admin
fe998b8847
gates / gates (push) Successful in 2m27s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
41 lines
2.7 KiB
Python
41 lines
2.7 KiB
Python
import sys, time, json
|
|
sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
|
|
import box_walk as w
|
|
EVF = open(f"{w.EV}/nextcloud.txt", "a", buffering=1)
|
|
def say(*a):
|
|
w.say(*a); EVF.write(" ".join(map(str, a)) + "\n")
|
|
APP, SUB = "nextcloud", "cloud"
|
|
H = f"{SUB}.{w.DOMAIN}"
|
|
def tun(v, f, m, p, b="", ct="", x=""):
|
|
q = lambda s: "'" + s.replace("'", "'\\''") + "'"
|
|
return w.guest(f"docker run --rm --network felhom-tunnel --ip 172.16.253.2 -v /root/tun.sh:/t.sh:ro curlimages/curl:8.11.1 "
|
|
f"sh /t.sh {H} {v} {f} {m} {q(p)} {q(b)} {q(ct)} {q(x)}").strip().splitlines()[-1:]
|
|
w.login()
|
|
say(f"##### nextcloud on 9202 — controller {w.guest('docker inspect felhom-controller --format {{.Config.Image}}').strip()} — {time.strftime('%FT%TZ', time.gmtime())}")
|
|
say("deploy ->", w.deploy(APP, SUB, {"HDD_PATH": "/mnt/felhom-drives/scratch_hdd"}))
|
|
say("the container env:", w.guest("docker exec nextcloud printenv TRUSTED_PROXIES").strip())
|
|
# R-613: wait until the app is up, then read status.php's exact bytes and the controller's own verdict
|
|
for i in range(90):
|
|
st = w.guest("docker exec nextcloud curl -s http://localhost/status.php").strip()
|
|
if '"installed":true' in st: break
|
|
time.sleep(10)
|
|
say("R-613 status.php bytes (inside the container):", st[:200])
|
|
for i in range(30):
|
|
s = w.stack(APP); state = s.get("state")
|
|
if state == "running": break
|
|
time.sleep(10)
|
|
say("R-613 the controller's state for the app (the probe expects '\"installed\":true'):", state, "| health:", (s.get("health") or s.get("health_status") or ""))
|
|
say("trusted_proxies in config.php:", w.guest("docker exec -u www-data nextcloud php occ config:system:get trusted_proxies 2>&1 | tr '\\n' ' '").strip())
|
|
# R-776 3.6: a stranger fails WebDAV basic auth 6 times through the simulated tunnel, each with a NEW forged leftmost
|
|
V, LAN = "198.51.100.66", "203.0.113.10"
|
|
codes = [tun(V, f"10.5.0.{i}", "PROPFIND", "/remote.php/dav/files/nobody/", "", "", "Authorization: Basic bm9ib2R5Ondyb25n") for i in range(1, 7)]
|
|
say(f"stranger {V}, 6 wrong basic-auth tries with a new forged leftmost each:", codes)
|
|
time.sleep(3)
|
|
occ = lambda ip: w.guest(f"docker exec -u www-data nextcloud php occ security:bruteforce:attempts {ip} 2>&1 | tr '\\n' ' '").strip()
|
|
say(f"occ bruteforce:attempts {V} (the real visitor):", occ(V))
|
|
for f in ("10.5.0.1", "10.5.0.6", "172.16.253.2"):
|
|
say(f"occ bruteforce:attempts {f} (forged / the tunnel):", occ(f))
|
|
tip = w.guest("docker inspect traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}'").split()
|
|
for ip in tip: say(f"occ bruteforce:attempts {ip} (traefik):", occ(ip))
|
|
say(f"occ bruteforce:attempts {LAN} (another visitor, never failed):", occ(LAN))
|