# 🔴 Security Assessment Report: PT Data Sinergitama Jaya Tbk (Elitery)
**Date:** 2026-06-21  
**Classification:** CONFIDENTIAL  
**Tools:** Shodan v1.31, LeakIX API, Nuclei v3.7.1, Nmap, OpenSSL, Curl  

---

## Executive Summary

**8 targets scanned** across the elitery.com infrastructure. Found **5 critical/high severity exposures**, **4 medium severity**, and **12 low/info findings**.

| Severity | Count |
|---|---|
| 🔴 **Critical** | 2 |
| 🟠 **High** | 3 |
| 🟡 **Medium** | 4 |
| 🔵 **Info/Low** | 12 |
| **Total** | **21** |

**Attack Surface Summary:** Origin server exposed behind Cloudflare, 2 VPN admin panels public, 1 vulnerability scanner panel public, 5 MikroTik routers with SNMP public, mail server fully exposed, 22 subdomains discovered (3 still active & accessible).

---

## 🔴 Critical Findings

### C-01: Origin Server Tidak Terproteksi Cloudflare
| Field | Value |
|---|---|
| **Host** | `43.230.29.247` |
| **Service** | Apache 2.4.41 (Ubuntu) + WordPress |
| **Ports** | 80, 443, 22022 (SSH non-standard) |

**Bukti:**
- IP langsung tembus ke origin tanpa Cloudflare
- SSL Cert **EXPIRED** (13 Feb 2024 → 16 Mar 2025 — expired >1 tahun!)
- 70+ CVE terdeteksi di Apache 2.4.41 (Shodan)
- `xmlrpc.php` aktif dengan **80 metode** (system.listMethods confirmed)

**Risiko:** RCE, defacement, data breach, DDoS reflection via xmlrpc pingback

### C-02: Multiple Admin VPN Panels Ekspos Publik
| Target | Software | IP | Status |
|---|---|---|---|
| `vpn-sap.elitery.com` | **Pritunl VPN** | `34.36.211.52` (GCP) | ✅ Live — login page full |
| `vpn-dev.elitery.com` | **NetBird Dashboard** | `103.17.178.200` | ✅ Live — dashboard loads |
| `vpn-sap` default password hint | — | — | Alert: `"sudo pritunl default-password"` |

---

## 🟠 High Findings

### H-01: SNMP Public pada 5 Router MikroTik
| IP | Model | Lokasi | Kontak |
|---|---|---|---|
| `202.51.101.234` | RB3011UiAS-RM | Cikarang | alert@elitery.com |
| `101.128.95.41` | RB951Ui-2nD | Plasa Senayan | alert@elitery.com |
| `103.17.179.13` | CCR2004-16G-2S+ | DCI | engineer@elitery.com |
| `36.95.107.169` | RB951Ui-2nD | Plasa Senayan | alert@elitery.com |
| `103.142.4.82` | Linux Ubuntu (BGM) | Bogor | ahmad.fuadi@elitery.com |

**Risiko:** SNMP community string `public` — bocor info jaringan, konfigurasi, kontak IT staff. Bisa jadi entry point social engineering.

### H-02: RouterOS API Terbuka (101.128.95.41:8728)
Port 8728/tcp (RouterOS API) terbuka publik. Bisa remote admin langsung jika kredensial lemah.

### H-03: WordPress XML-RPC Fully Exposed
**Endpoint:** `https://43.230.29.247/xmlrpc.php`  
**80 metode aktif** termasuk:
- `pingback.ping` — potensi DDoS reflection
- `wp.getUsers` — user enumeration (walau 405, methods lain jalan)
- `system.multicall` — batch execution
- `wp.getComments`, `wp.getPosts`, `wp.deletePost`, dll.

