来源

关联漏洞

描述

Zabbix CVE-2024-42327 PoC

介绍

# Zabbix-CVE-2024-42327 PoC 
        _______    ________    ___   ____ ___  __ __        __ __ ___  ________  _____
      / ____/ |  / / ____/   |__ \ / __ \__ \/ // /       / // /|__ \|__  /__ \/__  /
     / /    | | / / __/________/ // / / /_/ / // /_______/ // /___/ / /_ <__/ /  / / 
    / /___  | |/ / /__/_____/ __// /_/ / __/__  __/_____/__  __/ __/___/ / __/  / /  
    \____/  |___/_____/    /____/\____/____/ /_/          /_/ /____/____/____/ /_/   
    
NSFOCUS CERT detected that Zabbix released a security announcement and fixed the SQL injection vulnerability (CVE-2024-42327) of Zabbix server. Due to the SQLi vulnerability in the CUser class in the addRelatedObjects function, attackers with default user permission or API access can call the CUser.get function. This could lead to unauthorized access to sensitive information or the execution of arbitrary SQL statements. The CVSS score is 9.9.

This PoC exploits this sql injection vulnerability, for the time-based SQL injection approach, we need to extract the sessions table from the database to determine if the Admin user is logged in. This script provided a multi-threaded script to expedite the extraction of the admin session for further exploitation. With the API token of the admin user, we proceed to create an item and then we can trigger that item. We then get a reverse shell by sending a payload.

To summarise, this tool extracts the admin session ID (admin_session) with time-based SQL injection using the Zabbix API and then sends a reverse shell command to the target system using this ID. First, the script receives the user's credentials, sends an authentication request to the Zabbix API and receives auth_token. Then, it extracts the admin_session ID using SQL injection. The extracted admin_session ID is used to retrieve the host and interface IDs with the host.get request to the Zabbix API. Finally, an item.create request containing the reverse shell command is sent with the obtained host and interface IDs. In this way, a reverse shell is opened on the target server and a connection is established.

NOTE : Sometimes the admin session value may not be found exactly, for example, it may find 23 characters instead of 32 characters, in this case, the problem will probably be solved when you run the script again.

文件快照

 [4.0K]  /data/pocs/40c4bb9eb4c665a24831aedf7191088a07f362b0
├── [6.8K]  exploit.py
└── [2.3K]  README.md

0 directories, 2 files

备注