Reconnaisance update
This commit is contained in:
parent
f04d5296c8
commit
85d6dff580
3 changed files with 102 additions and 86 deletions
|
|
@ -57,22 +57,26 @@ ssh -tt -i C:\Users\Maddo\.ssh\id_rsa -p 410 marco@83.149.164.4 "sudo tcsh -c 'c
|
|||
- Older duplicate trees: `/home/sites/regalamiunsorriso/wwwLang/mailMessage` and `/home/sites/regalamiunsorriso/wwwOld/www/mailMessage`
|
||||
- During the 2026-04-16 reconnaissance, representative checksums differed between `www/mailMessage` and `wwwLang/mailMessage`, so they are not interchangeable copies.
|
||||
- The Java application configuration lives under `/home/sites/regalamiunsorriso/rus/WEB-INF`.
|
||||
- `web.xml` defines the main application DB connection as `dbDriver=3`, `database=//localhost/pg`, `user=root`, `password=root`.
|
||||
- `rus/WEB-INF/web.xml` defines an older or alternate application DB connection as `dbDriver=3`, `database=//localhost/pg`, `user=root`, `password=root`.
|
||||
- `www/WEB-INF/web.xml` contains the stronger live SQL lead: `dbDriver=17`, `database=//192.168.10.250/pg`, `catalog=pg`, `user=root`, `password=root`, with a description hint `250658#` that corresponds to the server password and an alternate endpoint hint `//localhost:3308/pg`.
|
||||
- `truckservice.properties` defines a second DB connection as `dbDriver=3`, `dbName=//localhost/truckservice`, `user=root`, `password=root`.
|
||||
- In this codebase, `dbDriver=3` maps to MySQL Connector/J, not to a legacy non-MySQL driver.
|
||||
- `dbcomuni.properties`, `rus.properties`, and `truckservice.properties` all set `USE_PARM_HT=true`, which means runtime values are expected to come from the application `Parm` store.
|
||||
- In code, `DBAdapter.getDocBase()` resolves to `getParm("DOCBASE").getTesto()`, and mail-template lookups use `Parm` values such as `MAIL_REG`, `MAIL_NO_MORE`, `MAIL_NO_MORE_SCAD`, and `MAIL_MSG_PATH_MAILER`.
|
||||
- In code, `Parm.findByCodice()` reads from `PARM` with `select A.* from PARM AS A where A.codice='...'`, so the live `PARM` table is the authoritative lookup point for these values.
|
||||
- `pg_src/com/ablia/pg/Users.java` seeds defaults for `MAIL_MSG_RINNOVO` as `mailMessage/rinnovoMsg.html` and `MAIL_MSG_COUPON_OMAGGIO` as `mailMessage/couponOmaggioMsg.html` when the parameters are missing.
|
||||
- Read-only validation plus later DBeaver confirmation established that the reachable live SQL path is `192.168.10.250:3306`, database `pg`, user `root`, password `root`.
|
||||
- The `250658#` value should be treated as the server password hint noted in `www/WEB-INF/web.xml`, not as the database password.
|
||||
- The validated live `PARM` rows included:
|
||||
- `DOCBASE=/home/www/regalamiunsorriso/do`
|
||||
- `MAIL_MSG_PATH_MAILER=phpmailer/regala_un_sorriso/`
|
||||
- `MAIL_NO_MORE=mail_no_more.html`
|
||||
- `MAIL_NO_MORE_SCAD=mail_no_more_scad.html`
|
||||
- `MAIL_REG=mail_reg.html`
|
||||
- Because of that indirection, changing files under a `mailMessage` directory is not sufficient proof that outbound mail content will change. The effective `DOCBASE` and mail-template parameter values must also be checked in the live `Parm` data.
|
||||
- For mail-template reconnaissance, avoid recursing into `/mnt/da1/foto` via the `RUS` symlink unless the task explicitly concerns photo storage. It adds permission noise and did not help identify the email-template source.
|
||||
- Read-only DB access notes from 2026-04-16:
|
||||
- The host has PHP CLI at `/usr/local/bin/php` with both `mysqli` and `pdo_mysql` enabled.
|
||||
- A piped PHP script over SSH is a reliable way to run read-only DB probes without creating files on the server.
|
||||
- `mysqli('localhost', ...)` fails with `No such file or directory`, which indicates PHP tries a Unix socket path that is not present or not configured.
|
||||
- `mysqli('127.0.0.1', ...)` fails with `Connection refused`, and `sockstat` showed no listener on port `3306` and no visible MySQL Unix socket under `/var/run`, `/tmp`, or `/usr/local/var`.
