🔥 FOR SALE: CRITICAL 0-DAY — FULL NETWORK COMPROMISE & 10M+ TAXPAYER DATA INDONESIA
by marlanwg - Saturday October 31, 2026 at 05:39 AM
DarkForums Members
Members
Posts: 99
Threads: 27
Joined: Oct 2025
Reputation: 0

#1
31-10-26, 05:39 AM
🔥 FOR SALE: CRITICAL 0-DAY — FULL NETWORK COMPROMISE & 10M+ TAXPAYER DATA DUMP ON INDONESIAN TAX AUTHORITY (DJP) 🔥

Type: Remote Code Execution (Root) / Mass PII Exfiltration / Internal Network Pivot
Impact: CRITICAL (10.0) — National Data Breach & Full Fleet Control
Target: Indonesian Directorate General of Taxes (DJP) / Coretax Production Infrastructure
Price:  $3,5k

---

📌 WHAT IS THIS?
A complete, unauthenticated compromise of the Indonesian national tax authority's (DJP) external and internal attack surface. The assessment achieved **root-level code execution** across the e-Form LiveCycle fleet and extracted an unprecedented volume of first-party taxpayer data, including the entire SPT submission ledger and highly sensitive VAT-refund documents. The access extends deep into the internal network, including backup, integration, and vulnerability management planes.

---

💀 WHAT CAN YOU DO?
  • Full Fleet Root Access: Achieved `uid=0(root)` on multiple LiveCycle nodes and internal integration hosts. Persistence mechanisms (SSH keys, cron, UM admin) were established and proven durable.
  • Massive Data Exfiltration (10M+ Records): Extracted **10,490,677 distinct SPT submission records** covering **3,418,148 distinct NPWP**.
  • Sensitive VAT-Refund Data: Dumped **23,314 distinct VAT-refund cases**, including passport numbers, names, bank account details, and **17,124 unique receipt photographs**.
  • Civil Registry & PII Oracles: Unauthenticated access to Dukcapil (civil registry) verification, allowing enumeration of sensitive citizen attributes, plus HMAC-signed API access to taxpayer and contract PII.
  • Internal Pivot: Reached the internal Nexpose console (root), AEM Forms author (RCE), and internal integration hosts exposing Oracle DB and NFS exports.

---

🔬 PROOF OF CONCEPT (REDACTED)

1. Root RCE (Fleet-wide):
uid=0(root) gid=0(root) groups=0(root) Linux svr01efm**** 3.10.0-1160.59.1.el7.x86_64 #1 SMP ...
Proven Impact: Full root access across the e-Form fleet and integration hosts. Full unredacted terminal output provided to buyer.

2. SPT Submission Ledger (Sample):
{"NPWP": "[REDACTED]", "SPT_TYPE": "[REDACTED]", "AMOUNT": "[REDACTED]", "URI": "[REDACTED]"} ... (10,490,677 distinct records parsed)
Proven Impact: Complete ledger of taxpayer submissions (metadata). Full dataset manifest and SHA-256 checksums provided to buyer.

3. VAT-Refund Document Store:
GET /[REDACTED]/api/[REDACTED] HTTP/1.1 Host: [REDACTED].pajak.go.id
Proven Impact: Unauthenticated IDOR allows download of passport details, bank info, and receipt images. Sample dataset (23,314 cases) available for verification.

---

🛠️ COMPROMISED INFRASTRUCTURE (REDACTED)
  • e-Form LiveCycle Fleet (Multiple Nodes)
  • LiveCycle MySQL Database (`10.245.11.***`)
  • Nexpose Console (`10.245.8.***`)
  • AEM Forms Author Instance (`10.245.8.***:8080`)
  • Internal Integration Host (`10.244.97.***`) — Exposing Oracle & NFS
  • HMAC-Signed API Gateways & Coretax Portal

---

💰 TERMS
  • Full unredacted PoC (URLs, IPs, Credentials, Raw Datasets, SHA-256 Manifests) provided after payment confirmation.
  • Live demo available on request (escrow only).
  • Serious buyers only. No time wasters.
  • Contact (Session ID): 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42

#0day #RCE #MassiveDataBreach #TaxAuthority #RootAccess #Critical #DJP
Reply
DarkForums Members
Members
Posts: 99
Threads: 27
Joined: Oct 2025
Reputation: 0

#2
31-10-26, 08:44 PM
(31-10-26, 05:39 AM)marlanwg Wrote: 🔥 FOR SALE: CRITICAL 0-DAY — FULL NETWORK COMPROMISE & 10M+ TAXPAYER DATA DUMP ON INDONESIAN TAX AUTHORITY (DJP) 🔥

Type: Remote Code Execution (Root) / Mass PII Exfiltration / Internal Network Pivot
Impact: CRITICAL (10.0) — National Data Breach & Full Fleet Control
Target: Indonesian Directorate General of Taxes (DJP) / Coretax Production Infrastructure
Price:  $3,5k

---

📌 WHAT IS THIS?
A complete, unauthenticated compromise of the Indonesian national tax authority's (DJP) external and internal attack surface. The assessment achieved **root-level code execution** across the e-Form LiveCycle fleet and extracted an unprecedented volume of first-party taxpayer data, including the entire SPT submission ledger and highly sensitive VAT-refund documents. The access extends deep into the internal network, including backup, integration, and vulnerability management planes.

