Pandora — HTB Writeup | The Hack Sparrow

Executive summary — Pandora punishes lazy recon: the public web server on port 80 is an untouched Bootstrap template, a total decoy. The real vector sits on 161/UDP, where SNMP with the default community public leaks, through hrSWRunParameters, the full command line of a running process — credentials included. From there, a reused SSH login leads to an internal vhost bound to localhost running Pandora FMS 7.0NG.742, vulnerable to CVE-2021-32099 (a pre-authenticated SQL injection that forges an admin session). With that session, the panel's file manager uploads a webshell with no extension filter at all, and a SUID backup binary with a relative-path system() call — plus a setreuid() with swapped arguments — closes the chain with root.

Platform	Hack The Box
Operating system	Linux (Ubuntu 20.04 LTS "Focal Fossa")
Difficulty	Easy
Status	Retired
Target IP	`10.129.59.207`

Attack map

[161/UDP] SNMP community "public" — hrSWRunParameters exposes process argv
   │  cleartext leak: daniel:HotelBabylon23
   ▼
[22] SSH — daniel (uid 1001)
   │  /etc/apache2/sites-enabled/pandora.conf: vhost pandora.panda.htb
   │  bound to localhost:80, PHP runs as matt (AssignUserID)
   ▼
[SSH -L 8000:127.0.0.1:80]  tunnel into the internal vhost
   │  Pandora FMS 7.0NG.742 — CVE-2021-32099
   │  SQLi in chart_generator.php -> session_decode() -> forged admin $_SESSION
   ▼
[RCE]  admin file manager uploads a .php webshell, no extension filter
   │
   ▼
[www]  uid=1000(matt)  ⇒ user.txt
   │  SUID /usr/bin/pandora_backup -> system("tar ...") with no absolute path
   │  PATH hijack + setreuid(0,1000) with swapped arguments -> ruid=0
   ▼
[ROOT]  bash without -p does setuid(getuid())=setuid(0) -> euid=0  ⇒ root.txt

1. Reconnaissance

ping -c 2 -W 3 10.129.59.207

PING 10.129.59.207 (10.129.59.207) 56(84) bytes of data.
64 bytes from 10.129.59.207: icmp_seq=1 ttl=63 time=37.1 ms
64 bytes from 10.129.59.207: icmp_seq=2 ttl=63 time=36.6 ms

A ttl=63 is an initial 64 (Linux/BSD) minus the single VPN hop of HTB: the target is Linux before a single scan runs, which already narrows down wordlists and escalation techniques worth prioritizing.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.59.207

Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

closed (reset) on the remaining 65,533 ports means nothing is filtering: the TCP surface is genuinely exhausted with just those two ports. If the vector isn't there, it isn't in TCP at all.

sudo nmap -p22,80 -sCV -oN scans/services.txt 10.129.59.207

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Play | Landing

OpenSSH 8.2p1 + Apache 2.4.41 pins Ubuntu 20.04 LTS. Neither version has a known pre-auth RCE, so the path runs through content, not server software. The page's <head> confirms the suspicion: it's UIdeck's free "Play" template, with not a single dynamic file. A feroxbuster pass with several wordlists (directories, extensions php,html,txt) and a vhost fuzz against *.htb both come back empty — only the template's static assets.

With TCP exhausted, UDP is next — the step a plain nmap never covers, since it needs explicit -sU:

sudo nmap -sU --top-ports 100 -T4 -Pn -oN scans/udp.txt 10.129.59.207

Not shown: 58 closed udp ports (port-unreach), 41 open|filtered udp ports (no-response)
PORT    STATE SERVICE
161/udp open  snmp

161/udp answers unambiguously (unlike the 41 open|filtered ports, reached by elimination): there's an SNMP daemon listening, and that's the real entry vector.

