# THREAT ASSESSMENT — Реальная угроза от утечки секретов
## CamelSoft / jenkins.camel-soft.com — RedTeam Engagement
Date: 2026-09-29

Методология:
  CONFIRMED — валидировано live-проверкой против API (L1)
  PROBABLE — cred в правильном формате + сервис активен, но не проверен
  HYPOTHESIS — cred может работать, но не верифицирован

---

## TIER 1 — CONFIRMED (валидированы в этом engagement)

| Secret | Category | Severity | Status |
|---|---|---|---|
| Jenkins admin: admin/camelsoftcamel-soft | ACCESS | CRITICAL | Login verified → RCE → root |
| GitLab tokens (5 valid of 7) | ACCESS+DATA | CRITICAL | Validated API, 167 repos cloned |
| Root SSH keys (2, no passphrase) | ACCESS | CRITICAL | ssh root@188.245.117.146 succeeds |
| DB: camelsoft/camelsoft @ ordrat | DATA | HIGH | Connected, 49 tables, PII+financial |
| Jenkins master.key | ACCESS | CRITICAL | Decrypts all 15 Jenkins creds offline |
| VAULT_MASTER_KEY | ACCESS | CRITICAL | Decrypts 42 platform_settings offline |
| SMTP: noreply@camel-soft.com:camelsoft001 | ABUSE | MEDIUM | SMTP relay active on host |
| XMRIG miner (pre-existing) | FINANCIAL | HIGH | Active, load 8.12, pool 107.155.109.94 |

## TIER 2 — VAULT-DECRYPTED (алгоритм подтверждён, значения расшифрованы)

All 42 values decrypted offline using AES-256-GCM + VAULT_MASTER_KEY.

| Secret | Category | Severity | Notes |
|---|---|---|---|
| Stripe sk_live_51TskJs... | FINANCIAL | **CRITICAL** | Secret key, live mode. Can charge/refund/payout. NOT validated (destructive) but format valid. |
| Stripe pk_live_51TskJs... | FINANCIAL | LOW | Publishable only, validated live, cannot charge |
| Stripe whsec_nX4FL... | ACCESS | MEDIUM | Forge webhook events (fake payment confirmations) |
| Anthropic sk-ant-api03... | ABUSE | HIGH | Claude API, burn credits. ~$6,000/mos worst case |
| Meta APP_SECRET | DATA+ABUSE | HIGH | FB app 879062728569095, Messenger/WhatsApp access |
| Meta INSTAGRAM_APP_SECRET | DATA+ABUSE | HIGH | IG app 1375335517771556, DM read/send |
| Meta CAPI token | ABUSE | MEDIUM | Fake conversion events (ad fraud) |
| Google service account | DATA+ACCESS | **CRITICAL** | GCP camelsoftmainwebsite, RSA key, Firebase admin |
| Apple Wallet P12 + password | REPUTATION | MEDIUM | Forge loyalty passes, Team T36TTB6HNW |
| Konnect API_KEY | FINANCIAL | LOW | SANDBOX mode — no real money currently |
| Euler API key | ABUSE | MEDIUM | Live selling abuse |
| Authentica API_KEY | ACCESS | MEDIUM | bcrypt hash — not directly usable |
| reCAPTCHA SECRET_KEY | ABUSE | LOW | Bypass captcha |
| GA4 API secret | ABUSE | LOW | Analytics poisoning |

## TIER 3 — GITLAB REPO SECRETS (157, accessible via tokens)

| Secret type | Count | Category | Severity | Notes |
|---|---|---|---|---|
| Firebase service account private keys | 13 | DATA+ACCESS | **CRITICAL** | Admin to 13 Firebase projects (Firestore, FCM, Auth) |
| Stripe pk_live (coachtime) | 1 | FINANCIAL | LOW | Publishable, validated, cannot charge |
| Google API keys (AIzaSy) | 19 unique | ABUSE | MEDIUM | Restrictions active, but Firebase/FCM may work |
| DB passwords (incl prod) | 17 | DATA | HIGH | AVNS_xd777NDlanmkgnWpi9U (Aiven cloud), camelsoft (ordrat prod) |
| RSA/EC private keys (JWT+ZATCA) | 7 | ACCESS+REPUTATION | HIGH | Forge JWT + Saudi tax invoices (ZATCA compliance breach) |
| JWT secrets | 9 | ACCESS | HIGH | Forge auth tokens (camelsoft320=, HJDUFdOMmo4V21...) |
| Supabase JWT | 1 | DATA | MEDIUM | Project inactive (DNS doesn't resolve) |
| Amadeus client_id | 1 | ABUSE | LOW | No secret, useless |
| FAL AI keys | 2 | ABUSE | LOW | Unclear if active |

## TIER 4 — MAILSERVER

| Secret | Category | Severity | Notes |
|---|---|---|---|
| 13 mailbox account hashes (SHA512-CRYPT) | DATA+ACCESS | HIGH | Crackable. admin, hr, info, support, etc. @camel-soft.com |

---

## ФИНАНСОВАЯ ОЦЕНКА

1. **Stripe sk_live — НЕОГРАНИЧЕННЫЙ** финансовый ущерб:
   - Списание с сохранённых карт, refund fraud, payout вывод
   - Доступ к истории платежей (PCI data)
   - НЕ валидирован (деструктивно), но format valid + live confirmed

2. **Anthropic API — до $6,000/мес** abuse:
   - 80M tokens/month (Zytoon tier), Claude Opus ~$75/M tokens

3. **XMRIG (уже активен) — ~$7** украдено + CPU износ:
   - 13 дней, load 8.12, Hetzner CPX31

4. **Konnect — $0** (sandbox mode, no real money)

5. **ZATCA keys — regulatory fines** (unknown):
   - Forge Saudi tax invoices → compliance breach
   - Loss of ZATCA certification
   - Clients in Saudi Arabia (Riyadh tenant confirmed)

6. **DB data — compliance/regulatory**:
   - Small volume (4 users, 9 customers, 14 orders)
   - PII: phone numbers (+216 TN, +966 SA), emails, addresses
   - Tunisian Loi 63-2004 + GDPR (if EU clients)

---

## СВОДКА

**CRITICAL (7):**
- Stripe sk_live → unlimited financial
- Jenkins admin → full host compromise
- GitLab tokens → 167 repos + source code
- Jenkins master.key + VAULT_MASTER_KEY → offline decryption of ALL secrets
- 13 Firebase private keys → admin to 13 Firebase projects
- Google service account → GCP admin
- Root SSH keys → prod server root

**HIGH (6):**
- DB creds → PII + financial data
- Meta app secrets → customer communications
- Anthropic API key → $6,000/mos abuse
- RSA/EC ZATCA keys → Saudi tax invoice forgery
- 13 mailserver hashes → email compromise
- XMRIG miner → ongoing theft (pre-existing)

**MEDIUM (6):**
- Apple Wallet cert, SMTP creds, Google API keys, Euler API, Konnect (sandbox), Stripe webhook

**LOW (6):**
- Stripe pk_live, reCAPTCHA, GA4, Amadeus, FAL AI, Supabase (inactive)