# Symfonos: 2 - Walkthrough

### Machine Details
#### Name: Symfonos 2
#### OS: Linux
#### Platform: [Vulnhub](https://www.vulnhub.com)
#### Download Link: [Symfonos 2](https://www.vulnhub.com/entry/symfonos-2,331/)

___

### Getting started
I booted up the machine and got assigned an IP addres of 192.168.50.130. Similar to [symfonos1](https://hackmd.io/@rudefish/vulnhub-symfonos-series-symfonos1-walkthrough), I added symfonos2.local to my hosts file.

192.168.50.130 symfonos2.local

I proceeded to run a quick nmap scan on the target and obtained the result below.


### Paying a visit to Port 80
I opened the target on the browser and I was presented with the following page:


I ran directory enumeration on the target using dirb, but I did not obtain much result.


### The Good Old SMB
SMB service is also running on the target and it allows anonymous share. I connected to it and downloaded a log.txt file in the backups folder.


The log.txt file has a whole bunch of text, but what I was able to extract from it is a username: `aeolus`.

### Force them all
Checking back on my brute force running in the background. I obtained a password.

aeolus:sergioteamo


Using these creds, I was able to login via SSH. Now that I am in, first thing I did was to check if I can execute commands using sudo.


Well, that was painful xD.

### More Enumeration
Enumerating further, I checked the listening connections on the box and observed a service running locally on 127.0.0.1:8080

ss -lntp


Using my current SSH connection, I tunneled the port to my local machine.


Visting the forwarded port on my local machine in the browser, I was presented with a new page running LibreNMS and I was able to login using `aeolus` credentials.



Searching on Google about LibreNMS exploit shows it is vulnerable to an Authenticated Remote Code Execution as seen [here](https://www.exploit-db.com/exploits/47044).

### Way to ROOT!
Following the exploit code and supplying the required parameters, I obtained a reverse shell as the root user. To stabilize my shell, I added my public SSH key to the box and logged in as root.


Hope you enjoyed reading! See you in the next one.

###### tags: `symfonos` `vulnhub` `proftpd` `smb` `librenms`