Resumen ejecutivo — Pandora castiga el reconocimiento perezoso: la web pública en el puerto 80 es una plantilla Bootstrap sin tocar, un señuelo total. El vector real está en 161/UDP, donde SNMP con la community por defecto public filtra, a través de hrSWRunParameters, la línea de comandos completa de un proceso — credenciales incluidas. Desde ahí, un SSH reutilizado lleva a un vhost interno atado a localhost que ejecuta Pandora FMS 7.0NG.742, vulnerable a CVE-2021-32099 (inyección SQL preautenticada que permite forjar una sesión de administrador). Con esa sesión, el gestor de ficheros del panel sube una webshell sin ningún filtro de extensión, y un binario SUID de backup con un system() de ruta relativa — y un setreuid() con los argumentos invertidos — cierra la cadena con root.

Plataforma	Hack The Box
Sistema operativo	Linux (Ubuntu 20.04 LTS "Focal Fossa")
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.59.207`

Mapa del ataque

[161/UDP] SNMP community "public" — hrSWRunParameters expone argv de procesos
   │  fuga en claro: daniel:HotelBabylon23
   ▼
[22] SSH — daniel (uid 1001)
   │  /etc/apache2/sites-enabled/pandora.conf: vhost pandora.panda.htb
   │  ligado a localhost:80, PHP corre como matt (AssignUserID)
   ▼
[SSH -L 8000:127.0.0.1:80]  túnel hacia el vhost interno
   │  Pandora FMS 7.0NG.742 — CVE-2021-32099
   │  SQLi en chart_generator.php -> session_decode() -> $_SESSION admin forjada
   ▼
[RCE]  gestor de ficheros (admin) sube webshell .php sin filtro de extensión
   │
   ▼
[www]  uid=1000(matt)  ⇒ user.txt
   │  SUID /usr/bin/pandora_backup -> system("tar ...") sin ruta absoluta
   │  PATH hijack + setreuid(0,1000) con argumentos invertidos -> ruid=0
   ▼
[ROOT]  bash sin -p hace setuid(getuid())=setuid(0) -> euid=0  ⇒ root.txt

1. Reconocimiento

ping -c 2 -W 3 10.129.59.207

PING 10.129.59.207 (10.129.59.207) 56(84) bytes of data.
64 bytes from 10.129.59.207: icmp_seq=1 ttl=63 time=37.1 ms
64 bytes from 10.129.59.207: icmp_seq=2 ttl=63 time=36.6 ms

Un ttl=63 es un 64 inicial (Linux/BSD) menos el único salto de la VPN de HTB: el objetivo es Linux antes de lanzar un solo escaneo, lo que ya condiciona wordlists y técnicas de escalada a priorizar.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.59.207

Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

closed (reset) en los 65.533 puertos restantes significa que no hay firewall filtrando: la superficie TCP está realmente agotada con esos dos puertos. Si el vector no aparece ahí, hay que salir de TCP.

sudo nmap -p22,80 -sCV -oN scans/services.txt 10.129.59.207

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Play | Landing

El par OpenSSH 8.2p1 + Apache 2.4.41 fija Ubuntu 20.04 LTS. Ninguna versión tiene un RCE preautenticado conocido, así que el camino pasa por el contenido, no por el software del servidor. El <head> de la web confirma la sospecha: es la plantilla gratuita "Play" de UIdeck, sin un solo fichero dinámico. Un feroxbuster con varias wordlists (directorios y extensiones php,html,txt) y un fuzzing de vhosts contra *.htb devuelven cero — solo los assets estáticos de la plantilla.

Agotada la superficie TCP, toca UDP — el paso que un nmap normal jamás cubre porque hace falta -sU explícito:

sudo nmap -sU --top-ports 100 -T4 -Pn -oN scans/udp.txt 10.129.59.207

Not shown: 58 closed udp ports (port-unreach), 41 open|filtered udp ports (no-response)
PORT    STATE SERVICE
161/udp open  snmp

161/udp responde de forma inequívoca (no por descarte, como los 41 puertos open|filtered): hay un demonio SNMP escuchando, y ahí está el vector real de entrada.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.