diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_agent_unix-7.0NG.742.tar.gz b/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_agent_unix-7.0NG.742.tar.gz new file mode 100644 index 000000000..9429d47f3 Binary files /dev/null and b/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_agent_unix-7.0NG.742.tar.gz differ diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_console-7.0NG.742.tar.gz b/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_console-7.0NG.742.tar.gz new file mode 100644 index 000000000..9099ef114 Binary files /dev/null and b/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_console-7.0NG.742.tar.gz differ diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_server-7.0NG.742.tar.gz b/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_server-7.0NG.742.tar.gz new file mode 100644 index 000000000..d65654355 Binary files /dev/null and b/modules/vulnerabilities/unix/http/pandora_fms_rce/files/pandorafms_server-7.0NG.742.tar.gz differ diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/install.pp b/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/install.pp new file mode 100644 index 000000000..87a404cc1 --- /dev/null +++ b/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/install.pp @@ -0,0 +1,59 @@ +class pandora_fms_rce::install{ + + $console_package= 'pandorafms_console-7.0NG.742.tar' + $server_package= 'pandorafms_server-7.0NG.742.tar' + $agent_package= 'pandorafms_agent_unix-7.0NG.742.tar' + #pandora denpencies + ensure_packages(['snmp','snmpd','libnet-telnet-perl','libgeo-ip-perl','libtime-format-perl','libxml-simple-perl','libxml-twig-perl','libdbi-perl','libnetaddr-ip-perl','libhtml-parser-perl','xprobe2','nmap','libmail-sendmail-perl','traceroute','libio-socket-inet6-perl','libhtml-tree-perl','libsnmp-perl','snmp-mibs-downloader','libio-socket-multicast-perl','libsnmp-perl','libjson-perl']) + + #lamp dependencies + ensure_packages(['mariadb-server','php-mysqli','php','php-common','php-gmp','php-curl','php-mbstring','php-xmlrpc','php-mysql','php-gd','php-bcmath','php-xml','php-cli','php-zip','php-pear','php-zip','php-sqlite3','php-snmp','graphviz','php-curl','php-ldap','dbconfig-common','unzip','git']) + + + # sets the default paths to use + Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] } + + + # copy archive + file { 'console' : + path => "/usr/local/src/${console_package}.gz", + ensure => file, + source => "puppet:///modules/pandora_fms_rce/${console_package}.gz", + } + file { 'server' : + path => "/usr/local/src/${server_package}.gz", + ensure => file, + source => "puppet:///modules/pandora_fms_rce/${server_package}.gz", + } + file { 'agent' : + path => "/usr/local/src/${agent_package}.gz", + ensure => file, + source => "puppet:///modules/pandora_fms_rce/${agent_package}.gz", + } + + file { '/var/www/html/pandorafms/': + ensure => 'directory', + } + + exec { 'unpack-console': + cwd => '/usr/local/src/', + command => "tar -xf ${console_package}.gz -C /var/www/html/pandorafms/", + creates => '/var/www/html/pandorafms/pandora_console/', + require => File['/var/www/html/pandorafms/'], + } + + exec { 'unpack-server': + cwd => '/usr/local/src/', + command => "tar -xf ${server_package}.gz -C /var/www/html/pandorafms/", + creates => '/var/www/html/pandorafms/pandora_server/', + require => File['/var/www/html/pandorafms/'], + } + + exec { 'unpack-agent': + cwd => '/usr/local/src/', + command => "tar -xf ${agent_package}.gz -C /var/www/html/pandorafms/", + creates => '/var/www/html/pandorafms/pandora_agent/', + require => File['/var/www/html/pandorafms/'], + } + +} \ No newline at end of file diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/lamp.pp b/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/lamp.pp new file mode 100644 index 000000000..fa30ecb01 --- /dev/null +++ b/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/lamp.pp @@ -0,0 +1,154 @@ +class pandora_fms_rce::lamp{ + $db_password = 'db_password' ##$secgen_parameters['db_password'][0] + $db_admin = 'db_admin' ##$secgen_parameters['db_admin'][0] + $db_name = 'pandora'##$secgen_parameters['db_name'][0] + $homedir = '/var/www/html/pandora_console' + $homeurl= '/pandora_console' + $auth= 'mysql' + $host = 'localhost' + $port = '80' + $docroot = '/var/www/html/pandorafms' + + + # sets the default paths to use + Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] } + + + + #set up mysql database + mysql::db { 'pandora_database': + user => $db_admin, + password => $db_password, + dbname => $db_name, + host => $host, + grant => ['ALL'], + sql => ['/var/www/html/pandorafms/pandora_console/pandoradb.sql'], + }-> + #ensure db admin is a privledged user + mysql_grant { "${db_admin}@${host}/*.*": + user => "${db_admin}@${host}", + table => '*.