{"uuid": "51fd187a-b580-46ed-ac6d-20c914ae2725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/81238", "content": "Hacking Articles\nPandora HackTheBox Walkthrough\n\nSummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results. Then we will dig into SNMP protocol and find out very interesting information for us which will lead us to an initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on the target\u2019s internal port. Then we will exploit the admin console which is vulnerable to SQL injection and upload a malicious file to get a reverse shell as a different user. In the post-exploitation phase, we will abuse the SUID binary using path hijacking technique. Table of ContentInitial Access\n\n* TCP Port Scan\n* Enumeration\n* UDP Port Scan\n* SNMP Enumeration\n* User Shell as Daniel\n\nHorizontal Privilege Escalation\n\n* Enumeration\n* Port Forwarding\n* CVE-2021-32099 SQL injection Exploitation\n* File Upload\n* User Flag\n\nPrivilege Escalation\n\n* SSH Key Generate\n* SUID Path hijack\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.\n\nFlags features:\n\n-sC\u00a0\u00a0 : Scans with default NSE scripts\n\n-sV\u00a0\u00a0 :\u00a0 Attempts to determine the service version\n\nCommand used:\nnmap -sC -sV 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png?w=640&ssl=1 \n\nFrom the nmap scan, we have found there were only two ports open, which are port 80 and port 22. As usual HTTP service is running on port 80 and the SSH service is running on port 22. Http service is used for Webhosting and the SSH service is used for remote connection. SSH version is the latest and does not look vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. EnumerationWe begin enumeration by accessing port 80 over the browser. The webpage does not have many interesting things, but we can see the domain name is available there which is Panda.htb. Next thing we can analyse what this website is made for, and what it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and network monitoring solutions.\nhtttp://10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png?w=640&ssl=1 UDP Port Scan Got stuck for some time as we did not get any lead to get a foothold into the target system, we decided to perform a UDP port scan. When we do a normal nmap scan, it only scans TCP ports but not UDP so many time UDP ports may lead us to interesting findings. After the completion of the UDP port scan, we found that SNMP port is open on its default port which is port 161. Now we can go for further enumeration against the SNMP port but let\u2019s talk about SNMP first.\n\nWhat is SNMP and what it is used for?\n\nSimple Network Management Protocol (SNMP) is a networking protocol used for the monitoring and management of the network-connected end devices in the internet protocol netwo[...]", "creation_timestamp": "2026-09-01T20:01:13.182021Z"}