cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

www.archline.hu — clean post-compromise baseline #2

Merged
imre.agent merged 88 commits from baseline/47 into main 2026-07-16 14:40:45 +02:00
Conversation 0 Commits 88 Files Changed 24297 +15 -4
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 0281383832 - Show all commits

19
RUNBOOK.md
View File

@ -37,6 +37,14 @@ delta (`cadline.patch`), so `git diff` documents exactly our change vs upstream.
Verification (residual→0, malware/data buckets) lives in **`illusion/hids`** (imrcli),
which consumes `out/` as the per-vhost `vanilla_ref`. This repo only produces the input.
**Current build result (verified against the live RO mirror):** `out/` = 23,578 clean
code files. Byte-matches live for all legit code; differs only on the 4 known-infected
files where the baseline is intentionally clean (3 trojanized core files + the
`shaper_helix3/index.php` cloaking). **Non-malware code residual = 0** — every live code
file is either in the baseline or is excluded malware / scan artifact. 5 benign extra
files (clean core the package carries but live dropped). `public/` (~219k files) and
other runtime data are excluded as data, not code.
## Module inventory (categorization)
### core
@ -68,10 +76,13 @@ in PROVENANCE.md.
com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit,
com_presentation, com_project, com_tcexam, com_versions; mod_al_*, mod_alusers,
mod_alworkshops, mod_course_list, mod_webinar*, mod_wsregister; plg content/workshopdates;
templates blankframe, category; docroot apps (beiratkozas, iskolak, public, phpext);
docroot PHPs (crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php,
recaptchalib.php, configuration.php). Cadline-internal deployed-layout repos are
**git submodules**: `common_cadline_libraries` → cadcommonlib, `maintenance` → maintenance.
templates blankframe, category; docroot apps (beiratkozas, iskolak, phpext) + root PHPs
(crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, sbtrack.php,
recaptchalib.php, configuration.php). `common_cadline_libraries` and `maintenance/` come
from the Cadline-internal repos cadcommonlib / maintenance (see PROVENANCE.md) but are
kept as **vetted live files for byte-fidelity** (could be converted to git submodules
later — that would not change the byte-baseline). `public/` is **excluded — user data**
(~219k images/project files), not code.
### overrides/ — Cadline core modifications (23 files)
com_content / com_users (registration/login/reset/remind), mod_login, captcha/recaptcha,