⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.173
Server IP:
78.40.11.138
Server:
Linux tango.o2switch.net 4.18.0-553.30.1.lve.el8.x86_64 #1 SMP Tue Dec 3 01:21:19 UTC 2024 x86_64
Server Software:
Apache
PHP Version:
7.4.33
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
home
/
sc1voni9410
/
Edit File: audit_ao.sh
#!/bin/bash SERVER_IP="109.234.161.230" export SERVER_IP uapi --output=json DomainInfo domains_data > /tmp/dd_ao.json 2>/dev/null python3 - <<'PY' > /tmp/domlist.txt import json d=json.load(open('/tmp/dd_ao.json'))['result']['data'] m=d.get('main_domain',{}) print(f"{m.get('domain')}\t{m.get('documentroot')}\t0") for it in d.get('addon_domains') or []: print(f"{it.get('domain')}\t{it.get('documentroot')}\t1") PY WPBIN="$(command -v wp || echo /usr/local/bin/wp)" while IFS=$'\t' read -r DOMAIN DR ISADDON; do echo "@@@DOMAIN@@@ $DOMAIN" echo "docroot=$DR" echo "is_addon=$ISADDON" if [ ! -d "$DR" ]; then echo "docroot_exists=0"; else echo "docroot_exists=1"; fi CMS="empty"; DBNAME="" if [ -f "$DR/wp-config.php" ]; then CMS="wordpress" DBNAME=$(grep -oP "DB_NAME'\s*,\s*'\K[^']+" "$DR/wp-config.php" 2>/dev/null | head -1) grep -q "SBA_AUTOLOGIN_SECRET" "$DR/wp-config.php" 2>/dev/null && echo "autologin_secret=1" || echo "autologin_secret=0" else CNT=$(find "$DR" -maxdepth 2 -type f 2>/dev/null | head -5 | wc -l) if [ "$CNT" -eq 0 ]; then CMS="empty"; else if ls "$DR"/*.php >/dev/null 2>&1 || [ -f "$DR/index.php" ]; then CMS="other"; else CMS="static"; fi [ -f "$DR/artisan" ] && CMS="laravel" fi echo "autologin_secret=0" fi echo "cms=$CMS" echo "db_name=$DBNAME" [ -f "$DR/wp-content/mu-plugins/sba-autologin.php" ] && echo "mu_autologin=1" || echo "mu_autologin=0" TABLES=0 if [ "$CMS" = "wordpress" ]; then TABLES=$("$WPBIN" --path="$DR" --skip-plugins --skip-themes db tables 2>/dev/null | wc -l) if [ "$TABLES" -eq 0 ] && [ -n "$DBNAME" ]; then TABLES=$(mysql -N -e "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='$DBNAME'" 2>/dev/null) fi fi [ -z "$TABLES" ] && TABLES=0 echo "db_tables=$TABLES" HTTP=$(curl -skI -m 12 "https://$DOMAIN/" 2>/dev/null | awk 'NR==1{print $2}') [ -z "$HTTP" ] && HTTP=0 echo "http_code=$HTTP" DNSIP=$(dig +short "$DOMAIN" 2>/dev/null | grep -E '^[0-9]' | tail -1) echo "dns_ip=$DNSIP" [ "$DNSIP" = "$SERVER_IP" ] && echo "served_here=1" || echo "served_here=0" if [ -d "$DR/wp-content/uploads" ]; then UPHP=$(find "$DR/wp-content/uploads" -name '*.php' -type f 2>/dev/null | head -5 | wc -l) echo "uploads_php=$UPHP" else echo "uploads_php=0" fi if [ -d "$DR" ]; then SHELLS=$(grep -rlE 'eval\(base64_decode|eval\(\$_(POST|GET|REQUEST)|gzinflate\(base64|assert\(\$_|FilesMan|c99|r57|WSO ' "$DR" --include='*.php' 2>/dev/null | head -5) [ -n "$SHELLS" ] && echo "webshell_hits<<E" && echo "$SHELLS" && echo "E" if [ -d "$DR/wp-content/mu-plugins" ]; then MU=$(ls "$DR/wp-content/mu-plugins" 2>/dev/null | grep -viE '^(sba-autologin.php|index.php)$') [ -n "$MU" ] && echo "mu_extra<<E" && echo "$MU" && echo "E" fi fi echo "@@@END@@@" done < /tmp/domlist.txt rm -f /tmp/dd_ao.json /tmp/domlist.txt
Simpan