---

## 🟡 Medium Findings

### M-01: Mail Server Full Port Terbuka
| Field | Value |
|---|---|
| **Host** | `103.17.178.10` (mail-sa.elitery.com) |
| **Ports** | 25, 110, 143, 465, 587, 993, 995 — **all standard mail ports open** |
| **Software** | Dovecot IMAP, nginx, Let's Encrypt SSL |

### M-02: Subdomain Exposure (22 ditemukan)
Subdomain sensitif yang terekspos via LeakIX:
- `nessus.elitery.com` → Tenable Nessus scanner
- `repository.elitery.com` → Code repository
- `registry.elitery.com` → Docker registry
- `gitlabpages.eliproxy.elitery.com` → GitLab Pages
- `admin-ecmp.elitery.com` → Admin panel ECMP
- `apigee.elitery.com` → API Gateway
- `sre.elitery.com` → Internal SRE tools
- `suricitiw.elitery.com` → Suricata IDS panel
- `elitery-iac.elitery.com` → Infrastructure as Code

### M-03: Kontak Karyawan Terekspos via SNMP
5 email unik bocor: `alert@`, `engineer@`, `security@`, `ahmad.fuadi@`

### M-04: WordPress Plugin Exposure (11 plugins)
Elementor Pro, Jet Engine, Jet Blog, Smart Slider 3, dll — setiap plugin punya CVE history.

---

## 🔵 Info / Low Findings

| # | Temuan | Detail |
|---|---|---|
| I-01 | Cloudflare WAF detected | CF challenge on main domain (mitigates some attacks) |
| I-02 | HSTS enabled | Strict-Transport-Security: max-age=31536000 |
| I-03 | DMARC p=quarantine | Email spoofing partially mitigated |
| I-04 | WordPress Astra theme v4.12.6 | Popular theme, no specific vuln found |
| I-05 | Yoast SEO active | SEO plugin — info leak via JSON-LD |
| I-06 | GCP hosting (vpn-sap) | Google Cloud (34.36.211.52) |
| I-07 | Cloudflare shared IPs | 104.20.47.199, 172.66.149.227 |
| I-08 | DNS: Google Workspace | MX via Google (mitigated spam) |
| I-09 | Bandwidth-test server | 36.95.107.169:2000 — bisa jadi DDoS reflector |
| I-10 | 14 subdomain mati/tidak terjangkau | apigee, sre, emss, dll sudah tidak hidup |
| I-11 | vpn-dev.elitery.com | NetBird Dashboard (nginx/1.24.0 Ubuntu) |
| I-12 | Pritunl VPN vpn-sap | Auth endpoint /auth/session confirmed working |

---

## 🔥 Attack Vector Priority

```
Priority 1: ORIGIN SERVER (43.230.29.247)
  Vector: WordPress RCE via plugin vuln / Apache CVE / xmlrpc abuse
  Impact: FULL SERVER COMPROMISE
  └── Port 22022 (SSH) accessible

Priority 2: VPN PANELS (vpn-sap & vpn-dev)
  Vector: Default creds / password spraying / known CVE
  Impact: VPN ACCESS → internal network

Priority 3: ROUTEROS API (101.128.95.41:8728)
  Vector: Weak credentials via RouterOS API
  Impact: NETWORK ACCESS → pivot to internal

Priority 4: NESSUS SCANNER (nessus.elitery.com)
  Vector: Panel exposed — known CVEs in Nessus
  Impact: Vulnerability management data

Priority 5: MAIL SERVER (103.17.178.10)
  Vector: Open ports — SMTP/IMAP brute-force
  Impact: EMAIL ACCESS → phishing / data exfiltration
```

---

## 📁 Output Files

| File | Description |
|---|---|
| `~/.hackbot/shodan-output/` | Raw Shodan scans (IP, search, DNS) |
| `~/.hackbot/leakix-output/` | LeakIX recon (subdomains, services) |
| `~/.hackbot/reports/RECON_elitery.com.md` | Full compiled report |

---
*Generated by HackBot v2 — Automated Pentest Methodology*