⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.173
Server IP:
78.40.11.138
Server:
Linux tango.o2switch.net 4.18.0-553.30.1.lve.el8.x86_64 #1 SMP Tue Dec 3 01:21:19 UTC 2024 x86_64
Server Software:
Apache
PHP Version:
7.4.33
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
home
/
sc1voni9410
/
View File Name :
scan_rogue.sh
#!/bin/bash # Rogue admin scan across all WP installs BADLOGINS="'mainauth','wplogin','adminwp','cmsuser','mainpanel','archiverss','wp-admin','admin1','wpsupport'" for wc in ~/*/wp-config.php ~/*/*/wp-config.php ~/*/wordpress/wp-config.php; do [ -f "$wc" ] || continue dir=$(dirname "$wc") # skip dup-installer / backup junk copies quickly but still report DBN=$(php -r "define('ABSPATH',1);\$s=file_get_contents('$wc');preg_match('/DB_NAME.\x27,\s*.\x27([^\x27]*)/',\$s,\$m);echo \$m[1];" 2>/dev/null) DBU=$(php -r "define('ABSPATH',1);\$s=file_get_contents('$wc');preg_match('/DB_USER.\x27,\s*.\x27([^\x27]*)/',\$s,\$m);echo \$m[1];" 2>/dev/null) DBP=$(php -r "define('ABSPATH',1);\$s=file_get_contents('$wc');preg_match('/DB_PASSWORD.\x27,\s*.\x27([^\x27]*)/',\$s,\$m);echo \$m[1];" 2>/dev/null) DBH=$(php -r "define('ABSPATH',1);\$s=file_get_contents('$wc');preg_match('/DB_HOST.\x27,\s*.\x27([^\x27]*)/',\$s,\$m);echo \$m[1]?:'localhost';" 2>/dev/null) PRE=$(php -r "\$s=file_get_contents('$wc');preg_match('/table_prefix\s*=\s*.\x27?\x22?([^\x27\x22]*)/',\$s,\$m);echo \$m[1]?:'wp_';" 2>/dev/null) [ -z "$DBN" ] && { echo "SKIP_NOCREDS $wc"; continue; } SQL="SELECT CONCAT('ROGUE|$wc|',u.user_login,'|',u.user_email) FROM ${PRE}users u JOIN ${PRE}usermeta m ON u.ID=m.user_id WHERE m.meta_key='${PRE}capabilities' AND m.meta_value LIKE '%administrator%' AND ( u.user_login IN ($BADLOGINS) OR u.user_email LIKE '%rambler%' OR u.user_email LIKE '%@wordpress.org' OR u.user_email LIKE '%nomxwp%' );" OUT=$(mysql -u"$DBU" -p"$DBP" -h"$DBH" "$DBN" -N -e "$SQL" 2>/tmp/myerr) if [ -s /tmp/myerr ]; then echo "DBERR|$wc|$(head -1 /tmp/myerr)"; fi if [ -n "$OUT" ]; then echo "$OUT"; fi done echo "SCAN_DONE"