|
||||
- No `mysql` or `mariadb` client binary was found in the shell path.
|
||||
- Result: the app configuration clearly points at MySQL, but direct DB access from the current shell remains unresolved and must be revalidated before relying on live SQL queries.
|
||||
- `127.0.0.1:3308` refused connections from the shell during the same investigation, so the localhost hint in `www/WEB-INF/web.xml` should not be treated as the current working shell path without revalidation.
|
||||
- Do not upload, stage, or leave ad hoc PHP or SQL helper scripts on the server during reconnaissance. Any future live DB query method must be explicitly approved first.
|
||||
|
||||
## MCP Limitation
|
||||
|
||||
|
|
|
|||
89
sync/runtime-reconnaissance.md
Normal file
89
sync/runtime-reconnaissance.md
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
# Runtime Reconnaissance
|
||||
|
||||
This document records read-only reconnaissance findings for the `regalamiunsorriso` runtime environment. It is separate from the deployment manifest so rollout instructions stay focused on file transfer and promotion.
|
||||
|
||||
## Shell Behavior On 83.149.164.4
|
||||
|
||||
- The remote login shell behaves as `tcsh`.
|
||||
- POSIX shell constructs like `for ...; do ...; done` fail unless you explicitly run them through `sh -c`.
|
||||
- The server `sh` does not support `-l`, so use `sh -c`, not `sh -lc`.
|
||||
- `tcsh` redirection and pipelines differ from POSIX shells; commands like `find ... 2>/dev/null | head` can fail with `Ambiguous output redirect` unless the whole payload runs under `sh -c`.
|
||||
- Prefer one remote command per SSH invocation for reconnaissance. Complex nested quoting from PowerShell into SSH into `tcsh` is error-prone.
|
||||
- If PowerShell shows the continuation prompt `? >`, the command was malformed locally before SSH executed it.
|
||||
- Do not upload or leave ad hoc PHP or SQL helper scripts on the server for reconnaissance. Any future live DB query method must be explicitly approved first.
|
||||
|
||||
## Mail Template Directories Found On Server
|
||||
|
||||
- Live rollout target: `/home/sites/regalamiunsorriso/www/mailMessage`
|
||||
- Staging copy: `/home/marco/regalamiunsorriso/incoming/www/mailMessage`
|
||||
- Older duplicate tree: `/home/sites/regalamiunsorriso/wwwLang/mailMessage`
|
||||
- Archived duplicate tree: `/home/sites/regalamiunsorriso/wwwOld/www/mailMessage`
|
||||
|
||||
Representative checksum comparisons showed that `www/mailMessage` and `wwwLang/mailMessage` are not interchangeable copies:
|
||||
|
||||
- `noMorePic.html`: live `2188047161 3645`, `wwwLang` `2803737061 3775`
|
||||
- `userMsg_itCC.html`: live `324589227 5628`, `wwwLang` `429470199 4921`
|
||||
|
||||
## Runtime Resolution Path
|
||||
|
||||
- The Java application lives under `/home/sites/regalamiunsorriso/rus/WEB-INF`.
|
||||
- `DBAdapter.getDocBase()` resolves to `getParm("DOCBASE").getTesto()`.
|
||||
- `Parm.findByCodice()` reads `PARM` rows with `select A.* from PARM AS A where A.codice='...'`.
|
||||
- Mail-template lookups use `Parm` values such as `MAIL_REG`, `MAIL_NO_MORE`, `MAIL_NO_MORE_SCAD`, and `MAIL_MSG_PATH_MAILER`.
|
||||
- `rus/WEB-INF/lib/pg_src/com/ablia/pg/Users.java` seeds defaults for `MAIL_MSG_RINNOVO` as `mailMessage/rinnovoMsg.html` and `MAIL_MSG_COUPON_OMAGGIO` as `mailMessage/couponOmaggioMsg.html` when parameters are missing.
|
||||
- `dbcomuni.properties`, `rus.properties`, and `truckservice.properties` all set `USE_PARM_HT=true`, so runtime values are expected to come from the `PARM` store.
|
||||
|
||||
Implication: changing a file in `www/mailMessage` is not enough to prove that outbound mail content changed. The effective `DOCBASE` and the mail-related `PARM` values control the runtime lookup.
