From 181cb5af6a0eaf204aac4321a8f622189cc2cb8d Mon Sep 17 00:00:00 2001
From: Myfro9 <36755290+Myfro9@users.noreply.github.com>
Date: Thu, 1 Oct 2026 07:37:42 +0800
Subject: [PATCH] =?UTF-8?q?tools-sync:=20triage=20=E6=8C=89=E5=BD=A2?=
 =?UTF-8?q?=E7=8A=B6=E6=89=BE=E8=90=BD=E5=9C=B0=E6=96=87=E4=BB=B6=EF=BC=88?=
 =?UTF-8?q?=E5=90=8D=E5=AD=97=E6=AF=8F=E8=BD=AE=E9=83=BD=E6=8D=A2=EF=BC=8C?=
 =?UTF-8?q?2026-10-01=20.pwn/.k*/RootHawk=20=E5=85=A8=E9=83=A8=E6=BC=8F?=
 =?UTF-8?q?=E6=8A=A5=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6dZ7Qcr3bdy7LuEbRPzNX
---
 tools-sync/scripts/gitea_triage.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tools-sync/scripts/gitea_triage.sh b/tools-sync/scripts/gitea_triage.sh
index 7f2f639..a24bc22 100644
--- a/tools-sync/scripts/gitea_triage.sh
+++ b/tools-sync/scripts/gitea_triage.sh
@@ -145,7 +145,18 @@ if [ -n "$PAYLOAD" ]; then
     echo "$PAYLOAD" | sed 's/^/    /'
     [ "$FIX" = 1 ] && { dex "rm -f /tmp/giteahook* /tmp/col_*" >/dev/null 2>&1; fixed payload "removed"; }
 else
-    note payload "none"
+    note payload "none (known names)"
+fi
+# The names change every round (2026-10-01: /data/gitea/home/.pwn + /tmp/.k<pid> binaries,
+# RootHawk-* in /tmp) and the name list above said "none" through all of it. So also look
+# by shape, name-independent. Report only: these are evidence of a compromise, and what to
+# do with a compromised container (rebuild, rotate credentials) is the user's decision.
+DROPS=$(dex "find /tmp -maxdepth 1 -type f -perm -u+x 2>/dev/null | head -20; \
+             ls -A /data/gitea/home 2>/dev/null | grep -Ev '^(\.cache|\.local|\.ssh|\.gitconfig(\..*)?)$' | sed 's|^|/data/gitea/home/|'" \
+        | tr -d '\r' | sed '/^$/d' | grep -v '\.quarantine\.')
+if [ -n "$DROPS" ]; then
+    bad payload "unexpected files (executables in /tmp, strays in gitea HOME) - treat the container as compromised:"
+    echo "$DROPS" | sed 's/^/    /'
 fi
 
 # ---------- F. git binary not shimmed ----------