Pandora - Hackthebox OSCP Prep TJ Nulls

Channel:

NoxLumens

Subscribers:

1,270

Published on April 4, 2024 7:00:21 PM ● Video Link: https://www.youtube.com/watch?v=OzXLcOzxn0g

Duration: 49:25

485 views

16

Pandora is an easy rated Linux machine. The port scan reveals a SSH, web-server and SNMP service running on the box. Initial foothold is obtained by enumerating the SNMP service, which reveals cleartext credentials for user daniel . Host enumeration reveals Pandora FMS running on an internal port, which can be accessed through port forwarding. Lateral movement to another user called matt is achieved by chaining SQL injection & RCE vulnerabilities in the PandoraFMS service. Privilege escalation to user root is performed by exploiting a SUID binary for PATH variable injection

Skills Required
Basic Linux Knowledge
Virtual Host Enumeration
------------------
Skills Learned
SNMP enumeration
Port forwarding
SQL injection
Lateral movement
Reversing
PATH variable injection
------------------
Tools
manual enumeration
snmpwalk
ltrace
CVE-2021-32099
ssh-keygen
------------------
My Certifications:
Practical Network Penetration Tester (PNPT) : TCM Security - https://certifications.tcm-sec.com/pnpt/
Practical Junior Penetration Tester (PJPT): TCM Security - https://certifications.tcm-sec.com/pjpt/
Practical Junior Web Tester (PJWT): TCM Security - https://certifications.tcm-sec.com/pjwt/
Certified Ethical Hacker (CEH): EC-Council
--------------------
Socials:
Tryhackme: https://tryhackme.com/p/NoxLumens
Hackthebox: https://app.hackthebox.com/profile/179139
Twitch: https://twitch.tv/noxlumens