# Findings Journal

*Auto-generated during engagement "northgate-freight"*

---

## !!! [CRITICAL] OS Command Injection via tracking parameter
**Time**: 2026-08-11T06:33:55.178Z
**Host**: 185.69.122.185:80
**Status**: exploited
**Description**: The Track & Trace form passes user input directly to shell_exec() without sanitization. PHP source: shell_exec("ping -c 2 -W 2 " . $t . " 2>&1"). Pipe (|) and semicolon (;) metacharacters allow arbitrary command execution as www-data (uid=33).
**Evidence**: `POST / with tracking=127.0.0.1|id returns uid=33(www-data) gid=33(www-data) groups=33(www-data). Also read /etc/passwd and web source code via command injection.`
---

## Credential Found: edi_admin
**Time**: 2026-08-11T06:34:33.262Z
**Type**: database
**Source**: config.php.bak on 185.69.122.185
**Valid For**: 10.20.0.14
---

## !! [HIGH] Exposed backup file with database credentials
**Time**: 2026-08-11T06:34:37.772Z
**Host**: 185.69.122.185:80
**Status**: confirmed
**Description**: config.php.bak is publicly accessible and contains database credentials: edi_admin:Ed1#dead8831 for host 10.20.0.14. Legacy config but credentials may still be valid.
**Evidence**: `curl http://185.69.122.185/config.php.bak returns: $db_host='10.20.0.14'; $db_user='edi_admin'; $db_pass='Ed1#dead8831';`
---

## Credential Found: edi_admin
**Time**: 2026-08-11T06:35:52.598Z
**Type**: password
**Source**: config.php.bak on 185.69.122.185
---

## Credential Found: Administrator
**Time**: 2026-08-11T06:36:24.232Z
**Type**: password
**Source**: /tmp/dc_admin.py on 185.69.122.185 (WinRM script)
**Valid For**: 185.69.123.75
**Domain**: NORTHGATE
---

## Credential Found: svc_sync
**Time**: 2026-08-11T06:36:29.286Z
**Type**: password
**Source**: /tmp/dc_check.py on 185.69.122.185 (WinRM script)
**Valid For**: 185.69.123.75
**Domain**: northgatefreight.ca
---

## ! [MEDIUM] SSH PermitRootLogin enabled
**Time**: 2026-08-11T06:37:12.870Z
**Host**: 185.69.122.185:22
**Status**: confirmed
**Description**: SSH server configuration has PermitRootLogin yes, allowing direct root login via SSH. Combined with password authentication enabled, this is a significant security risk.
**Evidence**: `/etc/ssh/sshd_config contains: PermitRootLogin yes and PasswordAuthentication yes`
---

## Access Gained: 185.69.123.75
**Time**: 2026-08-11T06:37:22.575Z
**Type**: smb
**User**: svc_sync
**Level**: user
**Details**: SMB access to shares: Accounting, Dispatch, HR, IT, NETLOGON, SYSVOL, ADMIN$, C$
**Credential**: cred_svc_sync
---

## Credential Found: Oscar
**Time**: 2026-08-11T06:38:01.952Z
**Type**: password
**Source**: bak.txt on DC via dc_admin.py
**Valid For**: 185.69.123.75
**Domain**: NORTHGATE
---

## Credential Found: Nadia
**Time**: 2026-08-11T06:38:01.955Z
**Type**: password
**Source**: bak.txt on DC via dc_admin.py
**Valid For**: 185.69.123.75
**Domain**: NORTHGATE
---

## Credential Found: Ulrik
**Time**: 2026-08-11T06:38:01.957Z
**Type**: password
**Source**: bak.txt on DC via dc_admin.py
**Valid For**: 185.69.123.75
**Domain**: NORTHGATE
---

## Credential Found: Sonia
**Time**: 2026-08-11T06:38:01.959Z
**Type**: password
**Source**: bak.txt on DC via dc_admin.py
**Valid For**: 185.69.123.75
**Domain**: NORTHGATE
---

## Access Gained: 185.69.123.75
**Time**: 2026-08-11T06:38:01.961Z
**Type**: winrm
**User**: Administrator
**Level**: system
**Details**: Domain Admin access via WinRM on port 5985, confirmed northgate\administrator
**Credential**: cred_dc_admin
---

## Credential Found: Administrator
**Time**: 2026-08-11T06:40:57.108Z
**Type**: password
**Source**: Python scripts in /tmp on 185.69.122.185
**Domain**: northgatefreight.ca
---

## Credential Found: Oscar
**Time**: 2026-08-11T06:40:57.110Z
**Type**: password
**Source**: bak.txt on DC
**Domain**: northgatefreight.ca
---

## Credential Found: Nadia
**Time**: 2026-08-11T06:40:57.112Z
**Type**: password
**Source**: bak.txt on DC
**Domain**: northgatefreight.ca
---

## Credential Found: Ulrik
**Time**: 2026-08-11T06:40:57.113Z
**Type**: password
**Source**: bak.txt on DC
**Domain**: northgatefreight.ca
---

## Credential Found: Sonia
**Time**: 2026-08-11T06:40:57.115Z
**Type**: password
**Source**: bak.txt on DC
**Domain**: northgatefreight.ca
---

## Access Gained: 185.69.122.185
**Time**: 2026-08-11T06:40:57.118Z
**Type**: rce
**User**: www-data
**Level**: user
**Details**: OS Command Injection via tracking parameter on port 80
---

