[marlanwg]

FOR SALE — Lion Air  Production Server Access (RCE)
Anonymous ASP.NET RCE → DefaultAppPool → Full Filesystem Access

---

WHAT YOU GET

- Pre-auth / anonymous RCE on Lion Air production server WEBAPPS01
- Endpoint: subdo.lionair.co.id 
- Execution context: IIS DefaultAppPool, Windows Server (build 10.0.26100)
- Full read/write/delete on webroot + writable folders
- Command execution (cmd / powershell) — server-side, no auth required
- Webshell persistent — HTTP-accessible, no session needed
- Access to backup file `backup_report_before_CVE-2026-47304.zip` (22 MB) — potential source/config leak
- Access to custom PowerShell scripts on root drive — potential credential leak
- pagefile.sys (1.2 GB) — memory dump potential for credential harvesting

---

TARGET DETAILS

Host:  subdo.lionair.co.id
App:  flight manifest / embarkation console)
Stack: IIS 10 / ASP.NET 4.8.9344
Host OS: Microsoft Windows NT 10.0.26100
User: DefaultAppPool
Server: WEBAPPS01
Root: C:\JT\APBManifest\APBApplication\
Industry: Civil aviation (Indonesia)

---

PROOF OF ACCESS

1. Root filesystem listing — C:\ via RCE

Show Content

Spoiler

DIR: C:\ SIZE        MODIFIED            NAME ------------------------------------------------------------ <DIR>        2025-05-15 11:08    $Recycle.Bin\ <DIR>        2026-10-09 18:00    a\ <DIR>        2026-09-04 15:47    b\ <DIR>        2024-11-14 00:27    Documents and Settings\ <DIR>        2026-05-19 17:07    GGV\ <DIR>        2025-07-02 09:16    inetpub\ <DIR>        2024-04-01 14:02    PerfLogs\ <DIR>        2026-03-13 13:45    Program Files\ <DIR>        2026-03-13 13:45    Program Files (x86)\ <DIR>        2026-03-02 13:23    ProgramData\ <DIR>        2025-05-14 15:49    Recovery\ <DIR>        2026-10-16 08:41    System Volume Information\ <DIR>        2025-11-20 10:41    Users\ <DIR>        2026-10-11 17:38    Windows\ 0            2026-09-12 04:33    $WINRE_BACKUP_PARTITION.MARKER 22510524    2026-08-19 17:37    backup_report_before_CVE-2026-47304.zip 363          2025-09-03 16:53    cek-update-jalan-auto-install-dan-restart.ps1 12288        2026-10-12 17:29    DumpStack.log.tmp 171          2025-09-03 16:53    install-nuget-dan-install-pswindowsProvider.ps1 1275068416  2026-10-12 17:29    pagefile.sys

2. Web shell execution (server-side, anonymous)

Show Content

Spoiler

HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 RCE_PROOF=49;MACHINE=WEBAPPS01;USER=DefaultAppPool;VER=Microsoft Windows NT 10.0.26100.0

3. Target identified — internal artifacts visible

Show Content

Spoiler

- backup_report_before_CVE-2026-47304.zip  (22 MB backup) - cek-update-jalan-auto-install-dan-restart.ps1  (custom script) - install-nuget-dan-install-pswindowsProvider.ps1  (setup script) - pagefile.sys  (1.2 GB memory page) - a\ b\ GGV\  (non-standard folders — likely app code / staging)

---

WHY THIS IS HIGH VALUE

- Production server — no test / staging
- No authentication needed to trigger shell — anonymous internet access
- Root-level filesystem access — backup ZIP, custom scripts, pagefile visible
- Aviation industry — flight manifest data, passenger PII potential
- Pivot potential — connection strings in web.config → SQL tier 
- BEC / phishing — trusted domain subdo.lionair.co.id
- Backup ZIP accessible — 22 MB of pre-patch data, potential source code / config / DB dump

---

PRICE

Price:  1k USD — negotiable
Payment: BTC / XMR — 
Delivery: Instant — access delivered privately via Session after payment

---

WHAT'S INCLUDED

- Working webshell URL (delivered privately)
- Auth token for shell
- Full PoC for upload + trigger
- Instructions to reproduce RCE from scratch
- Info on writable paths + sensitive files identified
- Notes on escalation potential (SeImpersonate / credential harvest)

---

CONTACT

Session: 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
Response: Within 24h
Escrow: Accepted — buyer's choice
Proof of life: Available on request

---

NOTES

- Access is not sold exclusive — first-come, first-served
- If target patches / removes shell after purchase, outside seller control
- Buyer assumes all responsibility for use
- No destructive action has been taken on target
- Test data uploaded to target has been cleaned up

---

Serious buyers only. Contact via Session. Escrow welcome.