Pandora

We would be attacking the HackTheBox Pandora Machine

Definitely starting with an nmap scan

Webpage on port 80 looks quite empty, safe some email addresses.

Now we do a full nmap scan & udp port scan

we find snmp service running on Udp port 161 open;

Enumerating udp port 161 with snmpwalk tool;

We can get username & password from snmp

now we use found creds to login ssh as daniel user

Password here;

We get ssh access & we find linpeas to escalate our privileges as daniel to root user;

We find the system vulnurable to pwnkit CVE-2021-4034;

changing our directory to the /tmp/dm0220 we find the pwnkit exploit lying around

Exploiting pwnkit CVE-2021-4034 to get root!

We become root now & can read both root.txt from root user & user.txt from the user matt

###RESOURCES

https://app.hackthebox.com/machines/Pandora