HTB: Pandora

Wed, 03 Jun 2026 00:00:00 +0000

Linux Easy. The TCP scan gives you almost nothing: SSH on 22 and a static company landing page on 80. The UDP scan is where things get interesting. SNMP is running with the default “public” community string, and the process argument table has host_check running with credentials directly in its parameters. That’s your SSH login.

Once inside as daniel, you’re not the user that holds the flag. A second user, matt, owns the Pandora FMS monitoring console that’s locked behind a localhost-only virtual host. Getting into that console doesn’t require a valid password: an unauthenticated SQLi lets you dump active PHP sessions and just cookie yourself in as matt. From there, an authenticated RCE via event response drops a reverse shell.

Path-Hijack on kanyo's blog

HTB: Pandora