www.archline.hu — clean post-compromise baseline #1

imre.agent · 2026-07-16T14:31:18+02:00

imre.agent commented

2026-07-16 14:31:18 +02:00

What this is

The clean, post-compromise code baseline of the www.archline.hu docroot (Joomla 3.8.11) — a malware-free, faithful reproduction of the live server's source files, used as the known-good reference for the HIDS baseline-diff.

The repo stores the baseline constituents plus a generator script; it is not the deployed tree.

Build it

git clone --recurse-submodules <this repo>
cd www_archline_hu && ./build-baseline.sh    # -> out/ = the deployed code baseline

Prerequisites: bash, rsync, git. No PHP, no network. Full guide in README.md.

Structure

core/ — Joomla 3.8.11 official package (deployed form)
packages/ — 5 upstream-obtainable extensions; modified ones show the exact delta vs upstream in git history (pristine -> reconcile commits)
deployed/ — ~55 no-source extensions (vetted live files)
cadline/ — Cadline own-code; common_cadline_libraries + maintenance are submodules of the developer repos (update via git submodule update --remote -> rebuild -> commit)
overrides/ — Cadline core modifications
Malware (see malware-iocs.md) and runtime data are excluded

Verification (against the live RO mirror)

out/ = ~23,544 files. Byte-matches live for all legit code; intentionally clean on the 4 attacker-infected files (3 trojanized core files + shaper_helix3/index.php cloaking) so the HIDS flags them on live. Non-malware code residual = 0.

Note on history

The branch history was rewritten to strip operator-internal references, so it is unrelated to main's initial commit. Merging brings the clean baseline into main; main's very first commit still carries those references in history (fully removing it would require a force-push on main).

🤖 Generated with Claude Code

## What this is The clean, post-compromise **code baseline** of the www.archline.hu docroot (Joomla 3.8.11) — a malware-free, faithful reproduction of the live server's source files, used as the known-good reference for the HIDS baseline-diff. The repo stores the baseline **constituents** plus a generator script; it is not the deployed tree. ## Build it git clone --recurse-submodules <this repo> cd www_archline_hu && ./build-baseline.sh # -> out/ = the deployed code baseline Prerequisites: bash, rsync, git. No PHP, no network. Full guide in README.md. ## Structure - `core/` — Joomla 3.8.11 official package (deployed form) - `packages/` — 5 upstream-obtainable extensions; modified ones show the exact delta vs upstream in git history (pristine -> reconcile commits) - `deployed/` — ~55 no-source extensions (vetted live files) - `cadline/` — Cadline own-code; `common_cadline_libraries` + `maintenance` are **submodules** of the developer repos (update via `git submodule update --remote` -> rebuild -> commit) - `overrides/` — Cadline core modifications - Malware (see `malware-iocs.md`) and runtime data are excluded ## Verification (against the live RO mirror) `out/` = ~23,544 files. Byte-matches live for all legit code; intentionally **clean** on the 4 attacker-infected files (3 trojanized core files + `shaper_helix3/index.php` cloaking) so the HIDS flags them on live. **Non-malware code residual = 0.** ## Note on history The branch history was rewritten to strip operator-internal references, so it is unrelated to main's initial commit. Merging brings the clean baseline into main; main's very first commit still carries those references in history (fully removing it would require a force-push on main). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

imre.agent closed this pull request

2026-07-16 14:39:11 +02:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

No reviewers

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cadline_web/www_archline_hu#1