{“lastseen”:”2026-01-29T16:32:06″,”description”:”This tool performs static analysis on Zabbix Agent binaries to identify hardcoded OpenSSL paths such as OPENSSLDIR, ENGINESDIR, and MODULESDIR. It leverages strings and radare2 to extract embedded configuration paths, OpenSSL version information, and…”,”published”:”2026-01-29T00:00:00″,”modified”:”2026-01-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Zabbix Agent Binaries 7.4 OpenSSL Path Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:214561″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-27237″],”sourceData”:”=============================================================================================================================================\\n | # Title : Zabbix Agent Binaries 7.4 for Hardcoded OpenSSL Paths and Potential Provider Abuse |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.zabbix.com\/download_agents |\\n =============================================================================================================================================\\n \\n [+] References : \\n \\n [+] Summary : This tool performs static analysis on Zabbix Agent binaries to identify hardcoded OpenSSL paths such as OPENSSLDIR, ENGINESDIR, and MODULESDIR.\\n It leverages strings and radare2 to extract embedded configuration paths, OpenSSL version information, \\n \\t\\t\\t\\t and indicators of dynamic engine or module loading (e.g., CONF_modules_load, ENGINE_by_id, dynamic_path).\\n Based on the extracted data, the script evaluates the potential exploitability of the binary by determining whether \\n \\t\\t\\t\\t the OpenSSL configuration directory may be user-writable, which could allow malicious provider or engine injection via a crafted openssl.cnf.\\n The output includes both human-readable analysis and structured JSON results, making the tool suitable for vulnerability research, C\\n \\t\\t\\t\\t VE validation, and large-scale binary auditing.\\n \\n [+] POC :\\n \\n #!\/usr\/bin\/env python3\\n \\n import subprocess\\n import sys\\n import re\\n import json\\n from pathlib import Path\\n \\n \\n def safe_run(cmd, timeout):\\n try:\\n proc = subprocess.run(\\n cmd,\\n capture_output=True,\\n text=True,\\n timeout=timeout\\n )\\n if proc.returncode != 0:\\n return \\”\\”\\n return proc.stdout\\n except Exception:\\n return \\”\\”\\n \\n \\n def extract_with_strings(binary_path: str) -\\u003e dict:\\n result = {\\n \\”binary\\”: binary_path,\\n \\”openssl_version\\”: None,\\n \\”openssldir\\”: None,\\n \\”enginesdir\\”: None,\\n \\”modulesdir\\”: None,\\n \\”has_conf_modules_load\\”: False,\\n \\”has_engine_by_id\\”: False,\\n \\”has_dynamic_path\\”: False,\\n }\\n \\n output = safe_run([\\”strings\\”, binary_path], 60)\\n \\n if not output:\\n return result\\n \\n version_match = re.search(r’OpenSSL\\\\s+(\\\\d+\\\\.\\\\d+\\\\.\\\\d+[^\\\\s]*)’, output)\\n if version_match:\\n result[\\”openssl_version\\”] = version_match.group(1)\\n \\n for key in (\\”OPENSSLDIR\\”, \\”ENGINESDIR\\”, \\”MODULESDIR\\”):\\n m = re.search(rf'{key}:\\\\s*\\”([^\\”]+)\\”‘, output)\\n if m:\\n result[key.lower()] = m.group(1)\\n \\n result[\\”has_conf_modules_load\\”] = \\”CONF_modules_load\\” in output\\n result[\\”has_engine_by_id\\”] = \\”ENGINE_by_id\\” in output\\n result[\\”has_dynamic_path\\”] = \\”dynamic_path\\” in output\\n \\n return result\\n \\n \\n def extract_with_r2(binary_path: str) -\\u003e dict:\\n result = {\\n \\”binary\\”: binary_path,\\n \\”openssl_version\\”: None,\\n \\”openssldir\\”: None,\\n \\”openssldir_offset\\”: None,\\n \\”enginesdir\\”: None,\\n \\”enginesdir_offset\\”: None,\\n \\”modulesdir\\”: None,\\n \\”modulesdir_offset\\”: None,\\n }\\n \\n def parse_izz(keyword):\\n out = safe_run([\\”r2\\”, \\”-q\\”, \\”-c\\”, f\\”izz~{keyword}\\”, binary_path], 120)\\n for line in out.splitlines():\\n if keyword in line:\\n m = re.search(r’0x([0-9a-fA-F]+)\\\\s+0x([0-9a-fA-F]+).