#!/usr/bin/env bash
# Post-exploitation credential discovery — checks common locations for stored credentials.
# Usage: bash scripts/cred_harvest_check.sh [--linux|--windows]
set -euo pipefail

OS_TYPE="${1:---linux}"

echo "=== Credential Discovery ==="
echo "⚠️  Use only during authorized engagements"
echo ""

if [ "$OS_TYPE" = "--linux" ]; then
  echo "--- SSH Keys ---"
  find /home -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" 2>/dev/null | head -10 || echo "  None found"

  echo ""
  echo "--- .env Files ---"
  find /home /opt /var/www -name ".env" -type f 2>/dev/null | head -10 || echo "  None found"

  echo ""
  echo "--- History Files ---"
  find /home -name ".bash_history" -o -name ".zsh_history" 2>/dev/null | while read -r f; do
    if grep -qiE "password|passwd|token|secret|api.key" "$f" 2>/dev/null; then
      echo "  🔴 $f contains credential-like strings"
    fi
  done

  echo ""
  echo "--- Config Files with Passwords ---"
  grep -rl --include="*.conf" --include="*.cfg" --include="*.ini" --include="*.yaml" --include="*.yml" \
    -iE "password\s*[:=]|passwd\s*[:=]|secret\s*[:=]" /etc /opt 2>/dev/null | head -10 || echo "  None found"

  echo ""
  echo "--- SUID Binaries ---"
  find / -perm -4000 -type f 2>/dev/null | head -20

elif [ "$OS_TYPE" = "--windows" ]; then
  echo "Windows credential locations to check manually:"
  echo "  - SAM/SYSTEM hives: C:\\Windows\\System32\\config\\"
  echo "  - Cached creds: cmdkey /list"
  echo "  - Saved WiFi: netsh wlan show profiles"
  echo "  - Chrome passwords: %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data"
  echo "  - KeePass DBs: dir /s *.kdbx"
  echo "  - Unattend.xml: C:\\Windows\\Panther\\"
fi