---

💀 WHAT CAN YOU DO?
  • Full Fleet Root Access: Achieved `uid=0(root)` on multiple LiveCycle nodes and internal integration hosts. Persistence mechanisms (SSH keys, cron, UM admin) were established and proven durable.
  • Massive Data Exfiltration (10M+ Records): Extracted **10,490,677 distinct SPT submission records** covering **3,418,148 distinct NPWP**.
  • Sensitive VAT-Refund Data: Dumped **23,314 distinct VAT-refund cases**, including passport numbers, names, bank account details, and **17,124 unique receipt photographs**.
  • Civil Registry & PII Oracles: Unauthenticated access to Dukcapil (civil registry) verification, allowing enumeration of sensitive citizen attributes, plus HMAC-signed API access to taxpayer and contract PII.
  • Internal Pivot: Reached the internal Nexpose console (root), AEM Forms author (RCE), and internal integration hosts exposing Oracle DB and NFS exports.

---

🔬 PROOF OF CONCEPT (REDACTED)

1. Root RCE (Fleet-wide):
uid=0(root) gid=0(root) groups=0(root) Linux svr01efm**** 3.10.0-1160.59.1.el7.x86_64 #1 SMP ...
Proven Impact: Full root access across the e-Form fleet and integration hosts. Full unredacted terminal output provided to buyer.

2. SPT Submission Ledger (Sample):
{"NPWP": "[REDACTED]", "SPT_TYPE": "[REDACTED]", "AMOUNT": "[REDACTED]", "URI": "[REDACTED]"} ... (10,490,677 distinct records parsed)
Proven Impact: Complete ledger of taxpayer submissions (metadata). Full dataset manifest and SHA-256 checksums provided to buyer.

3. VAT-Refund Document Store:
GET /[REDACTED]/api/[REDACTED] HTTP/1.1 Host: [REDACTED].pajak.go.id
Proven Impact: Unauthenticated IDOR allows download of passport details, bank info, and receipt images. Sample dataset (23,314 cases) available for verification.

---

🛠️ COMPROMISED INFRASTRUCTURE (REDACTED)
  • e-Form LiveCycle Fleet (Multiple Nodes)
  • LiveCycle MySQL Database (`10.245.11.***`)
  • Nexpose Console (`10.245.8.***`)
  • AEM Forms Author Instance (`10.245.8.***:8080`)
  • Internal Integration Host (`10.244.97.***`) — Exposing Oracle & NFS
  • HMAC-Signed API Gateways & Coretax Portal

---

💰 TERMS
  • Full unredacted PoC (URLs, IPs, Credentials, Raw Datasets, SHA-256 Manifests) provided after payment confirmation.
  • Live demo available on request (escrow only).
  • Serious buyers only. No time wasters.
  • Contact (Session ID): 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42

#0day #RCE #MassiveDataBreach #TaxAuthority #RootAccess #Critical #DJP
   
Reply
DarkForums Members
Members
Posts: 99
Threads: 27
Joined: Oct 2025
Reputation: 0

#3
02-11-26, 09:47 AM
(31-10-26, 05:39 AM)marlanwg Wrote: 🔥 FOR SALE: CRITICAL 0-DAY — FULL NETWORK COMPROMISE & 10M+ TAXPAYER DATA DUMP ON INDONESIAN TAX AUTHORITY (DJP) 🔥

Type: Remote Code Execution (Root) / Mass PII Exfiltration / Internal Network Pivot
Impact: CRITICAL (10.0) — National Data Breach & Full Fleet Control
Target: Indonesian Directorate General of Taxes (DJP) / Coretax Production Infrastructure
Price:  $3,5k

---

📌 WHAT IS THIS?
A complete, unauthenticated compromise of the Indonesian national tax authority's (DJP) external and internal attack surface. The assessment achieved **root-level code execution** across the e-Form LiveCycle fleet and extracted an unprecedented volume of first-party taxpayer data, including the entire SPT submission ledger and highly sensitive VAT-refund documents. The access extends deep into the internal network, including backup, integration, and vulnerability management planes.

