malware Removal"
info "Target: ${SSH_USER}@${SSH_HOST}"

# Create cleanup script locally
CLEANUP_SCRIPT="/tmp/bday_cleanup_$$.sh"
cat > "$CLEANUP_SCRIPT" << 'EOF'
#!/bin/bash
set -e

echo "[CLEANUP] Killing malicious processes..."
pkill -f "python.*bash-completion" 2>/dev/null || true
pkill -f "bday" 2>/dev/null || true
pkill -f ".python" 2>/dev/null || true

echo "[CLEANUP] Removing malicious binaries..."
sudo rm -f /bin/bday 2>/dev/null || true
sudo rm -f /bin/bash-completion-handler 2>/dev/null || true
sudo rm -f /usr/share/bash-completion/helpers/.python 2>/dev/null || true
sudo rm -f /usr/share/bash-completion/helpers/python 2>/dev/null || true

echo "[CLEANUP] Cleaning user bashrc files..."
find /home -name ".bashrc" -type f 2>/dev/null | while read -r bashrc; do
    if grep -q "preexec\|bash-completion-handler\|extdebug\|bday" "$bashrc" 2>/dev/null; then
        echo "Cleaning: $bashrc"
        sudo sed -i '/preexec\|bash-completion-handler\|extdebug\|bday/d' "$bashrc"
    fi
done

# Also clean root's bashrc
if [ -f /root/.bashrc ]; then
    if grep -q "preexec\|bash-completion-handler\|extdebug\|bday" /root/.bashrc 2>/dev/null; then
        echo "Cleaning: /root/.bashrc"
        sudo sed -i '/preexec\|bash-completion-handler\|extdebug\|bday/d' /root/.bashrc
    fi
fi

echo "[CLEANUP] Removing malicious startup entries..."
find /etc -name "rc*" -type f 2>/dev/null | xargs grep -l "bday\|bash-completion-handler" 2>/dev/null | while read -r rcfile; do
    echo "Cleaning startup file: $rcfile"
    sudo sed -i '/bday\|bash-completion-handler/d' "$rcfile"
done

# Clean crontabs
echo "[CLEANUP] Checking crontabs..."
crontab -l 2>/dev/null | grep -v "bday\|bash-completion-handler" | crontab - 2>/dev/null || true

echo "[CLEANUP] 🎂 Birthday cake malware blown out! 🕯️"
echo "[CLEANUP] System should be clean. Testing normal commands..."
whoami
date
echo "[CLEANUP] ✅ Commands working normally!"
EOF

chmod +x "$CLEANUP_SCRIPT"

# Upload and execute cleanup via SSH
log "Connecting to ${SSH_HOST} and blowing out the candles..."

# Upload the script via SCP first
expect -c "
set timeout 30
spawn scp \"$CLEANUP_SCRIPT\" ${SSH_USER}@${SSH_HOST}:/tmp/cleanup_malware.sh
expect {
    \"password:\" {
        send \"${SSH_PASS}\r\"
        expect eof
    }
    eof {}
    timeout {
        puts \"SCP timeout\"
        exit 1
    }
}
"

# Now execute it via SSH
expect -c "
set timeout 60
spawn ssh ${SSH_USER}@${SSH_HOST}
expect {
    \"password:\" {
        send \"${SSH_PASS}\r\"
        expect \"$ \"
    }
    \"$\" {}
    timeout {
        puts \"Connection timeout\"
        exit 1
    }
}

# Execute cleanup script
send \"chmod +x /tmp/cleanup_malware.sh\r\"
expect \"$ \"
send \"/tmp/cleanup_malware.sh\r\"
expect {
    \"password\" {
        send \"${SSH_PASS}\r\"
        exp_continue
    }
    \"Commands working normally!\" {
        expect \"$ \"
    }
    timeout {
        puts \"Script execution timeout\"
    }
}

# Clean up
send \"rm -f /tmp/cleanup_malware.sh\r\"
expect \"$ \"
send \"exit\r\"
expect eof
"

# Clean up local temp file
rm -f "$CLEANUP_SCRIPT"

if [ $? -eq 0 ]; then
    log "🎉 Candles successfully blown out!"
    log "✅ Bday cake malware has been eliminated from ${SSH_HOST}"
    log "✅ System should now respond to commands normally"
    info "You can now run your IR lockdown scripts normally"
else
    error "❌ Failed to blow out the candles. Check the output above for errors."
fi