64 lines
1.6 KiB
Bash
64 lines
1.6 KiB
Bash
# debugfs can search for directory entries by name
|
|
# even without a valid path
|
|
debugfs -c /dev/nbd0 << 'EOF'
|
|
stat <1585918>
|
|
EOF
|
|
|
|
# Use the parent inode from stat to walk upward
|
|
# inode 1585918 is 'volumes' - its .. entry points to pterodactyl dir
|
|
# pterodactyl's .. points to lib
|
|
# lib's .. points to var
|
|
|
|
# Find parent chain by reading .. entries
|
|
python3 -c "
|
|
import subprocess
|
|
|
|
def get_parent(inode):
|
|
r = subprocess.run(
|
|
['debugfs', '-c', '-R', f'ls -l <{inode}>', '/dev/nbd0'],
|
|
capture_output=True, text=True
|
|
)
|
|
for line in r.stdout.splitlines():
|
|
if '..' in line:
|
|
parts = line.split()
|
|
for p in parts:
|
|
try:
|
|
n = int(p)
|
|
if n > 0 and n != inode:
|
|
return n
|
|
except: pass
|
|
return None
|
|
|
|
def get_name(inode):
|
|
r = subprocess.run(
|
|
['debugfs', '-c', '-R', f'stat <{inode}>', '/dev/nbd0'],
|
|
capture_output=True, text=True
|
|
)
|
|
return r.stdout[:200]
|
|
|
|
# Walk up from volumes inode
|
|
inode = 1585918
|
|
chain = [inode]
|
|
print(f'Walking up from inode {inode} (volumes)...')
|
|
for i in range(10):
|
|
parent = get_parent(inode)
|
|
if parent is None or parent == inode or parent in chain:
|
|
break
|
|
print(f' inode {inode} -> parent {parent}')
|
|
chain.append(parent)
|
|
inode = parent
|
|
|
|
print(f'Chain: {chain}')
|
|
print()
|
|
|
|
# Now list each parent to find siblings of pterodactyl/volumes
|
|
for ino in chain[1:]:
|
|
print(f'Contents of inode {ino}:')
|
|
r = subprocess.run(
|
|
['debugfs', '-c', '-R', f'ls <{ino}>', '/dev/nbd0'],
|
|
capture_output=True, text=True
|
|
)
|
|
print(r.stdout[:500])
|
|
print()
|
|
"
|