-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Nagios XI 5.5.6 Root Remote Code Execution Module #11987
Conversation
Sorry for the wait. For some reason I ended up going down some silly path trying to install Nagios XI, but it turned out to be actually easy. Anyways, the module works fine for me:
But I'll do a little touch up here and there to clean up the code a little bit (don't worry, just minor stuff!). And then I will land this pull request. Thank you @yaumn. It's a really cool module! :-) |
No problem, thank you for your time! |
Release NotesThe Nagios XI 5.5.6 Root RCE module has been added to the framework. It exploits two vulnerabilities in Nagios 5.5.6. The first is CVE-2018-15708, which allows for unauthenticated remote code execution. The second is CVE-2018–15710, which allows for local privilege escalation. |
Some changes I made:
|
Add Nagios XI 5.5.6 Root Remote Code Execution Module
Verification
To test the exploit, I used Ubuntu 18.04 LTS x64 in a VM and I installed Nagios XI 5.5.6 from the official website (https://www.nagios.com/downloads/nagios-xi/older-releases/).
msfconsole
use exploit/linux/http/nagios_xi_root_rce
set RHOSTS IP
set RSRVHOST IP
exploit
Scenarios