Nagios 4.2.2 - Arbitrary Code Execution

Nagios 4.2.2 - Arbitrary Code Execution !/usr/bin/env python Source: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html intro = """\03394m Nagios Core 4.2.0 Curl Command Injection / Code Execution PoC Exploit CVE-2016-9565 nagioscmdinjection.py ver...

Nagios Core Curl Command Injection / Code Execution

/ / / / / / / / / / / / / / / / / / // / / / /// / / / / // / // / // / / / / // / // , / / / ///, /,// // //,///||// // // ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - CVE-2016-9565 - Release date:...

Nagios < 4.2.2 - Arbitrary Code Execution

!/usr/bin/env python Source: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html intro = """\03394m Nagios Core 4.2.0 Curl Command Injection / Code Execution PoC Exploit CVE-2016-9565 nagioscmdinjection.py ver. 1.0 Discovered & Coded by: Dawid Golunsk...

CVE-2016-9566

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565...

Nagios Privilege Escalation Vulnerability

Nagios is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nagios:nagios"; if...

Nagios RCE Vulnerability

Nagios is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nagios:nagios"; ...

Nagios Core < 4.2.2 Curl Command Injection/Code Execution （CVE-2016-9565）

Author: p0wd3r, dawu know Chong Yu 404 security lab Date: 2016-12-15 0x00 vulnerability overview 1. Vulnerability description Nagios is a monitoring of the IT infrastructure program, recently security researchers Dawid Golunski discovered in Nagios Core there is a code execution vulnerability: an...

CVE-2016-9566

A privilege escalation flaw was found in the way Nagios handled log files. An attacker able to control the Nagios logging configuration the 'nagios' user/group could use this flaw to elevate their privileges to root...

Nagios 2.x / 3.x / 4.x Local Privilege Escalation

Exploit : !/bin/bash -p TARGETSERVICE="Nagios" LOWUSER="nagios" TARGETPATH="/usr/local/nagios/var/nagios.lock" BACKDOORSH="/bin/bash" BACKDOORPATH="/tmp/rootbackdoor" PRIVESCLIB="/tmp/privesclib.so" PRIVESCSRC="/tmp/privesclib.c" SUIDBIN="/usr/bin/sudo" function cleanexit Cleanup echo -e "\n+...

CVE-2016-8641

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the...

Nagios 4.2.2 - Local Privilege Escalation

Nagios 4.2.2 - Local Privilege Escalation Affected Product: Nagios 4 Vulnerability Type: root privilege escalation Fixed in Version: N/A Vendor Website: https://www.nagios.com/ Software Link: : https://sourceforge.net/projects/nagios/files/latest/download?source=directory-featured Affected Versio...

Nagios 4.2.2 - Local Privilege Escalation

Affected Product: Nagios 4 Vulnerability Type: root privilege escalation Fixed in Version: N/A Vendor Website: https://www.nagios.com/ Software Link: : https://sourceforge.net/projects/nagios/files/latest/download?source=directory-featured Affected Version: 4.2.2 and prior Tested on: Ubuntu Remot...

Nagios 4.2.2 - Privilege Escalation Exploit

Exploit for linux platform in category local exploits Affected Product: Nagios 4 Vulnerability Type: root privilege escalation Fixed in Version: N/A Vendor Website: https://www.nagios.com/ Software Link: : https://sourceforge.net/projects/nagios/files/latest/download?source=directory-featured...

Nagios Network Analyzer create Cross-Site Request Forgery

A cross-site request forgery vulnerability exists in the create user interface of Nagios Network Analyzer. The vulnerability is due to a lack of CSRF protection on the user creation form in createuser.php. A remote, unauthenticated attacker can exploit this vulnerability by enticing an...

nagios.org XSS vulnerability

Vulnerable URL: https://www.nagios.org/supportMedia/images/banners/splunkv03.swf?clickTAG=javascript:alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 50045 VIP...

Nagios XI 5.2.9 Cross Site Scripting / Open Redirect Vulnerabilities

Exploit for php platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: ============== www.nagios.com Product: ================ Nagios XI v5.2.9 Nagios XI provides network, server, and application monitoring in one easy to configure package along with advanced alerting an...

Nagios XI 5.2.9 Cross Site Scripting / Open Redirect

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAGIOS-XI-V5.2.9-MULTIPLE-VULNERABILITIES.txt + ISR: ApparitionSec Vendor: ============== www.nagios.com Product: ================ Nagios XI v5.2.9 Nagios XI provides network,...

Nagios Network Analyzer Detection (HTTP)

HTTP based detection of Nagios Network Analyzer. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nagios Log Server < 1.4.2 Multiple Vulnerabilities - Active Check

Nagios Log Server is prone to multiple vulnerabilities, including authentication bypass, stored cross-site scripting XSS, inconsistent authorization controls and privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenc...

Nagios Log Server Detection (HTTP)

HTTP based detection of Nagios Log Server. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.107058...