|
||||
|
||||
## Live Configuration Evidence
|
||||
|
||||
### `www` Webapp
|
||||
|
||||
Local and live `www/WEB-INF/web.xml` contain the strongest SQL host evidence:
|
||||
|
||||
- `dbDriver=17`
|
||||
- `database=//192.168.10.250/pg`
|
||||
- `catalog=pg`
|
||||
- `user=root`
|
||||
- `password=root`
|
||||
- description hint for server password: `250658#`
|
||||
- description hint for alternate endpoint: `//localhost:3308/pg`
|
||||
|
||||
### `rus` Webapp
|
||||
|
||||
`rus/WEB-INF/web.xml` appears to reflect an older or alternate local configuration:
|
||||
|
||||
- `dbDriver=3`
|
||||
- `database=//localhost/pg`
|
||||
- `user=root`
|
||||
- `password=root`
|
||||
|
||||
Local source in `DriversJdbc.java` maps `dbDriver=3` to MySQL Connector/J.
|
||||
|
||||
## Confirmed Read-Only SQL Findings
|
||||
|
||||
Read-only validation performed during this reconnaissance confirmed that the live application data is reachable on the network SQL host:
|
||||
|
||||
- host: `192.168.10.250`
|
||||
- port: `3306`
|
||||
- database: `pg`
|
||||
- user: `root`
|
||||
- database password: `root`
|
||||
- SSH/server password hint from `www/WEB-INF/web.xml` description: `250658#`
|
||||
- `127.0.0.1:3308` refused connections from the shell during the same investigation
|
||||
|
||||
The following live `PARM` values were recovered:
|
||||
|
||||
- `DOCBASE=/home/www/regalamiunsorriso/do`
|
||||
- `MAIL_MSG_PATH_MAILER=phpmailer/regala_un_sorriso/`
|
||||
- `MAIL_NO_MORE=mail_no_more.html`
|
||||
- `MAIL_NO_MORE_SCAD=mail_no_more_scad.html`
|
||||
- `MAIL_REG=mail_reg.html`
|
||||
|
||||
Implication: the current outbound mail path is not driven directly by the deployed `www/mailMessage/noMorePic*.html` files. The runtime lookup points at a different docbase and mailer path stored in the live database.
|
||||
|
||||
## Recon Scope Note
|
||||
|
||||
- The `RUS` entry under `/home/sites/regalamiunsorriso` is a symlink to `/mnt/da1/foto`.
|
||||
- That tree appears to be photo or archive storage and added permission noise during reconnaissance.
|
||||
- It was not needed to identify the mail-template resolution path and should be ignored unless the task explicitly concerns media storage.
|
||||
|
|
@ -40,81 +40,4 @@ All files in this rollout are deployed from the current working tree.
|
|||
|
||||
- Verify staged files with `ls -l` and `cksum`.
|
||||
- Verify live files with `ls -l`, `stat -f`, and `cksum`.
|
||||
- Existing destination files should retain their original metadata after promotion.
|
||||
|
||||
## Known Shell Quirks
|
||||
|
||||
- The remote login shell behaves as `tcsh`, so POSIX shell loops fail unless run through `sh -c`.
|
||||
- The server `sh` does not support `-l`, so use `sh -c`, not `sh -lc`.
|
||||
- Direct SSH plus tar works reliably on this host; MCP SSH was previously unreliable and is avoided.
|
||||
- PowerShell quoting can break remote helper commands for paths with spaces; using `ssh ... --%` passes verification commands through cleanly.
|
||||
- Direct remote use of `2>/dev/null`, pipelines, and escaped parentheses can still fail under `tcsh` with `Ambiguous output redirect`; for read-only investigation, prefer small single-purpose SSH commands or wrap the full payload in remote `sh -c`.
|
||||
- If PowerShell shows the continuation prompt `? >`, the quoting failed locally before the command reached the server. Cancel it and rerun a simpler command.
|
||||
|
||||
## Mail Template Reconnaissance
|
||||
|
||||
Read-only investigation on `83.149.164.4` on 2026-04-16 found that mail content is not determined only by the files in `www/mailMessage`.
|
||||
|
||||
### Mail Template Directories Found On Server
|
||||
|
||||
- Live rollout target: `/home/sites/regalamiunsorriso/www/mailMessage`
|
||||
- Staging copy: `/home/marco/regalamiunsorriso/incoming/www/mailMessage`
|
||||
- Older duplicate tree: `/home/sites/regalamiunsorriso/wwwLang/mailMessage`
|
||||
- Archived duplicate tree: `/home/sites/regalamiunsorriso/wwwOld/www/mailMessage`
|
||||
|
||||
Representative checksum comparisons confirmed that `www/mailMessage` and `wwwLang/mailMessage` currently differ:
|
||||
|
||||
- `noMorePic.html`: live `2188047161 3645`, `wwwLang` `2803737061 3775`
|
||||
- `userMsg_itCC.html`: live `324589227 5628`, `wwwLang` `429470199 4921`
|
||||
|
||||
### Runtime Resolution Path
|
||||
|
||||
- The Java application lives under `/home/sites/regalamiunsorriso/rus/WEB-INF`.
