# Runtime Control-Plane Pentest Notes

## Scope

This note captures a controlled red-team style validation against the shared-hosting runtime control plane (cPanel + CloudLinux), focused on whether a customer account can stand up a hidden broker under random URIs.

The test intentionally models your Tier-1 attacker profile:

- upload code under account home
- register runtime app under random base URI
- expose public broker endpoint behind normal HTTPS

## What Was Tested

Two runtime paths were validated:

1. CloudLinux Node.js Selector (customer app registration)
2. cPanel Passenger Python application (Application Manager path)

Both checks were executed through `scripts/pentest_runtime_plane_probe.sh` using account credentials provided at runtime via environment variables.

## Reproduction

```bash
TWOMAN_CPANEL_BASE_URL='https://example.com:2083' \
TWOMAN_CPANEL_USERNAME='cpanel-user' \
TWOMAN_CPANEL_PASSWORD='cpanel-pass' \
TWOMAN_CPANEL_HOME='/home/cpanel-user' \
TWOMAN_PUBLIC_HOST='example.com' \
TWOMAN_PUBLIC_ORIGIN='https://example.com' \
bash scripts/pentest_runtime_plane_probe.sh
```

The script:

- creates a random Node Selector app URI
- creates a random Passenger app URI
- validates health endpoints with Bearer auth
- unregisters/destroys both apps
- deletes probe helper files and probe app directories
- prints a JSON summary with observed HTTP codes and cleanup status

## Observed Result Pattern

The runtime plane is considered **exploitable** when the probe shows:

- `node_selector.health_http_code == 200`
- `passenger.health_http_code == 200`

This means a customer-level identity can stand up a public broker endpoint at random paths without touching legacy `.htaccess` artifacts.

## Why This Matters

This confirms the highest-risk control-plane weakness in your model: if runtime creation primitives remain available to ordinary customer packages, path randomization + benign landing pages are enough to bypass simple URL/file IOC controls.

## Analyst Guidance

- Treat runtime inventory as the primary detection source:
  - Passenger: `PassengerApps/list_applications`
  - Node Selector: CloudLinux selector inventory/operations
- Alert on event correlation:
  - file write burst + app registration + new base URI
- Keep runtime features disabled by default in shared plans:
  - Application Manager, Node Selector, Terminal, API tokens
- For approved runtime plans, require controlled deployment paths:
  - CI-only deploys, no ad hoc File Manager writes into app roots
