The issue of 10.0.20

[t101804]

in GLPI 10.0.20 with the super admin privilages still cant obtain rce or similiar?

[t101804]

my idea we can do rce on the connected computer by deploying a task into the agent that connected, is that possible?

[Guilhem7]

Humm, that's an interesting idea.
In fact you can requests agent to do some tasks such as 'inventory' or even other thing if agent's plugins are enabled.

However, there is no way (for what I know) to deploy custom tasks that will execute arbitrary code. You will only be able to request the agent to execute an inventory or things like this.

Hope it helps !

[t101804]

Its possible , in inventory glpi there is a feature such as "Package Deployment" where we can execute something on it
https://help.glpi-project.org/tutorials/inventory/glpiinventory_deploy
you can look in the docs where example was running binary installer for firefox

Humm, that's an interesting idea.
In fact you can requests agent to do some tasks such as 'inventory' or even other thing if agent's plugins are enabled.

However, there is no way (for what I know) to deploy custom tasks that will execute arbitrary code. You will only be able to request the agent to execute an inventory or things like this.

Hope it helps !

[Guilhem7]

Oh yes indeed it seems possible !
I will try to look into it when I have time. Still from what I saw, this task seems not enabled by default on glpi-agent.

[t101804]

Oh yes indeed it seems possible ! I will try to look into it when I have time. Still from what I saw, this task seems not enabled by default on glpi-agent.

https://help.glpi-project.org/tutorials/inventory/deploy_agent_gpo

its enabled by default in the docs showed it

SetupOptions = "/quiet RUNNOW=1 ADD_FIREWALL_EXCEPTION=1 SERVER='http://glpi.yourcompany.com/front/inventory.php' TAG=MONTAG TASKS=inventory,deploy,collect,inventory"

deploy is enabled in the docs

[Guilhem7]

Thank you very much, I will look into it 😄 It could be a nice way for lateral movement.

The deploy task seems enabled by default until glpi-agent 1.8, stated here. I will try to setup this when I have more time ⏲️

Thanks again !!