*?(\\”.*\\”)’, line)\\n if m:\\n return m.group(2), m.group(3)\\n return None, None\\n \\n off, val = parse_izz(\\”OPENSSLDIR\\”)\\n if val:\\n result[\\”openssldir_offset\\”] = f\\”0x{off}\\”\\n d = re.search(r’\\”([^\\”]+)\\”‘, val)\\n if d:\\n result[\\”openssldir\\”] = d.group(1)\\n \\n off, val = parse_izz(\\”ENGINESDIR\\”)\\n if val:\\n result[\\”enginesdir_offset\\”] = f\\”0x{off}\\”\\n d = re.search(r’\\”([^\\”]+)\\”‘, val)\\n if d:\\n result[\\”enginesdir\\”] = d.group(1)\\n \\n off, val = parse_izz(\\”MODULESDIR\\”)\\n if val:\\n result[\\”modulesdir_offset\\”] = f\\”0x{off}\\”\\n d = re.search(r’\\”([^\\”]+)\\”‘, val)\\n if d:\\n result[\\”modulesdir\\”] = d.group(1)\\n \\n ver = safe_run([\\”r2\\”, \\”-q\\”, \\”-c\\”, \\”izz~OpenSSL\\”, binary_path], 120)\\n m = re.search(r’OpenSSL\\\\s+(\\\\d+\\\\.\\\\d+\\\\.\\\\d+[^\\\\s\\”]*)’, ver)\\n if m:\\n result[\\”openssl_version\\”] = m.group(1)\\n \\n return result\\n \\n def analyze_vulnerability(result: dict) -\\u003e dict:\\n vuln = {\\n \\”vulnerable\\”: False,\\n \\”exploitability\\”: \\”unknown\\”,\\n \\”openssl_cnf_path\\”: None,\\n \\”engine_dll_path\\”: None,\\n \\”notes\\”: []\\n }\\n openssldir = result.get(\\”openssldir\\”)\\n enginesdir = result.get(\\”enginesdir\\”)\\n \\n if not openssldir:\\n vuln[\\”notes\\”].append(\\”OPENSSLDIR not found\\”)\\n return vuln\\n \\n vuln[\\”openssl_cnf_path\\”] = openssldir.rstrip(\\”\/\\\\\\\\\\”) + \\”\/openssl.cnf\\”\\n vuln[\\”engine_dll_path\\”] = enginesdir\\n \\n path = openssldir.lower()\\n \\n user_writable_hint = any(x in path for x in (\\”vcpkg\\”, \\”users\\”, \\”home\\”, \\”usr\\\\\\\\local\\”, \\”usr\/local\\”))\\n \\n if user_writable_hint and result.get(\\”has_conf_modules_load\\”):\\n vuln[\\”vulnerable\\”] = True\\n vuln[\\”exploitability\\”] = \\”potentially_user_writable\\”\\n vuln[\\”notes\\”].append(\\”Writable-looking OPENSSLDIR with module loading enabled\\”)\\n \\n if result.get(\\”has_engine_by_id\\”):\\n vuln[\\”notes\\”].append(\\”ENGINE_by_id present (engine loading supported)\\”)\\n \\n if \\”program files\\” in path:\\n vuln[\\”exploitability\\”] = \\”requires_admin\\”\\n vuln[\\”notes\\”].append(\\”Protected directory (Program Files)\\”)\\n \\n return vuln\\n \\n \\n def main():\\n if len(sys.argv) \\u003c 2:\\n print(f\\”Usage: {sys.argv[0]} \\u003cbinary\\u003e […]\\”)\\n sys.exit(1)\\n \\n results = []\\n \\n for binary in sys.argv[1:]:\\n if not Path(binary).exists():\\n print(f\\”File not found: {binary}\\”, file=sys.stderr)\\n continue\\n \\n r2 = extract_with_r2(binary)\\n s = extract_with_strings(binary)\\n \\n for k in (\\”openssl_version\\”, \\”openssldir\\”, \\”enginesdir\\”, \\”modulesdir\\”):\\n if not r2.get(k):\\n r2[k] = s.get(k)\\n \\n r2.update({\\n \\”has_conf_modules_load\\”: s[\\”has_conf_modules_load\\”],\\n \\”has_engine_by_id\\”: s[\\”has_engine_by_id\\”],\\n \\”has_dynamic_path\\”: s[\\”has_dynamic_path\\”],\\n })\\n \\n r2[\\”vulnerability\\”] = analyze_vulnerability(r2)\\n results.append(r2)\\n \\n print(json.dumps(r2, indent=2))\\n \\n print(\\”\\\\n— JSON Output —\\”)\\n print(json.dumps(results, indent=2))\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\n \\n \\t\\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214561″,”cvss”:{“score”:7.3,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:L\/AC:L\/AT:P\/PR:L\/UI:N\/VC:H\/SC:N\/VI:H\/SI:N\/VA:H\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214561\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-29T16:32:06″,”description”:”This tool performs static analysis on Zabbix Agent binaries to identify hardcoded OpenSSL paths such as OPENSSLDIR, ENGINESDIR, and MODULESDIR. It leverages strings and radare2…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,47,12,15,13,53,7,11,5],"class_list":["post-38150","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-73","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n