Week 2. Monitored
TL;DR
This is a Debian machine owned by an IT team that runs a Nagios application used for network monitoring purposes. SNMP is also running on the host for maintenance purposes, and the public tree leaks credentials for the Nagios core. These credentials can be used to get an authentication token using the API which will be subsequently used to exploit an SQLi vulnerability affecting the installed Nagios version. SQLi allows dumping the database and retrieve the admin API key that we use to create our own admin user and get the user flag. For escalation, we abuse a writable binary found in the file system which run as root.
KEYWORDS
Nagios, ffuf enumeration, CVE-2023-40931, LDAP, SNMP, token authentication, SQLi, binary hijacking escalation.
REFERENCES
https://www.cvedetails.com/cve/CVE-2023-40931
https://rdgroup.co.za/2018/07/10/nagios-xi-5-5-is-here
https://support.nagios.com/forum/viewtopic.php?p=331071#p331071
https://www.exploit-db.com/exploits/44560
ENUMERATION
Port scan.
> nmap $target -p- -T4 -Pn --open --reason
Nmap scan report for 10.10.11.248
Host is up, received user-set (0.057s latency).
Not shown: 63049 closed tcp ports (conn-refused), 2481 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
389/tcp open ldap syn-ack
443/tcp open https syn-ack
5667/tcp open unknown syn-ack
Nmap done: 1 IP address (1 host up) scanned in 33.02 secondsEnumerate the open ports.
Enumerating the web server with Firefox, we find out a Nagios Xi login portal running at https://nagios.monitored.htb/nagiosxi. Nagios is an IT tool dedicated to monitor infrastructure components such as applications, OSes, networks and system metrics.
Let's start bruteforcing directories with ffuf. In the https://nagios.monitored.htb/nagiosxi directory we find out directories /terminal and /api
Fuzz again the /api folder to discover endpoints.
Continue finding endpoints by bruteforcing the /api/v1 folder.
Take note of the /api/v1/authenticate endpoint and move along. Now, bruteforce the web root folder at https://nagios.monitored.htb, to find another login portal (code 401) at https://nagios.monitored.htb/nagios
With this, we can consider the web enumeration over. Now we'll continue enumerating LDAP.
It seems SNMP is running in the host, we can confirm it with an UDP scan on port 161.
Best way to continue enumerating the public SNMP tree is to use the snmpwalk tool. The output provided is very large and supplies huge amount of information, among other, a list of running processes.
There are calls to a local shell script check_host.sh along with what seems to be a credential svc:XjH7VCehowpR1xZB
At this point we finish the enumeration phase. Let's do a summary of what we have found so far:
A Nagios network monitoring tool is running on port 80.
There are 3 login pages running at:
Additionally, an authentication endpoint is available at: https://nagios.monitored.htb/nagiosxi/api/v1/authenticate
Finally, enumerating LDAP and SNMP we have found what seem to be a password (
XjH7VCehowpR1xZB) for usersvc
USER
Looking for Nagios vulnerabilities, we come across this one: https://www.cvedetails.com/cve/CVE-2023-40931
It seems ID parameter in https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php is vulnerable to SQLi. However, we must be authenticated to launch this attack, so we need to be logged into the Nagios tool before trying the injection.
If we remember, we have already found credentials svc:XjH7VCehowpR1xZB. The credential do not work in Nagios Xi portal https://nagios.monitored.htb/nagiosxi.login.php (an "User disabled" error is returned).
Access is granted though in the Nagios core login at https://nagios.monitored.htb/nagios; however, nothing useful can be found here.
According to Nagios documentation (https://rdgroup.co.za/2018/07/10/nagios-xi-5-5-is-here/), user and password could theoretically be be used to login sending a POST request to the /api/v1/authenticate endpoint.
I unsuccessfully tried to do so with Burpsuite and Postman, but finally found instructions in the Nagios support forum (https://support.nagios.com/forum/viewtopic.php?p=331071#p331071) to authenticate using curl
The following command performs the authentication and a token is received.
In summary, although the svc account is disabled in the web login, it seems the API is still supplying tokens for this account when queried with curl. We can take advantage of this now and launch the SQLi attack with sqlmap and passing the token as argument.
You have to patiently dump the databases and tables until you find the right one. In the process the token may expire so you may need to request a new one. Eventually, you end up finding an API key for user admin on the nagiosxi database and xi_users table.
We can use this API key to add a new admin user. In this exploit https://www.exploit-db.com/exploits/44560 I found out the API endpoint and the parameters to do so.
Tips: make sure an user_id is received, if null is received your user has not been correctly created and you won't be able to use it. If that's the case, try changing paramenters; for example, in my case I found out the email had to finish in @localhost for the user to be correctly created.
Now you can login into the Nagios Xi login site with your new admin account.
In the dashboard, navigate to Configure (top menu) -> Advanced configuration -> Commands -> Add new. Alternatively, you can edit an already existing command. In the command line field type a command to send a reverse shell to your attacker machine.
Click on "Apply Changes" to save the command. Note: I constantly received error when trying to apply changes; however, after checking the history, I found out that as long as the command.cfg file is correctly saved, everything will be ok.
To issue the command navigate to Monitoring -> Hosts -> Run check command. Start a listener and launch the command, a reverse shell is received, and you can get the user flag.
ROOT
Check current user's sudo configuration.
It seems the user can start/stop services nagios and npcd as root without supplying a password. Enumerate the binaries related to the nagios and npcd services.
Turns out we have writable access to the npcd binary. Stop the service using the shell script.
Now edit the npcd file contents and add command to send a reverse shell.
Launch a listener on port 9001 and start the npcd service using the script, a root reverse shell is received.
Last updated