---

💀 WHAT CAN YOU DO?
  • Full Fleet Root Access: Achieved `uid=0(root)` on multiple LiveCycle nodes and internal integration hosts. Persistence mechanisms (SSH keys, cron, UM admin) were established and proven durable.
  • Massive Data Exfiltration (10M+ Records): Extracted **10,490,677 distinct SPT submission records** covering **3,418,148 distinct NPWP**.
  • Sensitive VAT-Refund Data: Dumped **23,314 distinct VAT-refund cases**, including passport numbers, names, bank account details, and **17,124 unique receipt photographs**.
  • Civil Registry & PII Oracles: Unauthenticated access to Dukcapil (civil registry) verification, allowing enumeration of sensitive citizen attributes, plus HMAC-signed API access to taxpayer and contract PII.
  • Internal Pivot: Reached the internal Nexpose console (root), AEM Forms author (RCE), and internal integration hosts exposing Oracle DB and NFS exports.

---

🔬 PROOF OF CONCEPT (REDACTED)

1. Root RCE (Fleet-wide):
uid=0(root) gid=0(root) groups=0(root) Linux svr01efm**** 3.10.0-1160.59.1.el7.x86_64 #1 SMP ...
Proven Impact: Full root access across the e-Form fleet and integration hosts. Full unredacted terminal output provided to buyer.

2. SPT Submission Ledger (Sample):
{"NPWP": "[REDACTED]", "SPT_TYPE": "[REDACTED]", "AMOUNT": "[REDACTED]", "URI": "[REDACTED]"} ... (10,490,677 distinct records parsed)
Proven Impact: Complete ledger of taxpayer submissions (metadata). Full dataset manifest and SHA-256 checksums provided to buyer.

3. VAT-Refund Document Store:
GET /[REDACTED]/api/[REDACTED] HTTP/1.1 Host: [REDACTED].pajak.go.id
Proven Impact: Unauthenticated IDOR allows download of passport details, bank info, and receipt images. Sample dataset (23,314 cases) available for verification.

---

🛠️ COMPROMISED INFRASTRUCTURE (REDACTED)
  • e-Form LiveCycle Fleet (Multiple Nodes)
  • LiveCycle MySQL Database (`10.245.11.***`)
  • Nexpose Console (`10.245.8.***`)
  • AEM Forms Author Instance (`10.245.8.***:8080`)
  • Internal Integration Host (`10.244.97.***`) — Exposing Oracle & NFS
  • HMAC-Signed API Gateways & Coretax Portal

---

💰 TERMS
  • Full unredacted PoC (URLs, IPs, Credentials, Raw Datasets, SHA-256 Manifests) provided after payment confirmation.
  • Live demo available on request (escrow only).
  • Serious buyers only. No time wasters.
  • Contact (Session ID): 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42

#0day #RCE #MassiveDataBreach #TaxAuthority #RootAccess #Critical #DJP
Provide is the details of data dump from 7 servers so that can get 10 million data

{
  "total_submit_lines": 26595540,
  "bad_lines": 1572964,
  "distinct_records": 10486001,
  "distinct_npwp": 3418091,
  "per_host": {
    "svr01efm0202a01": {
      "submit_lines": 3981650,
      "parsed": 2910925,
      "bad": 234419
    },
    "svr01efm0202a03": {
      "submit_lines": 4183936,
      "parsed": 1616259,
      "bad": 238784
    },
    "svr01efm0202a04": {
      "submit_lines": 3410971,
      "parsed": 2114295,
      "bad": 209375
    },
    "svr01efm0202a05": {
      "submit_lines": 4258722,
      "parsed": 1044485,
      "bad": 238888
    },
    "svr01efm0202a06": {
      "submit_lines": 3356342,
      "parsed": 993754,
      "bad": 207282
    },
    "svr01efm0202a07": {
      "submit_lines": 3995276,
      "parsed": 832668,
      "bad": 235762
    },
    "svr01efm0202a08": {
      "submit_lines": 3408643,
      "parsed": 973615,
      "bad": 208454
    }
  },
  "output": "submissions_fleet.jsonl",
  "db": "dedupe.db"
}
Reply
DarkForums Members
Members
Posts: 39
Threads: 2
Joined: Aug 2026
Reputation: 0

#4
7 hours ago
What the website bro?
What the website bro?
fbichan
Reply
DarkForums Members
Members
Posts: 99
Threads: 27
Joined: Oct 2025
Reputation: 0

#5
1 hour ago
(7 hours ago)RmaxEx Wrote: What the website bro?
What the website bro?

pajak.go.id
Reply


Forum Jump:


 Users browsing this thread: 1 Invisible User(s), 1 Guest(s)