{
  "phase": "L5-windows-host-enum",
  "date": "2026-08-12",
  "operator_go": "alternative vectors check",
  "host": "14.225.11.28 (WIN-J7BDV0AOIG7, Windows Server 2016)",
  "access": "PostgreSQL superuser (noti/nOTI@2025@#) -> RCE as NT AUTHORITY\\NETWORK SERVICE",
  "os_enum": {
    "drives": ["C: NTFS 200GB (110GB free)", "A: floppy", "D: CD-ROM"],
    "shares": ["C$", "ADMIN$", "IPC$"],
    "av": "Windows Defender ENABLED (all modules, no exclusions)",
    "users": ["Administrator", "app", "MariaDB", "orcldb", "Public"],
    "networks": ["14.225.11.28 (public)", "172.16.2.28 (internal)"]
  },
  "software": {
    "oracle_21c": "SID=orcl, home=C:\\Users\\Administrator\\Downloads\\WINDOWS.X64_213000_db_home",
    "mysql_8.0.36": "running, tamdt/tamdt valid (sc_data, vschool only)",
    "mariadb_11.3.2": "port 4309, root GSSAPI-only",
    "postgresql_10.23": "superuser noti, RCE vector",
    "nexus_3.41.1": "port 8081, service runs as LocalSystem",
    "iis_10.0": "14.225.11.40, 500 error",
    "apache_php": "14.225.11.51, 403 forbidden"
  },
  "found_creds": {
    "tammom_tammom_14.225.11.34": "TienPM config, but host blocked (not allowed from our IP)",
    "minhtien48_minhtien88.pham": "TienPM .bak config, DCOM auth OK but WMI/SMB denied",
    "postgres_Ctech2022!@#_14.225.11.8": "appsettings.json, VALID SUPERUSER",
    "postgres_Ctech2022!@#_14.225.11.57": "appsettings.json, VALID SUPERUSER",
    "postgres_Ctech@123!_localhost": "Serilog config, VALID",
    "geoserver_admin_Ctech@123!": "geo3.cgis.asia, VALID",
    "gmail_vinhlong.cgis_dyeoqtqhnevpucuq": "SMTP config",
    "google_api_29350440eb729a1980a474cb3953ceea": "Google Maps API"
  },
  "windows_neighbors": [
    {"ip": "14.225.11.6", "ports": "none", "os": "?"},
    {"ip": "14.225.11.7", "ports": "none", "os": "?"},
    {"ip": "14.225.11.8", "ports": "21,80,443,445,3389,5432,5985", "os": "Windows", "note": "PG Ctech2022!@# VALID, 100+ DBs"},
    {"ip": "14.225.11.21", "ports": "21,80,443,445,3389,5432,5985", "os": "Windows"},
    {"ip": "14.225.11.29", "ports": "80,443,445,3389,5985", "os": "Windows"},
    {"ip": "14.225.11.34", "ports": "80,445,3306,3389,5985", "os": "Windows", "note": "MySQL host-blocked"},
    {"ip": "14.225.11.36", "ports": "445,1433,3389,5985", "os": "Windows", "note": "MSSQL"},
    {"ip": "14.225.11.40", "ports": "80,443,445,1433,3389,5985", "os": "Windows", "note": "IIS+MSSQL"},
    {"ip": "14.225.11.41", "ports": "80,445,1433,3389,5985", "os": "Windows", "note": "MSSQL"},
    {"ip": "14.225.11.51", "ports": "22,80,445,1433,3306,3389,5985", "os": "Windows", "note": "SSH+Apache+MSSQL+MySQL"},
    {"ip": "14.225.11.57", "ports": "21,80,443,445,1433,3389,5432,5985,8080", "os": "Windows", "note": "PG Ctech2022!@# VALID, geoserver"},
    {"ip": "14.225.11.58", "ports": "21,22,23,80,443,445,3389,5432,5985", "os": "Windows", "note": "SSH+Telnet"},
    {"ip": "14.225.11.60", "ports": "21,80,445,3389,5985", "os": "Windows"},
    {"ip": "14.225.11.70", "ports": "80,443,445,1433,3389,5985,8080", "os": "Windows", "note": "MSSQL+Tomcat"},
    {"ip": "14.225.11.85", "ports": "21,80,445,1433,3389,5985", "os": "Windows", "note": "MSSQL"},
    {"ip": "14.225.11.145", "ports": "80,443,445,3389,5985", "os": "Windows"},
    {"ip": "14.225.11.147", "ports": "80,443,445,1433,3389,5985", "os": "Windows", "note": "MSSQL"},
    {"ip": "14.225.11.186", "ports": "21,80,443,445,1433,3389,5985", "os": "Windows", "note": "MSSQL"}
  ],
  "privesc_check": {
    "nexus_service": "C:\\TamDT\\nexus-3.41.1-01\\bin\\nexus.exe, LocalSystem, unquoted path",
    "write_access": "C:\\TamDT writable (Users: CreateFiles), nexus.exe replaceable but locked",
    "service_perms": "standard (SY/BA/IU/SU), no NETWORK SERVICE write",
    "registry": "HKLM Run key denied",
    "startup_folder": "denied",
    "current_privs": "SeChangeNotifyPrivilege only"
  },
  "alternative_vectors": {
    "oracle_default_creds": "not tested (need instantclient)",
    "nexus_web": "auth required, no default creds work",
    "mssql_default": "tested, all failed",
    "internal_network": "172.16.2.0/24 scanned, 172.16.2.29 found (Windows)",
    "dll_hijack": "possible in C:\\TamDT\\nexus-3.41.1-01\\bin (no DLLs currently)",
    "potato_exploit": "not attempted (Defender enabled)",
    "postgresql_superuser": "14.225.11.8 and 14.225.11.57 VALID (Ctech2022!@#)",
    "geoserver_admin": "geo3.cgis.asia VALID (admin:Ctech@123!)"
  },
  "confidence": "CONFIRMED RCE via PG on 14.225.11.28, 14.225.11.8, 14.225.11.57; GeoServer admin on geo3.cgis.asia",
  "next_steps": [
    "Test Oracle default creds (system/manager, sys/change_on_install)",
    "Test more PG hosts with Ctech2022!@#",
    "Exploit GeoServer (2.13.2 has known RCE)",
    "Scan more internal networks (172.16.2.0/24, 172.30.112.0/24)",
    "Attempt DLL hijack in nexus bin (place malicious DLL, wait for restart)",
    "Consider Potato exploit (PrintSpoofer/JuicyPotato) if other vectors fail"
  ]
}