module

Nagios XI Autodiscovery Webshell Upload

Try Surface Command
Back to search
Disclosed
Jul 15, 2021
Created
Feb 12, 2022

Description

This module exploits a path traversal issue in Nagios XI before version 5.8.5 (CVE-2021-37343).
The path traversal allows a remote and authenticated administrator to upload a PHP web shell
and execute code as `www-data`. The module achieves this by creating an autodiscovery job
with an `id` field containing a path traversal to a writable and remotely accessible directory,
and `custom_ports` field containing the web shell. A cron file will be created using the chosen
path and file name, and the web shell is embedded in the file.

After the web shell has been written to the victim, this module will then use the web shell to
establish a Meterpreter session or a reverse shell. By default, the web shell is deleted by
the module, and the autodiscovery job is removed as well.

Authors

Claroty Team82
jbaines-r7

Platform

Linux,Unix

Architectures

cmd, x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/http/nagios_xi_autodiscovery_webshell
    msf exploit(nagios_xi_autodiscovery_webshell) > show targets
        ...targets...
    msf exploit(nagios_xi_autodiscovery_webshell) > set TARGET < target-id >
    msf exploit(nagios_xi_autodiscovery_webshell) > show options
        ...show and set options...
    msf exploit(nagios_xi_autodiscovery_webshell) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today