search

Symfonos 2

Symfonos 2 Vulnhub Walkthrough

hashtag
Enumeration

hashtag
Nmap

nmap -sC -sV -oA nmap/sym2 192.168.43.97
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-15 10:27 EDT
Nmap scan report for symfonos2 (192.168.43.97)
Host is up (0.00014s latency).
Not shown: 995 closed ports
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         ProFTPD 1.3.5
22/tcp  open  ssh         OpenSSH 7.4p1  Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   2048 9d:f8:5f:87:20:e5:8c:fa:68:47:7d:71:62:08:ad:b9 (RSA)
|   256 04:2a:bb:06:56:ea:d1:93:1c:d2:78:0a:00:46:9d:85 (ECDSA)
|_  256 28:ad:ac:dc:7e:2a:1c:f6:4c:6b:47:f2:d6:22:5b:52 (ED25519)
80/tcp  open  http        WebFS httpd 1.21
|_http-server-header: webfs/1.21
|_http-title: Site doesn't have a title (text/html).
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 4.5.16-Debian (workgroup: WORKGROUP)
MAC Address: 00:0C:29:03:48:23 (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 1h40m01s, deviation: 2h53m12s, median: 1s
|_nbstat: NetBIOS name: SYMFONOS2, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.5.16-Debian)
|   Computer name: symfonos2
|   NetBIOS computer name: SYMFONOS2\x00
|   Domain name: \x00
|   FQDN: symfonos2
|_  System time: 2020-05-15T09:27:31-05:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-05-15T14:27:31
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.14 seconds

hashtag
Enum4linux

We can see that anonymous shared folder here

We then can use smbclient to see what's inside.

hashtag
smblient

We can then ls to list all the available files inside the anonymous folder, then we saw a backup folder, change directory to that folder and get the log.txt by typing get log.txt

This is the content of log.txt

As we can see here we have a user called aeolus, so maybe we can brute force the ssh login using hydra

hashtag
Exploitation

hashtag
ncrack

We can see the password for the user aeolus is sergioteamo

hashtag
ftp

After that we can use ftp to login

Then I realized that we can ssh to the user to login into the user account.

hashtag
ssh

I been looking for a lot of directories and I can't seem to find a way. After looking at walk-through, I found out that there is a apache directory

navigate to the /etc/apache, we can find a few folders and I go into the sites-enabled folder and found a file called librenms.conf

cat that file and we find out this.

we can see that there is a server running at localhost port 8080.

We now need to port forward so that we can access the shell by using ssh tunneling.

hashtag
ssh tunneling

Then we can use our browser to browse the web-page.

hashtag
Exploit

it is LibreNMS. I went to searchsploit and did a quick lookup and got the exploit

After that, copy the exploit to a directory and set up the exploit

The exploit actually requires the URL, cookies and remote host and port.

I use BurpSuite to intercept the traffic and get the cookies from it

Before run the command, remember to set up a listener on our machine

Command should looks like this

We successfully connected to the user cronus

hashtag
Privilege Escalation

We first get a proper shell by typing

When we type sudo -l, it will show this to us.

Thanks to this websitearrow-up-right that my senior sent to me, I manage to find a suitable command to get root from it

Got root access !

Congratulation!

PreviousSymfonos 1NextSymfonos 3

Last updated