> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/pandora.md). # Pandora ## Gaining Access Nmap scan results: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f817dc0ec67e69de834ae1672ec94bc424ce1046%2Fimage.png?alt=media) ### Port 80 The website was some form of corporate website. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-aac63636f4a4d8164a681cd39dfbfb6d5344bb5d%2Fimage.png?alt=media) However, checking for directories or other web exploits was rather unsuccessful, as I did not find anything of use. ### SNMP Because we couldn't find anything with the TCP ports, we could enumerate the UDP ports and hopefully find something: ``` $ sudo nmap -sU -top-ports=100 panda.htb Starting Nmap 7.80 ( https://nmap.org ) at 2022-03-28 06:00 EDT Nmap scan report for panda.htb (10.10.11.136) Host is up (0.089s latency). Not shown: 99 closed ports PORT STATE SERVICE 161/udp open snmp Nmap done: 1 IP address (1 host up) scanned in 95.71 seconds ``` So port 161 for SNMP was open. We can then use `snmpwalk` to enumerate this further. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b95253e9e88449acc9c8e092f9a85f245d61701d%2Fimage.png?alt=media) Redirecting this output to a file, I was able to find some credentials within the contents: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-71c64fe519aa524944ec6c37919c6a725ca425b3%2Fimage.png?alt=media) With these credentials, we can SSH in as the `daniel` user. ## Privilege Escalation ### Pandora FMS As Daniel, we didn't have much permissions over the machine. However, we were able to head to the `/var/www/pandora` directory to find another potential website that was up: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ddbb1fafecca816a83b7c257945bbea681f90ecd%2Fimage.png?alt=media) Checking the apache2 config files reveals that the user `matt` was running the other web server: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-eaab44b4302a88d87cd4985b65f95a1b44a87739%2Fimage.png?alt=media) So, I started an SSH tunnel using the credentials for `daniel`, and we can forward port 80 to our machine. ```bash ssh -L 4444:127.0.0.1:80 daniel@pandora.htb ``` ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-fdf1fefe67b2c9a64e5753a4399d97b9b78a0b37%2Fimage.png?alt=media) ### Upgrade Session We can enumerate from the machine that this was a Pandora FMS instance. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b628bd5a2055903242fa75c8925f14ce620be421%2Fimage.png?alt=media) Pandora FMS was vulnerable to many types of exploits, one of which was CVE-2021-32099, which would leverage SQL Inejction on the `/include/chart_generator.php` endpoint to bypass authentication and allow attackers to login as the admin. {% embed url="" %} Then, we would gain access to the Pandora Dashboard. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f877dbe76760e3f65d81411578949db081db4947%2Fimage.png?alt=media) ### RCE as Matt I did more research and found this repository, which allowed us to make use of the SQL Injection to upload any web shell of our choosing to the server: ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b1c14f52fac6fd321439c843dd911fa0ac07bae4%2Fimage.png?alt=media) Then, we can gain a reverse shell via a Python3 shell. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1bb18f86b9ba71862eede2f7eab2d2d94bc14273%2Fimage.png?alt=media) ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cd0e73818da15701f5ac70922ca010e9718161de%2Fimage.png?alt=media) ### Exploiting PATH I ran another LinPEAS as `matt`, and found that the root user was running some processes. ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-efaf9cd6ce7e3bce1acba44d1635c1315fc46995%2Fimage.png?alt=media) I also found this one SUID binary called `pandora_backup`. ```bash $ find / -perm -4000 -ls 2>/dev/null 264644 164 -rwsr-xr-x 1 root root 166056 Jan 19 2021 /usr/bin/sudo 265010 32 -rwsr-xr-x 1 root root 31032 May 26 2021 /usr/bin/pkexec 267386 84 -rwsr-xr-x 1 root root 85064 Jul 14 2021 /usr/bin/chfn 262764 44 -rwsr-xr-x 1 root root 44784 Jul 14 2021 /usr/bin/newgrp 267389 88 -rwsr-xr-x 1 root root 88464 Jul 14 2021 /usr/bin/gpasswd 264713 40 -rwsr-xr-x 1 root root 39144 Jul 21 2020 /usr/bin/umount 262929 20 -rwsr-x--- 1 root matt 16816 Dec 3 15:58 /usr/bin/pandora_backup ``` Running `pandora_backup` would call `tar` as per the process we found. The fact that `tar` did not use the absolute path means that we can create our own malicious `tar` script that would give us RCE as root because an SUID binary was in use here. We can run these commands for a shell: ```bash cp /bin/bash tar chmod 777 tar export PATH=$(pwd).$PATH pandora_backup ``` ![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-244d1184b0845bbd0763ece9e0de1bbb6cfb27b5%2Fimage.png?alt=media)