# prog2.pharmanet.id — Full Host Recon via MySQL LOAD_FILE
# Date: 2026-09-21

## HOST INFO

| Parameter | Value |
|-----------|-------|
| Public IP | 13.250.197.171 |
| Internal IP | 172.30.1.245 (AWS VPC) |
| VPC subnet | 172.30.0.0/16 |
| Gateway | 172.30.1.1 |
| DNS | 172.30.0.2 (AWS VPC DNS) |
| Hostname | prog2.pharmanet.id |
| Alias | all.apodoc.id |
| OS | CentOS Linux 7.4.1708 |
| MariaDB | 10.2.18 |
| AWS region | ap-southeast-1 (Singapore) |

## LISTENING PORTS (from /proc/net/tcp + tcp6 via LOAD DATA INFILE)

| Port | Service | UID | Notes |
|------|---------|-----|-------|
| 22 | SSH | 0 (root) | Open |
| 25 | SMTP (postfix) | 0 | Open |
| 80 | HTTP (nginx/apache) | 0 | Open |
| 111 | rpcbind | 0 | Open — NFS/RPC |
| 443 | HTTPS | 0 | Open |
| 1433 | MSSQL | 995 (mssql) | Open — separate DB engine |
| 3306 | MySQL/MariaDB | 996 (mysql) | Our access |
| 35679 | unknown | 0 | Open — unknown service |

## NETWORK

### /etc/hosts
127.0.0.1 localhost
13.250.197.171 all.apodoc.id all
13.250.197.171 prog2.pharmanet.id prog2

### /etc/resolv.conf
search ap-southeast-1.compute.internal pharmanet.id
nameserver 172.30.0.2

### /proc/net/arp
172.30.1.1 (gateway) — 02:dd:10:91:d0:e9 — eth0

### Established connections
- 172.30.1.245:3306 <- 74.131.225.104 (our MySQL)
- 172.30.1.245:80 <-> 13.250.197.171 (HTTP self-loopback)

## LINUX USERS (from /etc/passwd via LOAD_FILE)

| User | UID | Shell | Home | Notes |
|------|-----|-------|------|-------|
| root | 0 | /bin/bash | /root | — |
| sgt | 0 | /bin/bash | /home | ROOT EQUIVALENT! MySQL user без пароля |
| centos | 1000 | /bin/bash | /home/centos | Cloud User |
| prog1 | 1001 | /bin/bash | /var/www/html | Web app |
| ekap | 1002 | /bin/bash | /home/ekap | — |
| mis1 | 1003 | /bin/bash | /home/mis1 | — |
| b-prog1 | 1004 | /bin/bash | /home/b-prog1 | — |
| pivitropic | 1005 | /bin/bash | /var/www/html/pi_vitropic | WordPress (pi_vitropic.co.id) |

## INSTALLED SERVICES

nginx, apache/httpd, PHP-FPM (127.0.0.1:9000), postfix, clamav, MSSQL, Cyrus IMAP, SSH, rpcbind

## MYSQL ACCESS

### Privileges
GRANT ALL PRIVILEGES ON *.* TO 'PharmanetBois'@'%' WITH GRANT OPTION
File_priv=Y, Super_priv=Y, Process_priv=Y, Grant_priv=Y, Shutdown_priv=Y, Repl_slave_priv=Y

### secure_file_priv = EMPTY (no restrictions)

### 76 MySQL users — ALL with empty authentication_string (NO PASSWORDS)

Key named users (all passwordless):
backup, dbachc, dbprog1, delphicrawling, devsecops, hari, nsbois, pharmanet_ud, pifelix, pilianto, sgt, uservitropic, PharmaBois2

~60 random-named users (e.g. 1OoTsCcArFrRktFUdc0nz0CGElvAGE51) — all passwordless

### Can write to: /tmp, /var/tmp, /var/lib/mysql
### Cannot write to: /var/www/html, /home/*, /usr/lib64/mysql/plugin (plugin_dir)

## KEY FINDINGS

1. prog2 is in AWS VPC 172.30.0.0/16 — internal network accessible from host
2. 9 listening ports including HTTP (80/443), MSSQL (1433), SSH (22)
3. ALL MySQL users have empty passwords — anyone can connect as any user
4. LOAD_FILE works for regular files (not /proc pseudo-files)
5. LOAD DATA INFILE works for /proc files (netstat, arp, route)
6. INTO OUTFILE works for /tmp, /var/tmp, /var/lib/mysql
7. Cannot write to plugin_dir — UDF blocked
8. No SSH keys found on any user
9. Port 35679 — unknown service (needs investigation)
10. sgt user has uid=0 (root equivalent) and MySQL account without password