ALERT: SYSTEM SECURITY BREACH DETECTED

SYSTEM COMPROMISED

TARGET: mkbpay.unira.my.id

Aplikasi dan server pada domain ini telah berhasil di-takeover secara penuh. Seluruh proteksi keamanan, autentikasi session, dan database relasional telah dieksploitasi akibat kelalaian fatal dalam manajemen arsitektur keamanan dan celah kerentanan yang tidak ditutup.

THREAT: CVSS 10.0 CATASTROPHIC
PRIVILEGE: ROOT / NT AUTHORITY/SYSTEM
STATUS: 100% TABLES DUMPED
EXPLOIT: RCE + SQLi ZERO-DAY
WAKTU TERSISA SEBELUM PUBLIC DATA DUMP:
02JAM
:
47MENIT
:
59DETIK
SYSTEM TELEMETRY LIVE RECONNAISSANCE
Host Domain: mkbpay.unira.my.id
Server Software: nginx/1.26.2
OS Architecture: Linux (x86_64)
Runtime Engine: PHP 8.2.27
Client Ingress IP: 192.168.22.1
Infiltration Origin: SHADOW_VECTOR // 0xBFE3FE32
Breach Timestamp: 2026-09-24 06:52:18 WIB
LIVE DATA EXFILTRATION STREAM STREAMING [AES-256]
[DUMP] SELECT * FROM `users` WHERE `role`='superadmin' -> MATCH FOUND
[HASH] root:$6$qW9z12$N2vB4uP91kdKkP.8zM240L:19421:0:99999:7:::
[JWT] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.s3cr3t_4dm1n_t0k3n_3xp0s3d
[ENV] DB_HOST=localhost; DB_NAME=production_vault; DB_PASS=admin12345!
[ENV] AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE (EXPOSED IN PUBLIC REPO)
[KEY] STRIPE_LIVE_SECRET_KEY=sk_live_51N****************** (CAPTURED)
[AUTH] Bypassed OTP validation via null-byte parameter injection
[MEMORY] Heap pointer 0x7ffd98b420 dumped to remote shadow mirror
[DUMP] 4,892 Customer Records with Credit Card & Phone numbers extracted
[CONFIG] firewall_status: DISABLED; debug_mode: TRUE; display_errors: ON
[DUMP] SELECT * FROM `users` WHERE `role`='superadmin' -> MATCH FOUND
[HASH] root:$6$qW9z12$N2vB4uP91kdKkP.8zM240L:19421:0:99999:7:::
[JWT] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.s3cr3t_4dm1n_t0k3n_3xp0s3d
[ENV] DB_HOST=localhost; DB_NAME=production_vault; DB_PASS=admin12345!
SHADOW OVERRIDE CONSOLE CONNECTED: ROOT TTY
=====================================================
[+] INITIALIZING ADVERSARIAL PENETRATION FRAMEWORK
[+] TARGET: mkbpay.unira.my.id (PORT 80/443)
[!] SCANNING EXPOSED SURFACES... NO FIREWALL DETECTED
[+] CVE-2024-EXPLOIT: Remote Code Execution triggered
[+] ROOT PRIVILEGES ACQUIRED. Session established.
Type 'help' to view available intruder commands.
=====================================================
root@shadow:~#
VULNERABILITY & EXPLOIT ATTACK VECTORS 4 CRITICAL FLAWS IDENTIFIED
Zero Input Sanitization (SQLi)
Parameter HTTP GET/POST dimasukkan langsung ke SQL query tanpa Prepared Statements. Ekstraksi 100% database berhasil dilakukan dalam 1.4 detik.
Unrestricted File Upload (RCE)
Endpoint upload gambar tidak memvalidasi ekstensi file atau MIME type secara server-side. Reverse web-shell PHP berhasil diunggah dan dieksekusi.
Hardcoded Credentials (.env Leak)
File konfigurasi environment dan secret key dibiarkan dapat diakses secara publik pada root web directory tanpa proteksi .htaccess.
Default & Weak Passwords
Akun administrator menggunakan kata sandi lemah (admin / admin12345) tanpa proteksi Rate Limiting atau Two-Factor Authentication (2FA).
PESAN UNTUK DEVELOPER & SYSADMIN SECURITY REMINDER

Halaman deface ini adalah demonstrasi bahwa keamanan aplikasi tidak boleh menjadi hal yang dipikirkan belakangan. Sistem Anda runtuh bukan karena peretas hebat, melainkan karena standar pengkodean yang sangat ceroboh dan mengabaikan kaidah OWASP Top 10.

Langkah Pemulihan Segera:
  • Cabut seluruh active session dan rotate semua Database & API Secret Keys.
  • Gunakan PDO Prepared Statements untuk setiap query database.
  • Kunci izin folder upload dan blokir eksekusi skrip (.php, .sh).
  • Pasang Web Application Firewall (WAF) dan aktifkan proteksi SSL/TLS yang ketat.