*', + privileges => ['ALL'], + }-> + exec { 'mysqldmin flush-privileges': + command => 'mysqldmin flush-privileges', + logoutput => true + } + + file_line{ 'my.cnf_mysqld': + ensure => present, + path => '/etc/mysql/my.cnf', + line => '[mysqld]', + match => '^\[mysqld\]', + }-> + file_line{ 'my.cnf_sql_mode': + ensure => present, + path => '/etc/mysql/my.cnf', + line => 'sql_mode=NO_ENGINE_SUBSTITUTION', + after => '\[mysqld\]', + }-> + ##TODO confirm charset uploading correctly + exec { 'populate-database': + command => "mysql ${db_name} < ${docroot}/pandora_console/pandoradb_data.sql", + logoutput => true, + + }-> + exec { 'start-database': + command => 'systemctl restart mariadb', + logoutput => true, + } + + file{ 'console-install': + path => "${docroot}/pandora_console/install.php", + ensure => absent, + } + + class { '::apache': + default_vhost => false, + default_mods => ['rewrite'], + overwrite_ports => false, + mpm_module => 'prefork' + } + #pandora configuration file + file { 'console-config.inc.php': + path => "${docroot}/pandora_console/include/config.inc.php", + ensure => present, + content => template('pandora_fms_rce/config.inc.php.erb'), + } + + #update folder permissions + exec { 'chown-pandora': + command => "chown www-data:www-data ${docroot} -R", + }-> + exec { 'chown-pandora-console': + command => "chown www-data:www-data ${docroot}/pandora_console -R", + }-> + exec { 'chown-pandora-permissions': + command => "chown 775 ${docroot}/pandora_console -R", + } + + ::apache::vhost { 'www-pandora': + port => $port, + docroot => "${docroot}/pandora_console", + } + file{ 'remove-default-index': + path => '/var/www/html/index.html', + ensure => absent, + require => Class['::apache'] + } + file{ 'remove-apache2-default-page-enabled': + path => '/etc/apache2/sites-enabled/000-default.conf', + ensure => absent, + require => Class['::apache'] + } + + file{ 'remove-apache2-default-page-available': + path => '/etc/apache2/sites-available/000-default.conf', + ensure => absent, + require => Class['::apache'] + } + + exec { 'restart-apache-pandora': + command => 'systemctl restart apache2', + logoutput => true, + require => [File['remove-default-index'],File['remove-apache2-default-page-enabled'],File['remove-apache2-default-page-available']], + } -> + exec { 'wait-apache-pandora': + command => 'sleep 4', + logoutput => true + } + + + file_line{ 'php.ini-memory_limit': + ensure => present, + path => '/etc/php/7.3/apache2/php.ini', + line => 'memory_limit = 256M', + match => '^memory_limit =', + }-> + file_line{ 'php.ini-upload_max_filesize': + ensure => present, + path => '/etc/php/7.3/apache2/php.ini', + line => 'upload_max_filesize = 100M', + match => '^upload_max_filesize =', + }-> + file_line{ 'php.ini-execution_time': + ensure => present, + path => '/etc/php/7.3/apache2/php.ini', + line => 'max_execution_time = 360', + match => '^max_execution_time =', + }-> + file_line{ 'php.ini-max_input_vars': + ensure => present, + path => '/etc/php/7.3/apache2/php.ini', + line => 'max_input_vars = 2000', + match => '^max_input_vars =', + }-> + file_line{ 'php.ini-date.timezone': + ensure => present, + path => '/etc/php/7.3/apache2/php.ini', + line => 'date.timezone = Europe/Paris', + match => '^date.timezone =', + } + + +} \ No newline at end of file diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/pandora.pp b/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/pandora.pp new file mode 100644 index 000000000..d8b37ad17 --- /dev/null +++ b/modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/pandora.pp @@ -0,0 +1,7 @@ +class pandora_fms_rce::pandora{ + + + + + +} \ No newline at end of file diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/pandora_fms_rce.pp b/modules/vulnerabilities/unix/http/pandora_fms_rce/pandora_fms_rce.pp new file mode 100644 index 000000000..513bd5d8a --- /dev/null +++ b/modules/vulnerabilities/unix/http/pandora_fms_rce/pandora_fms_rce.pp @@ -0,0 +1,7 @@ + +contain pandora_fms_rce::install +contain pandora_fms_rce::lamp +contain pandora_fms_rce::pandora +Class['pandora_fms_rce::install'] -> +Class['pandora_fms_rce::lamp'] -> +Class['pandora_fms_rce::pandora'] \ No newline at end of file diff --git a/modules/vulnerabilities/unix/http/pandora_fms_rce/templates/config.inc.php.erb b/modules/vulnerabilities/unix/http/pandora_fms_rce/templates/config.inc.php.erb new file mode 100644 index 000000000..6ae5e3a72 --- /dev/null +++ b/modules/vulnerabilities/unix/http/pandora_fms_rce/templates/config.inc.php.erb @@ -0,0 +1,37 @@ +"; + $config["dbuser"]="<%=@db_admin%>"; + $config["dbpass"]="<%=@db_passsword%>"; + $config["dbhost"]="<%=@db_host%>"; +// This is used for reporting, please add "/" character at the end + $config["homedir"]="<%=@homedir%>"; + $config["homeurl"]="<%=@homeurl%>"; + $config["auth"]["scheme"] = "<%=@auth%>"; +/** + * Do not display any ERROR + */ +error_reporting(E_ALL); + +// Display ALL errors +// error_reporting(E_ERROR); +$ownDir = dirname(__FILE__).DIRECTORY_SEPARATOR; +require $ownDir.'config_process.php';