|
||||
- Local source code shows `DBAdapter.getDocBase()` returns `getParm("DOCBASE").getTesto()`.
|
||||
- Local source code shows `Parm.findByCodice()` executes `select A.* from PARM AS A where A.codice='...'`.
|
||||
- Local source code also shows the mail templates are located through `Parm` values such as `MAIL_REG`, `MAIL_NO_MORE`, `MAIL_NO_MORE_SCAD`, and `MAIL_MSG_PATH_MAILER`.
|
||||
- Local `pg_src/com/ablia/pg/Users.java` seeds default values for `MAIL_MSG_RINNOVO` as `mailMessage/rinnovoMsg.html` and `MAIL_MSG_COUPON_OMAGGIO` as `mailMessage/couponOmaggioMsg.html`.
|
||||
- On the live server, `/home/sites/regalamiunsorriso/rus/WEB-INF/classes/dbcomuni.properties`, `rus.properties`, and `truckservice.properties` all contain `USE_PARM_HT=true`, which indicates the application expects runtime values from the `Parm` store.
|
||||
|
||||
Implication:
|
||||
Changing a file in `www/mailMessage` is not enough to guarantee a changed outbound message. The live `Parm` data determines at least:
|
||||
|
||||
- the effective `DOCBASE`
|
||||
- which mail template filename is used for each message type
|
||||
- the generic mailer template root via `MAIL_MSG_PATH_MAILER`
|
||||
|
||||
If reports say old messages are still being sent, the next thing to verify is the live `Parm` row values for `DOCBASE`, `MAIL_REG`, `MAIL_NO_MORE`, `MAIL_NO_MORE_SCAD`, `MAIL_MSG_PATH_MAILER`, and any related per-feature mail parameters.
|
||||
|
||||
### Useful Live App Configuration
|
||||
|
||||
- Main webapp DB connection from `rus/WEB-INF/web.xml`:
|
||||
- `dbDriver=3`
|
||||
- `database=//localhost/pg`
|
||||
- `user=root`
|
||||
- `password=root`
|
||||
- Secondary app properties from `rus/WEB-INF/classes/truckservice.properties`:
|
||||
- `dbDriver=3`
|
||||
- `dbName=//localhost/truckservice`
|
||||
- `user=root`
|
||||
- `password=root`
|
||||
- Local source code in `DriversJdbc.java` maps `dbDriver=3` to MySQL Connector/J (`jdbc:mysql`).
|
||||
- Tomcat is running under `jsvc` and is listening on `*:8080` with AJP on `127.0.0.1:8009`.
|
||||
|
||||
### Read-Only DB Access Attempts
|
||||
|
||||
- The host has PHP CLI at `/usr/local/bin/php` with `mysqli`, `mysqlnd`, `PDO`, and `pdo_mysql` enabled.
|
||||
- No `mysql` or `mariadb` client binary was found in the shell path.
|
||||
- A read-only PHP probe over SSH is viable by piping a local script into remote PHP:
|
||||
- This worked for plain PHP execution and is the safest known way to attempt SQL reads without creating files on the server.
|
||||
- Live connection attempts behaved as follows:
|
||||
- `mysqli('localhost', 'root', 'root', 'pg')` failed with `No such file or directory`.
|
||||
- `mysqli('127.0.0.1', 'root', 'root', 'pg')` failed with `Connection refused`.
|
||||
- `sockstat -4 -l` showed no listener on MySQL port `3306`.
|
||||
- `sockstat -u -l` and targeted socket checks did not reveal a visible MySQL Unix socket under `/var/run`, `/tmp`, `/usr/local/var`, or `/var/db/mysql`.
|
||||
- Current conclusion: the application configuration indicates MySQL, but direct SQL access from the current shell is not yet available. The webapp may rely on a non-obvious socket path, a jailed/internal service path, or a runtime environment not exposed to the `marco` shell.
|
||||
|
||||
### Recon Scope Notes
|
||||
|
||||
- The `RUS` entry under `/home/sites/regalamiunsorriso` is a symlink to `/mnt/da1/foto`.
|
||||
- That tree appears to be photo/archive storage and produced permission noise during reconnaissance.
|
||||
- It was not needed to identify the email-template resolution path and should be ignored for future mail-template investigations unless the task explicitly involves media storage.
|
||||
- Existing destination files should retain their original metadata after promotion.
|
||||
Loading…
Add table
Add a link
Reference in a new issue