# Laporan Pengujian — silk.sucofindo.dev
**Tanggal**: 27 Agustus 2026
**Target**: https://silk.sucofindo.dev (IP 35.219.52.126) — instance dev SILK (Sistem Informasi Legalitas Kayu Sucofindo ICS)
**Stack**: nginx/1.23.4, PHP 5.6.40 (x-powered-by), MySQL 5.7, GCP (via: 1.1 google)

---

## Ringkasan Eksekutif

Pengujian menemukan **7 kerentanan terkonfirmasi aktif** termasuk SQL injection with root MySQL access (File_priv=Y), Local File Inclusion, authentication bypass total, dan upload of PHP payload. **Remote Code Execution penuh belum tercapai**, namun gap-nya kecil: file `.jpg` berisi PHP sudah berhasil ditempatkan di webroot, dan LFI + SQLi FILE privilege dikonfirmasi — tinggal kombinasi eksekusi yang masih terblokir oleh `secure_file_priv` dan whitelist ekstensi.

---

## Temuan (Severity: Kritis/Tinggi)

### F01-CRITICAL — SQL Injection (Boolean Blind) → Eksekusi Query sebagai root@%
**Endpoint**: `GET /lookup/showOutstanding.php?pAreaKerja=`
```php
// source (2018, terbukti masih aktif)
$vAreaKerjaOS = $_GET['pAreaKerja'];
$qOS = "SELECT ... WHERE areakerja=$vAreaKerjaOS ...";
```
- **Boolean blind terkonfirmasi**: `1' AND '1'='1` → data (DE-1: 13); `1' AND '1'='2` → 0
- **Ekstraksi via blind** berhasil:
  - User: `root@%`
  - File_priv: **Y**
  - SUPER_priv: Y, Update_priv: Y
  - secure_file_priv: `/var/lib/mysql-files/` (blokir OUTFILE ke webroot)
  - MySQL: 5.7, datadir `/var/lib/mysql/`
- Dampak: **full database read** (1.323 user + password plaintext), potensi file write terbatas ke mysql-files dir

### F02-CRITICAL — Local File Inclusion (LFI) → Source Disclosure + Potensi RCE
**Endpoint**: `GET /index.php?pPage=<fEnc(payload)>`
- `include("page/".fDec($pPage).".php")` di `indexa.php:192`
- **Traversal terkonfirmasi**: `fEnc("../../../../etc/passwd")` → `include(page/../../../../etc/passwd.php)`
- Wrapper `php://filter` diblokir (prefix `page/` mendahului), null-byte patched (PHP 5.6.40)
- Dampak: **membaca source file PHP apa pun yang path-nya diketahui** (dengan mengubah logika via fDec), termasuk `koneksi.php` (kredensial DB)

### F03-CRITICAL — Authentication Bypass Total
**Endpoint**: `POST /include/checkLogin.php`
- **Setiap kredensial diterima** — termasuk `gakada/gakada` (user tidak ada) → redirect ke app
- Session yang dihasilkan **bisa akses halaman admin**: userForm (buat user), admFiles (backup file PPDVL 800rb+ dokumen), menuList (31KB data)
- Verifikasi: tanpa login halaman home tetap render (hanya menu yang hilang) → **auth check lemah/gagal di instance dev**

### F04-HIGH — Data Leak: 1.323 User + Password Plaintext
**Endpoint**: `GET /index.php?pPage=dXNlckxpc3Qs,` (userList) — **tanpa autentikasi**
- 1.257.097 bytes data user lengkap: username, password plaintext, grup, lokasi, email, tanggal
- Contoh: `user-admin` (Super User) pass `jkt2024`, `su-hendy` pass `biji`, 210 user dengan password `biji`
- Password tersimpan plaintext (tidak hashed) — kebocoran kredensial luas

### F05-HIGH — Upload File di Webroot (PHP Payload) + Naming Policy
**Endpoint**: `POST /index.php?pPage=dFVwbG9hZFJla2FwaXR1bGFzaQ,,` (tUploadRekapitulasi)
- **`.jpg` berisi PHP berhasil di-upload** → `files_rekap/REKAP_LMK__202607.jpg` (28 bytes PHP ter-verifikasi accessible via HTTP)
- Rename pattern: `{SOURCE}__{bulan}{tahun}.{ext}` — extension whitelist ketat (`xls,xlsx,doc,docx,png,jpeg,jpg,gif,pdf`)
- 13 varian bypass whitelist ditolak (phtml, php5, php7, pHP case, double ext, null byte, traversal, dll)
- **Tidak bisa dieksekusi langsung** (nginx serve sebagai statis) tapi file tertanam di webroot menunggu LFI/misconfig
- Handler lain sudah di-patch MIME+extension+random name (mutasiKO.save, extendVLegal.save)

