# prog2 Shell Options — Analysis
# Date: 2026-09-21

## CURRENT ACCESS

- MySQL PharmanetBois@% — ALL PRIVILEGES WITH GRANT OPTION
- secure_file_priv = EMPTY
- File_priv=Y, Super_priv=Y

## WHAT WORKS

### Read (LOAD_FILE + LOAD DATA INFILE)
- /etc/passwd, /etc/hosts, /etc/resolv.conf, /etc/php.ini, /etc/my.cnf, /etc/redhat-release, /etc/fstab
- /proc/net/tcp, /proc/net/tcp6, /proc/net/arp, /proc/net/fib_trie (via LOAD DATA INFILE)
- /var/lib/mysql/ contents

### Write (INTO OUTFILE / INTO DUMPFILE)
- /tmp — YES
- /var/tmp — YES
- /var/lib/mysql — YES
- /var/lib/mysql/mysql/ — YES

## WHAT DOESN'T WORK

| Target | Error | Reason |
|--------|-------|--------|
| /var/www/html/ | Permission denied (errno 13) | MySQL user (uid 996) has no write access |
| /home/* | Permission denied | Same |
| /usr/lib64/mysql/plugin/ | Permission denied | UDF blocked |
| /etc/cron.d/ | Read-only file system (errno 30) | /etc is read-only! |
| /etc/systemd/system/ | Read-only file system | Same |
| /dev/shm | Permission denied | tmpfs not writable by mysql |
| /var/log/ | Permission denied | No write access |
| /var/spool/cron/ | Permission denied | No write access |
| /var/run/ | No such file or directory | — |

## SHELL VECTORS ANALYSIS

### 1. general_log → webshell — BLOCKED
- SET GLOBAL general_log_file='/var/www/html/shell.php' — ERROR 1231
- MySQL refuses to set general_log_file outside allowed paths
- Cannot write PHP to webroot

### 2. UDF (lib_mysqludf_sys.so) — BLOCKED
- plugin_dir = /usr/lib64/mysql/plugin/ (read-only for mysql user)
- INSTALL PLUGIN only accepts relative names (no paths)
- Cannot write .so to plugin_dir
- SET GLOBAL plugin_dir='/tmp/' — read-only variable

### 3. Cron — BLOCKED
- /etc/cron.d/ — Read-only filesystem
- /var/spool/cron/ — Permission denied
- Cannot create cron jobs

### 4. Web shell via INTO OUTFILE — BLOCKED
- /var/www/html/ — Permission denied
- Apache DocumentRoot = /var/www/html/
- MySQL user (996) cannot write there

### 5. MSSQL xp_cmdshell — UNTESTED
- MSSQL on port 1433 — OPEN externally
- sa password not found in MySQL databases
- No MSSQL credentials found in app configs
- Would need brute force (operator-gated)

### 6. /etc is READ-ONLY filesystem
- Cannot write to /etc/cron.d, /etc/systemd, /etc/profile.d
- This is unusual — suggests possible container or read-only mount

## NETWORK (from /proc/net/tcp + fib_trie)

### Internal IP
- 172.30.1.245 (prog2 internal)
- VPC: 172.30.0.0/16
- Gateway: 172.30.1.1
- DNS: 172.30.0.2

### Listening ports (external + internal)
| Port | Service | UID |
|------|---------|-----|
| 22 | SSH | root |
| 25 | SMTP | root |
| 80 | HTTP | root |
| 111 | rpcbind | root |
| 443 | HTTPS | root |
| 1433 | MSSQL | mssql (995) |
| 3306 | MySQL | mysql (996) |
| 35679 | unknown | root |

### Gateway only ARP entry
- 172.30.1.1 — 02:dd:10:91:d0:e9
- No other hosts in ARP (prog2 doesn't communicate with internal hosts)

## NEW CREDENTIALS FOUND

### apps_master.m_payment_gateway
- MerchantId: 00080091009147789397901
- MerchantName: PHARMANET B2B
- TransactionPassword: Qtidf3DN

### apps_master.m_user_refresh (refresh tokens)
- UserID 7: RefreshSecret=5f497399492b2f0b065817079e8268edf8b4e0b6647ba10c57fe72ffed481681

### CenturyMaster.M_AppUser
- ADMIN:ADMIN (plaintext)
- Qwerty, WAHYU, DAVID, RANI — binary-encoded passwords

### apps_master.m_ecommerce_akunpelapak
- Binary-encoded passwords (outlet accounts for retela/B2B)

## CONCLUSION

### Shell options status:
1. general_log webshell — BLOCKED (path restriction)
2. UDF — BLOCKED (plugin_dir not writable)
3. Cron — BLOCKED (/etc read-only)
4. Web shell via OUTFILE — BLOCKED (webroot not writable)
5. MSSQL xp_cmdshell — OPEN but no creds
6. SSH key injection — BLOCKED (/home not writable)

### Remaining options:
1. **MSSQL brute force** — port 1433 open, if we crack sa → xp_cmdshell (operator-gated)
2. **HTTP app exploitation** — port 80/443 serves Apache default page. If there's a PHP app, might have RCE vuln
3. **Port 35679** — unknown service, might have exploitable interface
4. **MySQL data exfiltration** — we can read all databases (already doing this)
5. **Stash UDF .so in /var/lib/mysql/ + symlink** — but can't create symlink without shell
6. **INTO OUTFILE to /tmp + wait for something to execute it** — no known mechanism

### The /etc read-only filesystem is the key blocker.
This is unusual for a standard CentOS 7 EC2 instance. It might be:
- A container (Docker/LXC) with read-only root
- An immutable infrastructure setup
- A security hardening measure

If it's a container, the host kernel is shared and container escape might be possible.