HackMD
Pandora Walkthrough - Hack The
In this box, I got to learn about SNMP exploitation and sqlmap. Also we have to do priviledge escalation to gain root.
Enumaration
nmap
After running the Nmap scan, i found that only port 22 (ssh) and 80 (http) were open as you can see.
I decided to visit the site and see if there was something interesting in it
After looking around, i found nothing interesting. I did a directory bruteforce using feroxburster but nothing worked.
After some time of thinking, i decided to do a UDP nmap scan and see if there are services that are running.
I found that only port 161 running snmpwas open and not filtered.
I did a deep scan on the port, to see what version of snmp was runing.
we can see that the bo is running SNMPv1.
Understanding SNMP
SNMP stands for simple ntework management protocol. Used for network management and monitoring.
After some research about SNMP, I learned that, for one to retrieve information from a machine running SNMP, one sends a requestor GET along with a string to authenticate it.
SNMP, uses two strings to authenticate itself. The string is refered to as community string. The community string, they are unhashed and can be easily cracked. There are two types of this strings; readonly string and the write only string.
Finding snmp community string
To find this string, we can use a tool called onesixtyone to bruteforce it using a wordlist.
We found the community string to this machine that is public
Exploiting SNMP
After successfully retrieving the community string, we can now retrieve some info from the machine with snmpwalk.
After analysing my out put in ape.txt, I found a username and password that I can use to ssh into the machine. Remember that snmp is unencrypted so information are in plain text.
After I ssh in the machine, i realised that there was another account matt with the user.txt but i cannot access it. I also realised that there is another website from /etc/hosts
For us to visit this webpage, we will have to use a dynamic tunnel using ssh since it is running locally and not available to the public.
This can be done using this command: ssh -D 8080 daniel@10.10.11.136. Using the generated tunnel, we can set up a SOCKS5 proxy that supports DNS resolution to view the website.
Now navigating to http://127.0.0.1/pandora_console/ from my machine, I land to the website.
We can see that the page, uses some software called Pandora FMS. I looked it up on the internet and luckily, I found that it had CVE's(here) available.
As shown in the article, the chart_generator.php file's session_id parameter, is vulnerable. Now I will run a SQLi with proxychain against the chart generator file. But file, I will have to cofigure /etc/proxychains4.conf file so as to enable proxy and our dynamic socks5 tunnel.
Then use the below command to run the sqli attack.
The table that is really important, is tpassword_history. Here we can find the hashes for matt and daniel. Looking at the harshes, they are md5.
I also did a futher attack on the tsession_php table to get the php session ids stored.
I just added the id to the url, visiting it, we get access granted and a blank white page. Going back to the fms login page, I was automatically logged in as matt with admin privilledges.
Accessed as matt
Now we have to get a way to exploit a reverse shell.
Getting Reverse shell
Looking at the Pandora FMS CVE-2020-5544 we can see that all the exploits require file upload, in order to get RCE.
I interacted with the tool and lucky, I found a file manager section that allows a file upload. I just got a webshell file online and uploaded it.
Lets visit the php file we uploaded
And yes, we got a shell. Now I connected it to my machine using netcat listener on port 4242 as shown below
listening using nc -nvlp 4242
we get a connection back. Lets now read the user hash.
Priviledge escalation
For a nice and stable shell, we can copy the machiens id_rsa, and use ssh to login.
Searching for a while, usign find command to seacrh for files with Setuid permisions, We can see one that seems interesting/usr/bin/pandora_backup.
After running the file /usr/bin/pandora_backup and analysing it, we see that its using tar to compress the PandoraFSM.
So lets try to poison the path and run the file again to escalate our privileges.
Congratulations!!! Pandora has been pwned
Finally we solved the lab and thank you so much for your time, if you liked this writeup and you feel it’s helpful then please share it with your friends.
Happy hacking!
