bouquets-ai/cve-2021-43798Batch verification script for CVE-2021-43798 in Grafana, written in Go, with 48 built-in checks to identify vulnerable instances and download the database file.
A batch verification script written in Golang, with 48 built-in verifications
Too many people write it in Python, so I'm trying to learn Golang
Save the URL addresses as url.txt, then run go run CVE-2021-43798.go in the current directory. Vulnerable addresses will be saved to test.txt
After confirming the vulnerability exists, access var/lib/grafana/grafana.db
to download this database file and open the user table
The password is salted, so it generally cannot be cracked (the salt is used to protect short passwords from being exposed by rainbow tables, i.e., the collision salt is a random value. The encryption formula is roughly md5 (md5 (passwd)+salt), and the cracking difficulty increases exponentially with each additional character)
It was found that when the login is admin, the password is usually also admin
Just log in, but remember to change the IP or log in from a virtual machine, as detailed records will be kept in the backend