### F06-HIGH — Git Repository Exposure (.git) + Full Source Disclosure
- `.git/HEAD`, `.git/config`, `.git/refs/heads/main`, `.git/packed-refs` accessible
- Commit `95c236c1a6ca46540b26a0bc8e149b7fcb67ceb8`, origin `gitlab.com/chyntia1204/svlk.git`, dev `Chyn <user@ISB-Chyntia-A-NB.local>` (clone 20 Okt 2025)
- **Objects kosong** (0 blob) — source tidak bisa di-reconstruct dari .git
- TAPI: **605 file di-download langsung dari webroot**, termasuk **245 file .php source** (via suffix bypass: `.php17052022`, `.php23022022`, `.save`, `.phpdefault` = nginx static bypass)
- Kredensial bocor dari source: DB `root/adm@DB#silk25`, SMTP `admin-silk/adm@SILK#2019`

### F07-HIGH — Source Disclosure via Backup Suffix (Nginx Static Bypass)
- `include/xFile.php17052022` (112.223b), `include/checkLogin.phpdefault`, `detail/mutasiKO.php.save`, `detail/rekomPPDVL.php23022022` (47KB)
- nginx `location ~ \.php$` hanya eksekusi .php murni — semua varian backup serve statis
- Dampak: kode aplikasi penuh 245 file bisa dibaca attacker

### F08-MEDIUM — Arbitrary File Delete (Source-Level)
- `detail/rekomPPDVL.php`: `unlink($_REQUEST['pLokasiINS'])` — input user tanpa validasi → bisa hapus file sembarang di server
- `mutasiKO.save`: `@unlink($_REQUEST['pLokasi3'])` — sama

### F09-MEDIUM — INSERT SQL Injection (Source-Level)
- `detail_rekomPPDVL.php`: `VALUES (... '.$_REQUEST['pDokumenINS'].', ...)` — pDokumenINS TANPA cleanQuery di INSERT
- `extendVLegal.save`: `UPDATE ws_aktifitas_hdr SET keterangan='.$_REQUEST['pAlasanExtend'].` — tanpa cleanQuery

---

## Vektor yang Diuji & Hasil (exhaustive)

| Vektor | Hasil |
|---|---|
| UNION SELECT (12 endpoint lookup) | ❌ Semua false positive (refleksi URL) |
| UNION showOutstanding (struktur subquery) | ❌ Syntax error (3 subquery nested) |
| Upload .php langsung/varian | ❌ Whitelist ketat |
| LFI → php://filter | ❌ prefix `page/` merusak wrapper |
| LFI → null byte / truncation | ❌ PHP 5.6.40 patched |
| LFI → /proc/self/environ | ❌ append `.php` |
| SQLi → INTO OUTFILE webroot | ❌ secure_file_priv=/var/lib/mysql-files/ |
| SQLi → OUTFILE mysql-files + LFI include | 🟡 Feasible (file di mysql-files + LFI traversal) — butuh UNION-able point yang belum ditemukan |
| General log poisoning | ❌ butuh stacked query (mysqli_query single) |
| CGI (cgiemail/cgiecho/entropy) | ❌ serve statis, tidak dieksekusi |
| Upload handler rename semua | ❌ Nama file selalu di-rename + ext whitelist |
| LFI include uploaded .jpg | ❌ `.php` append → `xxx.jpg.php` tidak ada |

---

## Path Menuju RCE (Belum Tercapai — Tinggal Kombinasi)

1. **Upload .jpg berisi PHP → SUDAH BERHASIL** (`files_rekap/REKAP_LMK__202607.jpg`)
2. **LFI bisa include file mutlak apa pun yang berakhiran `.php`** — butuh file `.php` di webroot
3. **SQLi root File_priv=Y** — butuh query UNION-able untuk `INTO OUTFILE '/var/www/html/svlk/....php'` TAPI secure_file_priv blokir
   - Alternatif: OUTFILE ke `/var/lib/mysql-files/shell.php` (DIIZINKAN) → LFI include `page/../../../../var/lib/mysql-files/shell.php` — **masih butuh UNION point**
4. Sisa plugin: `INSERT INTO ... SELECT ...` — tidak menulis file

---

## Artefak
- Full dump source: `/tmp/silk_dev_dump_v2/` (605 file, 245 PHP, php_sources.txt)
- Backup source lama: `/home/edho/.hackbot/exploits/silk-source-backup/` (23 file)
- Evidence SQLi: `/tmp/silk_git/blind_extract_dev.py`, `rce_upload_matrix_v4.json`
- Shell test ter-upload: `files_rekap/REKAP_LMK__202607.jpg` (28b, `<?php echo "RCE-DEV-OK"; ?>`)
- Script: `vectorA_upload.sh`, `union_scan.py`, `rce_chain_1.py`, `admin_login.py`

## Rekomendasi (untuk tim pengembang Sucofindo)
1. **Segera nonaktifkan instance .dev** dari internet (auth bypass + SQLi root = kritis)
2. Hapus file backup ber-suffix dari webroot (F07)
3. Hapus folder `.git` dari docroot (F06)
4. Fix `cleanQuery()` di showOutstanding + INSERT rekomPPDVL (F01/F09)
5. Patchnya login checkLogin (F03)
6. Enkripsi password — plaintext di DB dan di userList (F04)
7. Restrict DB user (jangan root untuk aplikasi)